My thoughts: It's well thought out and inherits from a variety of other global benchmarks. Save for the legal interpretation, I think it's a good start.
However, it is quite silent on emerging threats and trends such as;
- Authority to use defensive measures over and above passive protection of your digital assets- Mitigation of a threat is limited to the threat itself as harming the I.S in itself isn't allowed in this provision. (Think Cyber Warfare)
- Disclosure principles: - elicit disclosure of timely, and accurate information about risks and events that a reasonable investor would consider important to an investment decision. This isn't covered anywhere and currently such disclosures are treated with hostility as opposed to meaningful conversation.
Otherwise, a way better informed bill as opposed to the "other one"
-tyrus