Scarinci Hollenbeck, LLC, LLCScarinci Hollenbeck, LLC, LLC

Firm Insights

Chief Compliance Officers Now Targeted For Data Breaches

Author: Scarinci Hollenbeck, LLC

Date: November 13, 2015

Key Contacts

Back

The Securities and Exchange Commission (SEC) has made it clear that cybersecurity is a top priority. In a series of recent speeches, officials have focused attention on chief compliance officers and emphasized that chief compliance officers may be in the agency’s crosshairs when breaches occur.

The SEC announced that it plans to conduct a second round of cybersecurity compliance exams in the near future. Issues of concern include governance and risk assessment, access rights and controls, data loss prevention, vendor management, training, and incident response.

The Securities and Exchange Commission (SEC) has made it clear that cybersecurity is a top priority. In a series of recent speeches, officials have focused attention on chief compliance officers and emphasized that chief compliance officers may in the agency’s crosshairs when breaches occur.

In September, the SEC brought and settled charges against R.T. Jones Capital Equities Management. The agency alleged that the adviser failed to establish the required cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information of approximately 100,000 individuals. While financial firms will largely face liability for cybersecurity compliance failures, CCOs who shirk their duties could themselves also be on the receiving end of an enforcement action.

In remarks at the NRS 30th Annual Fall Investment Adviser and Broker-Dealer Compliance Conference, SEC Chief of Staff Andrew J. Donohue stated that the agency would continue to bring enforcement actions against compliance officers when appropriate. He specifically highlighted that chief compliance officers that wholly fail to carry out their responsibility to implement compliance programs and policies, including those involving cybersecurity and data privacy, could face an SEC enforcement action. However, he also reiterated the agency’s position that the agency does “not bring cases based on second-guessing compliance officers’ good faith judgments.”

In an October 16 speech, SEC Chair Mary Jo White further reiterated the importance of cybersecurity measures, noting that advisers are encouraged to assess their “ability to prevent, detect and respond to attacks in light of their compliance obligations under the federal securities laws.” She further stated:

Cybersecurity is the shared responsibility of all regulators and market participants, including investment advisers, to guard the broader financial system against intrusions. While cybersecurity attacks cannot be entirely eliminated, it is incumbent upon private fund advisers to employ robust, state-of-the-art plans to prevent, detect, and respond to such intrusions.

The bottom line is that chief compliance officers must be proactive when addressing cybersecurity.

As a starting point, regulated financial firms should consult the SEC’s Cybersecurity Guidance issued earlier this year. It advises that all firms should take the following compliance steps:

  1. Conduct a periodic assessment of:
    1. the nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses;
    2. internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems;
    3. security controls and processes currently in place;
    4. the impact should the information or technology systems become compromised; and
    5. the effectiveness of the governance structure for the management of cybersecurity risk. An effective assessment would assist in identifying potential cybersecurity threats and vulnerabilities so as to better prioritize and mitigate risk.
  2. Create a strategy that is designed to prevent, detect and respond to cybersecurity threats. Such a strategy could include:
    1. controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls and/or perimeter defenses, tiered access to sensitive information and network resources, network segregation, and system hardening;
    2. data encryption;
    3. protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events;
    4. data backup and retrieval; and
    5. the development of an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.

Implement the strategy through written policies and procedures and training that provide guidance to officers and employees concerning applicable threats and measures to prevent, detect and respond to such threats, and that monitor compliance with cybersecurity policies and procedures. Firms may also wish to educate investors and clients about how to reduce their exposure to cybersecurity threats concerning their accounts.

    No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

    Scarinci Hollenbeck, LLC, LLC

    Related Posts

    See all
    Can You Change an Irrevocable Trust in New Jersey? post image

    Can You Change an Irrevocable Trust in New Jersey?

    In New Jersey, an irrevocable trust can sometimes be modified even though its name suggests otherwise, and one of the primary tools for doing so is a process called decanting. Whether decanting is available depends on the specific terms of the trust and the discretion given to the trustee. Key takeaways: New Jersey has no […]

    Author: Marc J. Comer

    Link to post with title - "Can You Change an Irrevocable Trust in New Jersey?"
    How Intellectual Property Valuation Will Impact Business Transactions post image

    How Intellectual Property Valuation Will Impact Business Transactions

    Intellectual property valuation determines the monetary value of a business’s IP assets, and it drives outcomes in licensing deals, joint ventures, mergers and acquisitions, financing, and ownership disputes. The most valuable assets of a business are often the things that cannot be seen or touched: a proprietary process, a copyrighted work, brand recognition, or the […]

    Author: Jay McDaniel

    Link to post with title - "How Intellectual Property Valuation Will Impact Business Transactions"
    Data Center, Dark Fiber, and Lit Services Agreements in New Jersey: Key Terms and Legal Pitfalls post image

    Data Center, Dark Fiber, and Lit Services Agreements in New Jersey: Key Terms and Legal Pitfalls

    For New Jersey data center owners and operators, a service agreement may look routine when it is signed. The network is functioning, the vendor is meeting its installation schedule, and the parties have agreed on pricing and performance specifications. The provisions that seem most important at that stage are often the technical ones. That changes […]

    Author: George McGowan

    Link to post with title - "Data Center, Dark Fiber, and Lit Services Agreements in New Jersey: Key Terms and Legal Pitfalls"
    Fort Monmouth Redevelopment and the Transformation of Monmouth County Real Estate post image

    Fort Monmouth Redevelopment and the Transformation of Monmouth County Real Estate

    The Fort Monmouth redevelopment has entered its execution phase, and it is repositioning the broader Monmouth County real estate market. When Netflix and the Fort Monmouth Economic Revitalization Authority closed on the 292-acre Mega Parcel in December 2025, the transaction did more than hand over a deed. It marked the moment Fort Monmouth stopped being […]

    Author: Donald M. Pepe

    Link to post with title - "Fort Monmouth Redevelopment and the Transformation of Monmouth County Real Estate"
    Local Zoning and Land Use Rules Every New Jersey Rental Property Owner Should Understand post image

    Local Zoning and Land Use Rules Every New Jersey Rental Property Owner Should Understand

    Owning a residential rental property in New Jersey involves more than finding tenants and collecting rent. Property owners must comply with a combination of state laws, municipal ordinances, building and housing codes, and zoning and land use regulations. These requirements can affect everything from the number of dwelling units permitted at a property to whether […]

    Author: Donald M. Pepe

    Link to post with title - "Local Zoning and Land Use Rules Every New Jersey Rental Property Owner Should Understand"
    Real Estate Litigation Explained: Top 5 Disputes and How to Avoid Them post image

    Real Estate Litigation Explained: Top 5 Disputes and How to Avoid Them

    The five most common real estate disputes are breach of contract claims, landlord-tenant conflicts, zoning and land use disagreements, construction claims, and boundary disputes. Understanding why each arises, and taking preventive steps early, can help property owners, tenants, developers, and investors avoid costly litigation. Key Takeaways: Real estate transactions are complex endeavors involving numerous parties […]

    Author: Paul Grossman

    Link to post with title - "Real Estate Litigation Explained: Top 5 Disputes and How to Avoid Them"

    No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

    Sign up to get the latest from our attorneys!

    Explore What Matters Most to You.

    Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.

    Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.

    Let`s get in touch!

    * The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship. Confidential or time-sensitive information should not be sent through this form. By providing a telephone number and submitting this form you are consenting to be contacted by SMS text message. Message & data rates may apply. Message frequency may vary. You can reply STOP to opt-out of further messaging.
    “If you would like to submit a file, please email it directly to info@sh-law.com.

    Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!