Tighter SEC cybersecurity pushed by reintroduced legislation

Reps. Barry Loudermilk, R-Ga., and David Scott, D-Ga., have reintroduced the SEC Data Protection Act of 2025, which would require the Securities and Exchange Commission to strengthen its cybersecurity practices, reports The Record, a news site by cybersecurity firm Recorded Future.

The lawmakers said the measure would create consistent rules for how the SEC collects, stores, and protects sensitive information from advisers, investors, and other market participants. Under the proposal, the SEC would be required to update its cybersecurity protocols to match federal and National Institute of Standards and Technology guidelines, while also ensuring the security of the data provided by financial advisers.

Scott said recent breaches across federal financial agencies show that the SEC must modernize its protections to maintain public trust. With the bill set to take effect a year after passage, the lawmakers, who are both senior members of the House Financial Services Committee, are pushing for action after a similar effort in 2020 failed to advance.