The Securities and Exchange Commission (SEC) is proposing new rules that would force capital market participants to establish individual cyber resilience frameworks, part of a broader push to protect investors and ensure market stability.

The SEC on Dec. 17 released a draft memorandum circular outlining guidance for regulated entities. The proposal aligns with the government’s National Cybersecurity Plan 2023-2028, which treats digital security as a pillar of economic development.

Under the draft rules, companies must adopt frameworks that define cyber risk tolerance and establish procedures to identify and mitigate threats. The mandate covers a broad swath of the financial sector, including publicly listed companies, broker-dealers, investment houses, exchanges, and clearing agencies.

The proposed regulations place ultimate responsibility on boards of directors to oversee cyber risks and to appoint a Computer Emergency Response Team. Companies would also be required to create a Chief Information Security Officer role to lead these teams and act as a primary liaison with regulators and system owners.

The commission is also targeting risks within the supply chain. Covered entities would remain liable for the security of their systems even when managed by third parties.

Those relying on external critical information infrastructure must secure legally binding commitments that vendors will meet cybersecurity standards, including auditing and incident reporting.

Material cyber incidents must be disclosed to the SEC within five days of occurrence. Reports must detail the nature and timing of the breach, as well as its impact on the company’s financial condition and operations.