Broker-Dealers And Investment Advisers Now Targeted By Both Cyber Intruders And SEC Cybersecurity Examiners

Cybersecurity has increasingly become a critical issue for all types of businesses, few more so than broker-dealers, investment advisers and others in the financial sector. The cyber threat is much broader than customer data privacy as addressed by the Securities and Exchange Commission's Regulations S-P (regarding privacy of consumer financial information) and S-ID (regarding identity theft). Cybersecurity encompasses risks such as thefts of funds or business information and attacks designed to disable a firm's operations.

On April 15, 2014, the SEC's Office of Compliance Inspections and Examinations (OCIE) staff brought heightened attention to such cyber threats with the issuance of a Risk Alert titled "OCIE Cybersecurity Initiative."1 The OCIE Risk Alert provides valuable guidance to regulated firms on ways they can go about protecting themselves from cyber risks. It also highlights the regulatory risks firms will encounter if they do not implement adequately robust cybersecurity compliance programs. Broker-dealers and investment advisers should take steps now to ensure they are protected from the looming threats from both cyber criminals and regulatory examiners.

The SEC and FINRA Shine the Spotlight on Cybersecurity in 2014

Technology-related risks have been a focus of the SEC's rulemaking and examination programs in recent years. For example, as we discussed in our 2013 Mid-Year Report, the SEC and Commodity Futures Trading Commission jointly issued final rules in April 2013 requiring certain regulated entities to implement identity theft programs.2 As we also discussed in a previous Executive Alert, the SEC, FINRA, and the CFTC issued joint guidance in August of last year on the "best practices and lessons learned" from their review of firms' business continuity and disaster recovery plans, following the closures of equities and options markets caused by Hurricane Sandy.3

In 2014, securities regulators have moved beyond such particularized technology issues, and highlighted the broad spectrum of cybersecurity risks that firms face. Early this year, FINRA announced that it had begun conducting targeted examinations (sweeps) to assess how broker-dealers are managing cybersecurity threats.4 FINRA's sweeps letter requested information on over a dozen cybersecurity issues, and asked firms to complete an "impact analysis" regarding the likelihood and potential impact of various kinds of cyber attacks on the firm's critical systems.5

On...