Cybersecurity rule would clarify what SEC expects of advisers

The SEC hasn’t been shy about pushing financial advisers to protect their clients’ data from cybersecurity breaches, but a pending rulemaking likely will clarify the regulator's expectations.

Over the last few years, the Securities and Exchange Commission has issued cybersecurity guidance, made the topic an examination priority and brought enforcement cases that centered on cybersecurity lapses that violated existing customer protection rules.

Now the agency is poised to release a proposal in the next few months that would strengthen disclosures and preparedness related to cybersecurity risks for funds and investment advisers, according to an item on the regulator’s agenda.

“The industry needs guidance in this area,” said Amy Lynch, president and founder of FrontLine Compliance. “Smaller firms are struggling as to what they need to do. Having a written rule will level the playing field for the industry and give firms the necessary [direction] to implement systems that will actually protect their data.”

SEC Chairman Gary Gensler earlier this week outlined how the agency intends to step up its cyber oversight. In addition to the rule for funds and advisers, it’s working on a separate measure for public company disclosures related to cyber risks. It’s also considering updating rules regarding systems compliance for exchanges, and customer records and information protection for brokers, advisers and investment companies.

The SEC is making this push on cyber rules in part because the dramatic expansion of working from home has caused a greater reliance on technology while cyberattacks are becoming more aggressive.

“The SEC wants to make sure the policies, procedures and practices we had in place before the pandemic are still appropriate,” said Tiffany Smith, a partner at WilmerHale. “It’s about refreshing processes so they account for the current environment and the risks we’re facing.”

The SEC periodically critiques the financial industry’s cybersecurity practices. A cyber rule would likely address some of the problems the agency has observed.

“They’re just not satisfied with the control environment either from a technology perspective or a policies and procedures perspective,” said Scott Kimpel, a partner at Hunton Andrews Kurth.

The SEC won’t have to write a cyber rule for advisers from whole cloth. It can look to what other regulators have done, Lynch said.

The National Futures Association, for instance, implemented a rule that requires its members to adopt and enforce an information security program. New York and California have their own data protection laws.

“The SEC may take the NFA guidance as a starting point and could go further,” Lynch said. “They’ve got a road map to follow, and it makes it much easier for them when it comes to rulemaking.”

Gensler highlighted existing rules that could pertain to cybersecurity, such books-and-records, compliance and business continuity. A specific cyber rule could put it all in one place.

“The goal is a more robust cybersecurity environment and less enforcement activity due to a better understanding about compliance obligation,” Kimpel said.

Financial advisers don’t need to wait for a cyber rule to start bolstering their digital protections. Smith suggests they review the SEC examination priorities for cybersecurity mentions.

“Firms should make sure their policies and procedures satisfy the areas the staff is interested in,” she said.

Now is the time for brokers and advisers to tackle cybersecurity upgrades they’ve been putting off.

“You can get half of the way there, if your countermeasure suite is state of the art,” Kimpel said.