SEC urges advisers to draw up and implement cybersecurity plans

Next step could be to hold them accountable for data breaches

Apr 29, 2015 @ 12:54 pm

By Mark Schoeff Jr.

The Securities and Exchange Commission is pushing investment advisory firms to establish and implement formal, written policies to combat data breaches.

“Create a strategy that is designed to prevent, detect and respond to cybersecurity threats,” the SEC Division of Investment Management said in a guidance update released on Tuesday. “Implement the strategy through written policies and procedures and training … [for] officers and employees.”

The document recommends that firms conduct periodic assessments of the data it collects, the vulnerabilities of their information systems, the security controls they have in place, the potential consequences of a breach and their plan to manage such an assault. A cybersecurity strategy could include using credentials and authentication to restrict access to firm data as well as encrypting and backing up data.

The guidance follows cybersecurity exams that the SEC and the Financial Industry Regulatory Authority Inc., the industry-funded broker-dealer regulator, conducted last year. Both organizations have made cybersecurity an examination priority for the past two years, and the SEC hosted a roundtable on the topic last year.

The guidance underscores the fact that the SEC is making cybersecurity a regulatory obligation, said Todd Cipperman, principal at Cipperman Compliance Services.

“It puts the whole cybersecurity compliance program on the chief compliance officer's desk,” Mr. Cipperman said. “It means CCOs are going to have to step up their IT game. They don't need to become IT experts, but they do need to become IT competent.”

Although the guidance doesn't carry the force of a rule and is not legally binding, it does outline what the SEC will be looking for when it conducts exams. Advisers should take heed, said Brian Rubin, a partner at Sutherland Asbill & Brennan.

“They should be thinking long and hard about why their procedures or processes are different from what is suggested,” Mr. Rubin said. “Broker-dealers should review [the guidance], too, even though it does not apply to them.”

The next step for the SEC could be cybersecurity enforcement actions, Mr. Cipperman said. The agency also could show up at the door of an advisory firm after a data breach to assess the cyber defense it had implemented.

“You ignore this guidance at your own peril,” Mr. Cipperman said.


What do you think?

View comments

Most watched


How advisers can be a gamechanger for women investors

Why women defer to men when it comes to finances and how advisers can combat this phenomenon and make a difference for female investors, according to Heather Ettinger, founder and CEO Luma Wealth Advisors.


How the 2020 elections could impact ESG investing

Joseph Keefe, president of Impax Asset Management, on the elections and how advisers can build a bridge to the next generation of clients with ESG investing.

Latest news & opinion

Schorsch, AR Capital to pay $60 million to settle SEC charges

The former REIT czar and his firm wrongfully obtained millions linked to REIT mergers.

CFP Board postpones enforcement of its revised fiduciary standard

Board's new Code of Ethics and Standards to be enforced next June, in line with the SEC's Reg BI

Charles Schwab reportedly in talks to buy USAA brokerage, wealth management business

The deal would net Schwab roughly $100 billion in new assets.

Advisers scramble to help retirees navigate looming Fed rate cut

The Fed's first interest-rate cut in a decade has advisers warning against chasing the bait of risk over safety.


Hi! Glad you're here and we hope you like all the great work we do here at InvestmentNews. But what we do is expensive and is funded in part by our sponsors. So won't you show our sponsors a little love by whitelisting It'll help us continue to serve you.

Yes, show me how to whitelist

Ad blocker detected. Please whitelist us or give premium a try.


Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print