Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comAuthor: Scarinci Hollenbeck, LLC|November 11, 2015
On Sept 22, 2015, the SEC announced its settlement of an administrative cease-and-desist proceeding through imposition of remedial sanctions against R.T. Jones Capital Equities Management, Inc., an SEC-registered investment adviser.[1]
This is the first enforcement matter establishing a willful violation of Rule 30(a) of Regulation S-P under the Securities Act of 1933, known as the “Safeguards Rule.”[2] This proceeding is instructive for its itemization of the advisor’s failures over an extensive time period.
Interestingly, although the advisor discovered a possible cybersecurity breach at its third-party-hosted web server, and retained two cybersecurity consulting firms to independently confirm the cyber-attack, assess the scope of the breach and whether personally identifiable information (“PII”) stored on the server had been compromised, the attack did not appear to have caused any financial harm to any firm client. The firm’s failure to have the “basics” of a cybersecurity regime, however, was sufficient for the SEC to impose sanctions.[3]
The SEC determined that the advisor violated the Safeguards Rule, adopted in 2000, and amended in 2005, which requires adoption of written policies and procedures reasonably designed to safeguard client’s PII. The adviser took certain remedial efforts by appointing an information security manager over its PII data security and implemented a written information security policy, which included: (a) moving off of a web server-hosted server, (b) encrypting PII, installing a new firewall and log-in system, and (c) retaining a cybersecurity firm to provide a report/advice on IT security. These efforts should be viewed as the minimum requirements the SEC’s OCIE and enforcement staff’s expect from a firm’s cybersecurity program.
What are the “takeaways” from this enforcement action? Firm management CIO’s/CTO’s and CCO’s should take into account when considering the severity of the sanctions imposed against R.T. Jones that during the past 18 months, OCIE published two Risk Alerts on cybersecurity, and the SEC published a “Guidance Update,” and hosted a Cybersecurity Roundtable.[4] There will not be much room for advisers to attempt to excuse their cybersecurity deficiencies in the context of this educational effort.
Cybersecurity remains a focus of OCIE and Enforcement. The time is now to plan and implement a year-end reassessment of firm cybersecurity breach readiness and Incident Response Plan. (“IRP”)
Here are “actionable ideas” for assuring your firm (whether a broker-dealer, or investment adviser) has satisfied Cybersecurity basics:
[1] Order available at http://www.sec.gov/litigation/admin/2015/ia-4204.pdf; Press Release at http://www.sec.gov/news/pressrelease/2015-202.html.[2] 17 C.F.R. §248-30(a).[3] The Advisor was also censured and required to pay a $75,000 civil penalty.[4] OCIE’s 2015 Cybersecurity Examination Initiative, IV National Exam Program Risk Alert, Sept. 15, 2015, https://www.sec.gov/ocie/announcement/ocie-2015 – cybersecurity-examination.initiative.pdf. National Exam Program Risk Alert, Feb. 3, 2015, at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf. IM Guidance Update No. 2015-02 (April 2015), at http://www.sec.gov/investment/im-guidance-2015-02.pdf
The Firm
201-896-4100 info@sh-law.comOn Sept 22, 2015, the SEC announced its settlement of an administrative cease-and-desist proceeding through imposition of remedial sanctions against R.T. Jones Capital Equities Management, Inc., an SEC-registered investment adviser.[1]
This is the first enforcement matter establishing a willful violation of Rule 30(a) of Regulation S-P under the Securities Act of 1933, known as the “Safeguards Rule.”[2] This proceeding is instructive for its itemization of the advisor’s failures over an extensive time period.
Interestingly, although the advisor discovered a possible cybersecurity breach at its third-party-hosted web server, and retained two cybersecurity consulting firms to independently confirm the cyber-attack, assess the scope of the breach and whether personally identifiable information (“PII”) stored on the server had been compromised, the attack did not appear to have caused any financial harm to any firm client. The firm’s failure to have the “basics” of a cybersecurity regime, however, was sufficient for the SEC to impose sanctions.[3]
The SEC determined that the advisor violated the Safeguards Rule, adopted in 2000, and amended in 2005, which requires adoption of written policies and procedures reasonably designed to safeguard client’s PII. The adviser took certain remedial efforts by appointing an information security manager over its PII data security and implemented a written information security policy, which included: (a) moving off of a web server-hosted server, (b) encrypting PII, installing a new firewall and log-in system, and (c) retaining a cybersecurity firm to provide a report/advice on IT security. These efforts should be viewed as the minimum requirements the SEC’s OCIE and enforcement staff’s expect from a firm’s cybersecurity program.
What are the “takeaways” from this enforcement action? Firm management CIO’s/CTO’s and CCO’s should take into account when considering the severity of the sanctions imposed against R.T. Jones that during the past 18 months, OCIE published two Risk Alerts on cybersecurity, and the SEC published a “Guidance Update,” and hosted a Cybersecurity Roundtable.[4] There will not be much room for advisers to attempt to excuse their cybersecurity deficiencies in the context of this educational effort.
Cybersecurity remains a focus of OCIE and Enforcement. The time is now to plan and implement a year-end reassessment of firm cybersecurity breach readiness and Incident Response Plan. (“IRP”)
Here are “actionable ideas” for assuring your firm (whether a broker-dealer, or investment adviser) has satisfied Cybersecurity basics:
[1] Order available at http://www.sec.gov/litigation/admin/2015/ia-4204.pdf; Press Release at http://www.sec.gov/news/pressrelease/2015-202.html.[2] 17 C.F.R. §248-30(a).[3] The Advisor was also censured and required to pay a $75,000 civil penalty.[4] OCIE’s 2015 Cybersecurity Examination Initiative, IV National Exam Program Risk Alert, Sept. 15, 2015, https://www.sec.gov/ocie/announcement/ocie-2015 – cybersecurity-examination.initiative.pdf. National Exam Program Risk Alert, Feb. 3, 2015, at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf. IM Guidance Update No. 2015-02 (April 2015), at http://www.sec.gov/investment/im-guidance-2015-02.pdf
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.