The SEC alleges SolarWinds defrauded investors by failing to disclose gaps in their security practices later exploited by Russian hackers.

The U.S. famously does not have a federal privacy law and instead relies on 50 different state laws governing breach notification.

The proposed rule would give institutions 48 hours to report a cyber incident to the agency.

The SEC joins TSA, the FCC and other feds who have imposed or are considering imposing additional disclosure requirements.

The rule change could create additional reporting requirements for companies.

Aides continue to negotiate in a bid to overcome the dispute.

The agency also tightened security requirements for financial institutions.

Congress has debated over federal privacy legislation for years.

Industry groups favor a House bill over a stricter Senate proposal.

The breach has sparked lawmaker concern.