The Securities and Exchange Commission (SEC) is proposing rules that would require capital market companies to set up cyber resilience frameworks.

The regulator said Thursday the move would increase oversight and reporting for publicly listed firms, broker-dealers, exchanges, and other market participants.

Draft circular

The SEC released a draft circular for public comment titled Guidance for Regulated Entities on Establishing and Maintaining a Cyber Resilience Framework on 17 December. 

The guidance aims to protect investors, build trust, and promote stability in the Philippine capital market, aligned with the National Cybersecurity Plan 2023 to 2028.

Under the proposal, companies must adopt a framework outlining objectives, risk tolerance, and procedures to identify, mitigate, and manage cyber risks. 

Overseeing cybersecurity threats

Boards would oversee cybersecurity threats and ensure the creation of a Computer Emergency Response Team led by a chief information security officer (CISO).

“The CISO will be responsible for carrying out the responsibilities of the chief information officer and serving as the primary liaison to the company’s authorizing officials, information system owners, and information system security officers,” the draft read.

Companies would also be responsible for cybersecurity in systems managed by third parties. 

Legally binding agreements

Those relying on third-party Critical Information Infrastructure must have legally binding agreements to meet cybersecurity standards, including incident reporting, auditing, and risk assessment.

Entities experiencing a material cyber incident would need to report it to the SEC within five days, detailing its nature, scope, timing, and any impact on operations or finances.

If adopted, the framework could require companies to invest in staff, technology, and processes to strengthen defenses against cyber threats, while also raising compliance costs.