Why Is The SEC So Fixated On The Changing Nature of Cyber Threats?

Why Is The SEC So Fixated On The Changing Nature of Cyber Threats?

Financial firms are attractive targets for cyberattacks, given that they possess valuable financial assets and client data. In fact, one recent report recently dubbed them “candy stores” for hackers.

While cybersecurity is considered a top threat, regulators continue to express concern that many registered advisers are not yet adequately prepared. Late last month, the Securities and Exchange Commission (SEC) published revised cybersecurity guidance, which reflects the rapidly changing nature of cyber threats.

The SEC’s latest recommendations reflect discussions concerning cybersecurity with fund boards and senior management and advisers during the course of the Division of Investment Management’s senior level engagement and monitoring efforts as well as feedback from the Office of Compliance Inspections and Examinations’ review of adviser cybersecurity practices.

According to the SEC, advisers should identify their respective compliance obligations under the federal securities laws and take into account these obligations when assessing their ability to prevent, detect and respond to cyber attacks. It further suggests that advisers and funds consider the following measures when addressing cybersecurity risk:

• Conduct a periodic assessment of: (1) the nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses; (2) internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems; (3) security controls and processes currently in place; (4) the impact should the information or technology systems become compromised; and (5) the effectiveness of the governance structure for the management of cybersecurity risk.
• Create a strategy that is designed to prevent, detect and respond to cybersecurity threats. Such a strategy may include: (1) controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls and/or perimeter defenses, tiered access to sensitive information and network resources, network segregation, and system hardening; (2) data encryption; (3) protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events; (4) data backup and retrieval; and (5) the development of an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.
• Implement the strategy through written policies and procedures and training
  that provide guidance to officers and employees concerning applicable threats and measures to prevent, detect and respond to such threats, and that monitor compliance with cybersecurity policies and procedures. Firms may also wish to educate investors and clients about how to reduce their exposure to cyber security threats concerning their accounts.

The SEC guidance notes that advisers should tailor their compliance programs based on the nature and scope of their businesses. It further emphasizes that because funds and advisers rely on a number of service providers in carrying out their operations, they should also determine whether these third parties also have appropriate cybersecurity measures in place.