Chief Compliance Officers Now Targeted For Data Breaches

The Securities and Exchange Commission (SEC) has made it clear that cybersecurity is a top priority. In a series of recent speeches, officials have focused attention on chief compliance officers and emphasized that chief compliance officers may be in the agency’s crosshairs when breaches occur.

The SEC announced that it plans to conduct a second round of cybersecurity compliance exams in the near future. Issues of concern include governance and risk assessment, access rights and controls, data loss prevention, vendor management, training, and incident response.

In September, the SEC brought and settled charges against R.T. Jones Capital Equities Management. The agency alleged that the adviser failed to establish the required cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information of approximately 100,000 individuals. While financial firms will largely face liability for cybersecurity compliance failures, CCOs who shirk their duties could themselves also be on the receiving end of an enforcement action.

In remarks at the NRS 30th Annual Fall Investment Adviser and Broker-Dealer Compliance Conference, SEC Chief of Staff Andrew J. Donohue stated that the agency would continue to bring enforcement actions against compliance officers when appropriate. He specifically highlighted that chief compliance officers that wholly fail to carry out their responsibility to implement compliance programs and policies, including those involving cybersecurity and data privacy, could face an SEC enforcement action. However, he also reiterated the agency’s position that the agency does “not bring cases based on second-guessing compliance officers’ good faith judgments.”

In an October 16 speech, SEC Chair Mary Jo White further reiterated the importance of cybersecurity measures, noting that advisers are encouraged to assess their “ability to prevent, detect and respond to attacks in light of their compliance obligations under the federal securities laws.” She further stated:

Cybersecurity is the shared responsibility of all regulators and market participants, including investment advisers, to guard the broader financial system against intrusions. While cybersecurity attacks cannot be entirely eliminated, it is incumbent upon private fund advisers to employ robust, state-of-the-art plans to prevent, detect, and respond to such intrusions.

The bottom line is that chief compliance officers must be proactive when addressing cybersecurity.

As a starting point, regulated financial firms should consult the SEC’s Cybersecurity Guidance issued earlier this year. It advises that all firms should take the following compliance steps:

1. Conduct a periodic assessment of:
   1. the nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses;
   2. internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems;
   3. security controls and processes currently in place;
   4. the impact should the information or technology systems become compromised; and
   5. the effectiveness of the governance structure for the management of cybersecurity risk. An effective assessment would assist in identifying potential cybersecurity threats and vulnerabilities so as to better prioritize and mitigate risk.
2. Create a strategy that is designed to prevent, detect and respond to cybersecurity threats. Such a strategy could include:
   1. controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls and/or perimeter defenses, tiered access to sensitive information and network resources, network segregation, and system hardening;
   2. data encryption;
   3. protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events;
   4. data backup and retrieval; and
   5. the development of an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.

Implement the strategy through written policies and procedures and training that provide guidance to officers and employees concerning applicable threats and measures to prevent, detect and respond to such threats, and that monitor compliance with cybersecurity policies and procedures. Firms may also wish to educate investors and clients about how to reduce their exposure to cybersecurity threats concerning their accounts.