Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-5562" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/01/Data-breach_securities-fraud_digital-1.jpg" alt="" width="345" height="230" />It may be a new decade, but the focus of the Securities and Exchange Commission (SEC) on cybersecurity has not shifted. In particular, the SEC noted in its <a href="https://www.sec.gov/about/offices/ocie/national-examination-program-priorities-2020.pdf?mod=article_inline">2020 Examination Priorities</a> that the Office of Compliance Inspections and Examinations (OCIE) “will continue to prioritize cyber and information security risks across the entire examination program.” This pronouncement and other recent regulatory guidance underscore the risk of potentially far-reaching harm that breaches and security incidents pose to market participants and retail investors. Building on its earlier guidance (previously covered <a href="https://www.bakerlaw.com/alerts/the-three-cs-for-investment-advisers-compliance-attention-in-2019">here</a>), OCIE emphasized a cooperative approach to help firms identify and address these risks, bolster compliance programs to protect against them, and encourage engagement with regulators and law enforcement.

OCIE also indicated that SEC exam staff will continue to focus on investment advisers’ policies, procedures and controls with respect to:
<ul>
 	<li>Governance and risk management</li>
 	<li>Access controls</li>
 	<li>Data loss prevention</li>
 	<li>Vendor management</li>
 	<li>Training</li>
 	<li>Incident response and resiliency</li>
</ul>


To help firms address these areas, OCIE referenced its Risk Alerts on <a href="https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Network%20Storage.pdf">configuring network storage</a> and <a href="https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf">safeguarding customer information</a> (previously covered <a href="https://www.bakerlaw.com/alerts/sec-updates-data-privacy-and-cybersecurity-guidance-for-registered-firms">here</a>). Among other things, these alerts urged firms to:
<ul>
 	<li>Properly configure network storage solutions</li>
 	<li>Adequately monitor vendors</li>
 	<li>Accurately classify data and inventory systems</li>
 	<li>Timely provide privacy and opt-out notices</li>
 	<li>Avoid boilerplate programs by conducting risk assessments and tailoring policies, procedures and controls</li>
 	<li>Prepare incident response plans and train employees</li>
 	<li>Address common risks posed by personal devices, electronic communications, networks and outside vendors</li>
</ul>
Notably, OCIE announced in its 2020 Examination Priorities that it plans to scrutinize access controls for online accounts and mobile applications as well as proper disposal of retired hardware that may contain sensitive customer or network information.

Given the SEC’s continued focus here, firms of all stripes – including broker-dealers, investment companies, investment advisers and private funds – should be prepared for OCIE to closely examine their written information security programs, internal controls, and compliance with Regulation S-P and Regulation S-ID. After all, it’s 2020 and the risks remain.

Cybersecurity Remains a Top SEC Examination Priority in the New Decade