Good day. The U.S. Securities and Exchange Commission held a marathon cyber session Wednesday, approving proposals for new rules and amendments to existing regulations that could bring new compliance obligations to a broad swath of market participants. They now go to the public comment phase.

Among the new provisions is a three-part proposal that would force broker-dealers, clearinghouses, stock exchanges and other financial institutions to implement written cybersecurity policies, apply stringent reporting requirements in the event of an attack, and mandate public disclosures.

More on the proposals further down.

Also today: Amazon, Experian fight privacy sanctions to preserve data-based business models, carving paths for more businesses to challenge regulators. Get the full story. 

More news: 

• U.S. issues TikTok ultimatum
• Russia steps up cyber espionage, Microsoft says
• More than 4 million affected in the latest healthcare breach
• ChipMixer taken down

With Business Models in the Balance, Courts Side With Big Companies in Privacy Appeals

European courts have handed wins to Experian PLC, Amazon.com Inc. and Italian energy giant Enel SpA in recent rulings, in some cases striking down multimillion-dollar fines and reaffirming companies’ arguments that their data practices comply with the General Data Protection Regulation.

Companies have appealed GDPR decisions since the expansive privacy law took effect in 2018 in an effort to fight reputational harm and large fines.

Now companies see entire business models at stake.

Read the full story. 

• TikTok CEO Shou Zi Chew (pictured) is slated to appear before a congressional panel next week.
• “If protecting national security is the objective, divestment doesn’t solve the problem: a change in ownership would not impose any new restrictions on data flows or access, ” a TikTok spokeswoman said.

Read the full story.

Ransomware attackers penetrated networks at 860 critical infrastructure operators in 2022, according to the FBI's latest annual internet crime report. LockBit, BlackCat and Hive were the most common strains and healthcare was by far the most-attacked sector, followed by manufacturing and government organizations. (Bleeping Computer)

The Securities and Exchange Commission on Wednesday approved a number of proposals for new rules and amendments to existing regulations, to toughen cyber defenses at a range of financial institutions.

The proposals, which effectively cover most major market participants aside from the smallest broker-dealers, contain significant new requirements for reporting cyber incidents to the agency and the public.

The SEC also reopened the comment period for proposals covering similar areas for investment-management companies and advisers published in February 2022, allowing an additional 60 days for interested parties to weigh in.

More disclosures: Wednesday’s proposals include rules to require financial companies to develop written cybersecurity processes and review them regularly. Those that suffer a cyberattack would be required to immediately notify the SEC and provide updates as details are uncovered. Companies also must make public disclosures about their cyber risks and previous significant incidents.

Who's affected? Broker-dealers, the Municipal Securities Rulemaking Board, clearing agencies, stock exchanges, data repositories and transfer agents are among the organizations that would have to comply.

“Investors, issuers and market participants alike would benefit from knowing that these entities have in place protections fit for a digital age, and the proposal, if adopted, would help promote every part of our mission, particularly regarding investor protection and orderly markets,” said Gary Gensler, the agency’s chair, before the vote.

Commissioners voted three-to-two to pass the proposal for the new rule, with Hester Peirce and Mark Uyeda, the two Republican commissioners, voting against.

Objection: “I could not help but wonder, as I read through the more than 500 pages that make up this proposal, whether we at the Commission are living up to the proposed standards,” Ms. Peirce said, adding that she believes the SEC should correct cyber issues with existing projects before issuing new rules.

—James Rundle

Write to the WSJ Pro Cybersecurity Team: Kim S. Nash, James Rundle and Catherine Stupp. 

Follow us on Twitter: @knash99, @catstupp and @WSJCyber.

Contact Enterprise Technology Editor Steve Rosenbush at steven.rosenbush@wsj.com. Follow him on Twitter: @Steve_Rosenbush.