Joint Letter to SEC on Cybersecurity Risk Management Rule, New Rule 10 Proposal

Dear Secretary Countryman,

The Securities Industry and Financial Markets Association ("SIFMA"), Bank Policy Institute ("BPI"), Institute of International Bankers ("IIB"), and American Bankers Association ("ABA"), (collectively, the "associations") appreciate the opportunity to respond to the Rule 10 Proposal issued by the Securities and Exchange Commission (the "Commission" or "SEC") on March 15, 2023 ("Rule 10 Proposal" or the "Proposal"). The associations recognize the importance of providing cybersecurity risk management rules for the entities covered by the Proposal ("Market Entities"), including broker-dealers and security-based swap dealers. A well-designedSEC rule could provide further clarity and guidance on strong cybersecurity practices, collaboration with government agencies, and proper cyber breach reporting. However, the associations recommend that the Commission significantly revise the notice of proposed rulemaking in line with essential cross-government harmonization, greater simplicity and flexibility, appropriate deference to the input of other government agencies, and thoughtful consideration of the burdens, impacts, and justifications for certain of the proposed requirements in the Proposal.

The Commission should reconsider significant aspects of its Rule 10 Proposal to allow the necessary flexibility for Market Entities to respond to unique circumstances that can arise during a cybersecurity incident. The Rule 10 Proposal should also account for the Commission's other proposals and existing cybersecurity requirements imposed by other financial regulators.

Download the joint comment letter to read the full text.