In Deregulatory Climate, Critics of Cybersecurity Rules Get Heard

At a time of regulatory rollbacks and recalibrations, companies and industries are pushing back on cybersecurity rules, calling for changes to reduce costs and eliminate duplicative reporting requirements.

Such complaints were aired before and since rulemakings by the U.S. Cybersecurity and Infrastructure Security Agency, the Securities and Exchange Commission, and others including financial industry overseers that specified tight deadlines for reporting of cyber breaches. Under new Republican leadership, the SEC in June withdrew several proposals from the prior administration. One was for broker-dealers, clearing agencies and other covered entities to make “immediate notification to the commission of the occurrence of a significant cybersecurity incident.”

Representing a united front among advocacy groups, a May 22 comment letter from the American Bankers Association, Bank Policy Institute and others told the SEC that after 18 months in effect, cyber incident disclosures for Form 8-K Item 1.05 had proven to be premature, confusing, unhelpful to investors, and weaponized by hackers using “the rule's prescriptive requirements as...