SEC publishes observations on industry cybersecurity practices

SEC publishes observations on industry cybersecurity practices
The agency highlights specific examples of firms' cybersecurity and operational resiliency practices
JAN 27, 2020

The Securities and Exchange Commission’s office of Compliance Inspections and Examinations released a report on observations relating to cybersecurity and best practices by financial market participants.

The observations are based on thousands of examinations of broker-dealers, investment advisers, clearing agencies, national securities exchanges and other SEC registrants, according to the report published on the SEC’s website.

The intent is to highlight specific examples of cybersecurity and operational resiliency practices and controls that firms are taking to safeguard against threats, and how they respond in the event of a breach.

OCIE acknowledged that there is no one-size-fits-all approach to cybersecurity and that the approaches highlighted may not be appropriate for all organizations. The observations are meant more as guidelines for firms considering how to improve their cybersecurity preparedness and response procedures.

“Through risk-targeted examinations in all five examination program areas, OCIE has observed a number of practices used to manage and combat cyber risk and to build operational resiliency,” Peter Driscoll, director of OCIE, said in a statement. “We felt it was critical to share these observations in order to allow organizations the opportunity to reflect on their own cybersecurity practices.”

For example, OCIE observed that effective cybersecurity programs begin at the top with senior leaders committed to improving a firm’s defenses. Common elements include a risk assessment to identify, analyze and prioritize security risks; a written cybersecurity policy to address the risks; and the effective implementation and enforcement of those policies.  

Areas covered in the report include governance and risk management, access rights and controls, data loss prevention, mobile security, incident response and resiliency, vendor management, and training and awareness.

SEC Chairman Jay Clayton commended OCIE for compiling and sharing the observations and encouraged market participants to incorporate the information into their cybersecurity policies.

“Data systems are critical to the functioning of our markets, and cybersecurity and resiliency are at the core of OCIE’s inspection efforts,” Mr. Clayton said in a statement.

Latest News

RIA moves: True North adds $353M California RIA as SageView grows North Carolina presence
RIA moves: True North adds $353M California RIA as SageView grows North Carolina presence

Plus, a $400 million Commonwealth team departs to launch an independent family-run RIA in the East Bay area.

Blue Owl Capital, Voya strike private market partnership for retirement plans
Blue Owl Capital, Voya strike private market partnership for retirement plans

The collaboration will focus initially on strategies within collective investment trusts in DC plans, with plans to expand to other retirement-focused private investment solutions.

Top Commonwealth advisor to recruiters: Stop with the cold calls already!
Top Commonwealth advisor to recruiters: Stop with the cold calls already!

“I respectfully request that all recruiters for other BDs discontinue their efforts to contact me," writes Thomas Bartholomew.

Why AI notetakers alone can't fix 'broken' advisor meetings
Why AI notetakers alone can't fix 'broken' advisor meetings

Wealth tech veteran Aaron Klein speaks out against the "misery" of client meetings, why advisors' communication skills don't always help, and AI's potential to make bad meetings "100 times better."

Morgan Stanley, Goldman, Wells Fargo to settle Archegos trades lawsuit
Morgan Stanley, Goldman, Wells Fargo to settle Archegos trades lawsuit

The proposed $120 million settlement would close the book on a legal challenge alleging the Wall Street banks failed to disclose crucial conflicts of interest to investors.

SPONSORED How advisors can build for high-net-worth complexity

Orion's Tom Wilson on delivering coordinated, high-touch service in a world where returns alone no longer set you apart.

SPONSORED RILAs bring stability, growth during volatile markets

Barely a decade old, registered index-linked annuities have quickly surged in popularity, thanks to their unique blend of protection and growth potential—an appealing option for investors looking to chart a steadier course through today's choppy market waters, says Myles Lambert, Brighthouse Financial.