Section 1. Short title
This Act may be cited as the SEC Cybersecurity Act of 2024.
Section 2. GAO audit of information technology infrastructure and handling of data
The Comptroller General of the United States shall, not later than 1 year after the date of the enactment of this Act—
(1) perform an independent audit of the information technology (IT) infrastructure of the Securities and Exchange Commission and the Commission’s handling of data, including—
(A) a comparison of the Commission’s IT spending to other Federal financial regulators, including—
(i) the total amount spent on IT equipment and services; and
(ii) the amount of IT spending in proportion to each regulator’s total spending;
(B) examining the quality and effectiveness of the Commission’s IT contracting;
(C) determining if the Commission’s data and cybersecurity systems and procedures are sufficient; and
(D) examining any recent Commission IT or data events, such as breaches or hacks, that may have compromised the Commission’s IT infrastructure or exposed a vulnerability; and
(2) provide to the Commission, the Committee on Financial Services of the House of Representatives, and the Committee on Banking, Housing, and Urban Affairs of the Senate a report containing—
(A) all findings and determinations made in conducting the audit; and
(B) recommendations for steps that can be taken to improve the Commission’s IT infrastructure.