The SEC’s 2022 adviser-and-fund cybersecurity proposal was not a final rule, and its reported 48-hour incident-reporting deadline should not be treated as a current legal requirement. The SEC’s rulemaking index later listed a June 12, 2025 withdrawal action that includes proposal file S7-04-22; the index entry signals a later procedural development but does not, by itself, establish the precise legal effect on every proposed provision.
What the SEC did in February 2022
On February 9, 2022, the Securities and Exchange Commission voted 3-1 to approve a recommendation to issue a cybersecurity proposal for investment advisers and funds. The contemplated next step was publication for public comment. That vote moved a proposal forward; it did not adopt a final rule or create an effective reporting duty. CyberScoop’s account of the vote described the measure as proposed.
As an Amazon Associate I earn from qualifying purchases.
What the proposal reportedly would have required
CyberScoop reported that the proposal would require covered advisers and funds to submit confidential reports to the SEC within 48 hours after significant cybersecurity incidents. The 48-hour period was a proposed reporting concept in the 2022 account, not a deadline that readers should assume applies today.
The reported baseline safeguards included:
- Assessing cybersecurity risks;
- Establishing user security and access controls;
- Protecting information and monitoring for unauthorized use; and
- Conducting an annual written review of cybersecurity risks and policies for board review.
These are descriptions of proposed terms in the contemporaneous news report. For the proposal’s precise scope, definitions, exceptions, and reporting mechanics, the primary text is the SEC’s 2022 proposed-rule document: Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies.
#1 Best Overall
SEC reporting and investor disclosure were different questions
The 48-hour concept concerned a confidential report to the SEC. Separately, commissioners sought public input on how advisers and funds should disclose cybersecurity risks and incidents to investors. CyberScoop reported that the proposal did not specify the timing or extent of those investor-facing disclosures. A regulator report and a disclosure to investors are different obligations with different recipients; the reported deadline should not be applied to investor notices.
What the later withdrawal entry establishes
The SEC’s rulemaking activities index lists a June 12, 2025 final action titled “Withdrawal of Proposed Regulatory Actions” and includes file S7-04-22. Because the index entry groups multiple proposed actions, it establishes a later withdrawal signal associated with this file, but the index text alone does not resolve exactly which proposed provisions were withdrawn or the full legal consequences. It does establish that the February 2022 headline is historical, not a description of a proposal one step from a current vote.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not confuse it with the SEC’s 2023 public-company rule
The SEC also adopted a separate 2023 cybersecurity disclosure rule for public companies. That rulemaking is distinct from the 2022 adviser-and-fund proposal: the covered entities and disclosure context differ. The 2023 final-rule document is available at Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Its existence does not make the proposed adviser-and-fund 48-hour reporting framework an adopted requirement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Rank #4
What readers should take away
- The 2022 vote advanced a recommendation for a proposal, not a final rule.
- The 48-hour SEC report and cybersecurity-program measures were reported as proposed terms.
- Investor disclosure was a separate design issue; the 2022 account said its timing and extent were not specified.
- The SEC’s index lists a 2025 withdrawal action that includes S7-04-22, but the index entry alone does not define the precise effect on every provision.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
