Cybersecurity gets the SEC's attention as agency plans to query advisers on safeguards

Regulator beginning to think computer breaches not only put clients at risk, they put the financial system at risk too

Apr 17, 2014 @ 2:25 pm

By Mark Schoeff Jr.

At a time when an online threat is panicking Internet users, the Securities and Exchange Commission has provided financial advisers with a detailed checklist of what it expects firms to provide in terms of cybersecurity protection.

The SEC on Tuesday posted a risk alert that outlines the areas it will assess in an upcoming examination of more than 50 registered investment advisers and broker-dealers.

The seven-page document contains 28 requests that cover an advisory firm's cybersecurity governance, ability to protect its networks and client information, ability to assess risks associated with remote client access and fund transfers and its use of vendors and other third parties.

The SEC also wants to know how a firm detects security breaches and what its experience has been with such incidents.

“Every financial firm in the U.S., and probably in the world, should spend some time reviewing [the alert],” said John Reed Stark, managing director of Stroz Friedberg, a digital risk management firm. “It is the prism through which the SEC is viewing cybersecurity. Firms should take advantage and use this inside information to prepare for the regulatory onslaught that is clearly beginning.”

Mr. Stark on what the SEC is looking for from firms in cybersecurity examinations.

The tone of the document shows a change in the SEC's thinking, according to Mr. Stark, former head of the agency's Internet enforcement office. It is looking at cyberpredators as a holistic danger.

“If a firm is attacked, it's no longer just a threat to the firm's customer, it's a threat to the global financial marketplace,” Mr. Stark said.

He participated in a daylong cybersecurity forum at the SEC on March 26. SEC Chairman Mary Jo White attended almost the entire event. The Financial Industry Regulatory Authority Inc., the broker-dealer regulatory, also plans to conduct cybersecurity examinations this year.

The increasing interest in cybersecurity comes as anxiety about the “Heartbleed” bug is sparking a worldwide rush to change passwords as retailers such as Target and Neiman Marcus have suffered massive customer data breaches.

One of the SEC's goals in its examinations is to acclimate itself to the current state of cybersecurity, according to Amy Lynch, president of FrontLine Compliance, a consulting firm.

“It looks very much like a fact-finding mission for the SEC,” Ms. Lynch said. “They want to learn how firms are utilizing technology and the controls they have in place around it.”

Even though the SEC is going to examine only a handful of firms, it is using the sweep to send a message about what it views as best practices, said Dan Bernstein, director of research and development at MarketCounsel, a compliance consulting firm.

The result is not going to be a specific set of instructions to follow. Cybersecurity safeguards will depend on how much access firms have to client information and how they manage it, Mr. Bernstein said.

(See also: American Funds urges new client passwords over Heartbleed)

“It's going to be facts- and circumstances-based,” Mr. Bernstein said. “Some firms will need more protections than others. The advisers that have a strong privacy policy, a data-protection plan, an identity theft program and a business continuity plan will be in strong shape.”

Larger firms will have an easier time passing muster than smaller firms, according to Ms. Lynch.

“Where it gets murky is for midsize and smaller firms that don't have robust IT departments,” Ms. Lynch said.

Cybersecurity is even more important in the financial advice industry than in retail, Mr. Stark said. If a department store is breached, customers likely will come back. They may not be as loyal to an adviser because the attack hits a more vulnerable place — their money.

“If you get a call from your broker or investment adviser that your account has been compromised, you're going to seriously contemplate transferring your assets elsewhere,” Mr. Stark said.

0
Comments

What do you think?

View comments

Recommended for you

Upcoming Event

Mar 13

Conference

WOMEN to WATCH

InvestmentNews is honoring female financial advisers and industry executives who are distinguished leaders at their firms. These women have advanced the business of providing advice through their passion, creativity, inclusive approach and... Learn more

Featured video

Events

The biggest drivers in wealth management today

What's shaping the future of financial advice? After 10 years of MarketCounsel Summits, Brian Hamburger explains what's changed in the past decade and what stands ahead for adviser technology and regulation.

Video Spotlight

Help Clients Be Prepared, Not Surprised

Sponsored by Prudential

Recommended Video

Path to growth

Latest news & opinion

RIAs struggle to keep clients grounded amid stock market euphoria

With equities at record levels, financial advisers are confronted with realities of greed and fear.

Regulators showing renewed interest in cracking down on investment fees

SEC, Finra targeting high-fee share classes, 12b-1 fees and failure to give sales load discounts and waivers to investors.

Tax update: Brady says sales tax deduction in final bill

Taxpayers will be able to deduct state income taxes or state sales taxes in addition to property levies — up to a $10,000 cap.

Complexity of new indexed annuities causing concern

Insurers are using 'hybrid' indices as a way to differentiate themselves, but critics contend the products are less transparent, more confusing and don't add financial benefit.

Critics say regulation hasn't curbed overly rosy projections for indexed universal life insurance

They say rule didn't go far enough and more stringent measures may be necessary.

X

Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print