US securities regulators have adopted new rules that require all US-listed companies, including those in the cryptocurrency industry, to disclose any major cybersecurity incidents within four days. The rules were adopted on July 26 and will take effect 30 days after publication in the Federal Register, according to the SEC. Public companies will need to disclose cyberattacks deemed "significant" within the given timeframe, unless such disclosure poses potential national security or public safety risks.
The rules also mandate regular reporting on the registrant's policies and procedures for identifying and managing cybersecurity risks, as well as providing updates on previously reported cybersecurity incidents. The SEC's aim is to strengthen cybersecurity risk management measures and protects investors by ensuring that crucial cybersecurity information is Promptly disclosed. SEC Chairman Gary Gensler believes these measures will benefit investors, companies, and the overall market.
The new rules are applicable to all public companies in the United States, including those in the cryptocurrency industry. Notable publicly listed crypto companies, such as Coinbase (COIN), Marathon Digital (MARA), Riot Blockchain (RIOT), and Hive Digital Technologies (HIVE), will be subject to these regulations. The increase in digital payments and digital operations in the workforce, combined with the profitability of cybersecurity incidents for criminals, necessitated these rules to safeguard investors and businesses alike.
The crypto industry has been a significant target for cybercriminals, particularly the North Korean state-backed Lazarus Group, which has conducted multiple high-profile attacks on cryptocurrency platforms, resulting in losses exceeding $850 million. The SEC's proposal al for the cybersecurity rule was initially put forward in March 2022, and its implementation aims to enhance transparency and prompt action in the face of cybersecurity threats faced by publicly listed companies and the cryptocurrency sector.
