Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4355 size-full" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/12/Data_Security_208x186.jpg" alt="" width="208" height="186" />On August 7, 2017, the Securities and Exchange Commission (SEC) released its latest <a href="https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf">cybersecurity risk alert</a>, detailing findings from the examination of 75 broker-dealers, investment advisers and investment companies carried out by its Office of Compliance Inspections and Examinations (OCIE) pursuant to its <a href="https://www.sec.gov/ocie/announcement/ocie-2015-cybersecurity-examination-initiative.pdf">2015 cybersecurity examination initiative</a>. In contrast with the previous round of examinations, the Cybersecurity 2 Initiative focused more on validating and testing cybersecurity procedures and controls, with the alert highlighting improvements, deficiencies and best practices for registered firms.

Although OCIE noted improvements across the board (with all or “nearly all” broker-dealers leading advisers and investment companies in a number of areas), it also identified a number of deficiencies.

Written Policies and Procedures

<img class="alignleft wp-image-5047 size-full" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />Firms generally scored high marks on maintaining written policies and procedures addressing cybersecurity, including Regulation S-P, Regulation S-ID, business continuity planning, the cybersecurity roles and responsibilities of their employees, and their response procedures to access incidents and intrusions that could cause service disruptions or lead to data breaches.

<img class="alignleft size-full wp-image-5048" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/x.jpg" alt="" width="23" height="23" />OCIE determined that some policies and procedures were not reasonably tailored, offering only “general guidance” and “limited examples of safeguards” or because they were “narrowly scoped” or “vague,” or were perceived as providing “contradictory or confusing instructions” that employees might find difficult to follow.

<img class="alignleft size-full wp-image-5048" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/x.jpg" alt="" width="23" height="23" />Some firms also did not follow their policies and procedures, conducting reviews less frequently than prescribed or failing to ensure that all employees completed their required cybersecurity awareness training. And other policies and procedures were stale. For example, OCIE reported that “less than two thirds” of advisers and funds appeared to maintain their data breach incident response plans.

Risk Assessments  

<img class="alignleft size-full wp-image-5047" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />Nearly all” broker-dealers and the “vast majority” of advisers and investment companies conducted periodic risk assessments of their information systems.

<img class="alignleft size-full wp-image-5047" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />“Almost all firms” conducted initial risk assessments of third-party service providers either directly or through various reports or certifications at the outset, and “over half of the firms” updated these assessments at least annually.

Penetration Testing and Vulnerability Scans

<img class="alignleft size-full wp-image-5047" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />“Nearly all” broker-dealers and “almost half” of advisers and investment companies conducted penetration tests and vulnerability scans on “critical” systems.

<img class="alignleft size-full wp-image-5048" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/x.jpg" alt="" width="23" height="23" />A “number” of firms failed to fully remediate certain risks identified through their penetration tests and vulnerability scans.

Data Loss Prevention 

<img class="alignleft size-full wp-image-5047" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />All broker-dealers and “nearly all” advisers and investment companies instituted procedures to maintain their information systems.

<img class="alignleft size-full wp-image-5048" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/x.jpg" alt="" width="23" height="23" />A “few” firms  failed to install system patches, including security updates, while others used outdated operating systems that no longer receive security patches.


Access Controls

<img class="alignleft size-full wp-image-5047" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/check.jpg" alt="" width="27" height="26" />All advisers and investment companies maintained written policies and procedures to verify the identity of a customer requesting a funds transfer.

<img class="alignleft size-full wp-image-5048" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/08/x.jpg" alt="" width="23" height="23" />Some broker-dealers failed to memorialize customer verification procedures for funds transfers, relying instead on informal practices for confirming a customer’s identity prior to honoring transfer requests. As scams involving fraudulent wire transfers proliferate, formal procedures and redundant safeguards to protect against unauthorized requests are key.

Best Practices. OCIE also provided a noncomprehensive list of best practices identified during its examinations, suggesting that firms consider implementing these measures to bolster their cybersecurity programs. In addition to encouraging firms to undertake the compliance efforts discussed above, OCIE recommended that firms consider steps such as:
<ul>
 	<li>Maintaining an inventory of their information assets and associated vendors, as applicable, classified by risks and vulnerabilities. This recommendation appears to go hand in hand with a firm’s ability to conduct its periodic risk assessments.</li>
 	<li>Tracking requests to access information systems, including policies and procedures for modifying access rights when hiring, terminating or changing responsibilities of employees. Although the risk alert did not specifically reference third-party service providers here, this recommendation likely would apply to them as well.</li>
 	<li>Requiring and enforcing restrictions and controls for mobile devices that access information systems, including password protection and encryption. This recommendation acknowledges evolving business practices, the ubiquity of mobile devices and the necessity of remote access.</li>
</ul>
Because cybersecurity remains one of the SEC’s top priorities, registered firms should, among other things, measure themselves against these improvements, deficiencies and best practices to ensure they are keeping up with regulatory expectations.

SEC Cybersecurity Risk Alert Emphasizes Proactive Compliance and Ongoing Vigilance