Results from the SEC’s First Round of Cybersecurity Examinations. On February 3, 2015, the OCIE published a risk alert summarizing its findings from its examinations of over 100 registered investment advisers and broker-dealers. The examinations were conducted as part of the OCIE’s cybersecurity examination initiative, announced in April 2014, to assess cybersecurity preparedness in the securities industry and gather information on common practices and trends among registered firms. The OCIE interviewed key personnel and reviewed documents at 49 registered investment advisers and 57 registered broker-dealers. The OCIE’s findings focused on how registered investment advisers and broker-dealers:

• Identify cybersecurity risks;

• Establish cybersecurity policies, procedures and oversight processes;

• Protect their networks and information;

• Identify and address risks associated with remote access to client information, funds transfer requests and third-party vendors; and

• Detect and handle unauthorized activities and other cyber-attacks.

The examinations were designed to discern differences in the level of cybersecurity preparedness among the examined firms. While the OCIE examined the accuracy of the firms’ responses and the extent to which policies and procedures were implemented, it did not test the technical sufficiency of the firms’ cybersecurity programs.

Second Round of SEC Cybersecurity Examinations Announced. On September 15, 2015, the OCIE issued a risk alert announcing its second round of examinations of registered investment advisers and broker-dealers under its cybersecurity examination initiative. Whereas the first round of examinations consisted primarily of interviews and document reviews, the OCIE expects that the second round of examinations will involve more testing to assess implementation of a firm’s procedures and controls. The examinations are expected to focus on the following key areas:

• Governance and risk assessment;

• Access rights and controls;

• Data loss prevention;

• Vendor management;

• Staff and vendor training; and

• Cybersecurity incident response.

Registered investment advisers and broker-dealers should note that the topics highlighted above are not exhaustive and that OCIE examiners may select other areas of focus based on risks identified during the course of examinations. To assist firms in evaluating their cybersecurity preparedness, the OCIE has included a sample document request as an appendix to its Risk Alert.

SEC Cybersecurity Enforcement Action. On September 22, 2015, the SEC announced the settlement of an enforcement action against a St. Louis-based registered investment adviser brought under Rule 30(a) of Regulation S-P (Safeguards Rule). The SEC order charged the adviser with violating the Safeguards Rule by failing to adopt written cybersecurity policies and procedures reasonably designed to protect customer records and information. According to the SEC order, the adviser had stored sensitive personally identifiable information (PII) of its clients and other persons on its third party-hosted web server without adopting written policies and procedures that accounted for the security, confidentiality and protection of the PII from anticipated threats or unauthorized access. Subsequently, an unauthorized and unknown intruder gained access to the data on the server, thereby rendering the PII of more than 100,000 individuals, including the PII of clients of the adviser, vulnerable to theft. Without admitting or denying the findings set forth in the SEC order, the adviser agreed to be censured, to cease and desist from committing or causing any violations and any future violations of the Safeguards Rule and to pay a civil penalty of $75,000 to the SEC.

We note that as of the date of the SEC order, the adviser had not learned of any information indicating that a client had suffered any financial harm as a result of the cyberattack. This enforcement action highlights the SEC’s willingness to bring an enforcement action against a registered investment adviser, despite there being no apparent financial harm to such adviser’s clients, as well as the importance for registered investment advisers to have adequate cybersecurity policies to prevent and remedy cybersecurity threats.

New SEC Cybersecurity Guidance. On April 28, 2015, the SEC released a guidance update on the importance of cybersecurity and the steps registered investment advisers (and registered investment companies) may wish to consider in light of growing cybersecurity risks.  The guidance update suggested that to assist in identifying potential cybersecurity threats and vulnerabilities so as to better prioritize and mitigate risk, advisers should consider periodically assessing the following:

• The nature, sensitivity and location of information that the adviser collects, processes and/or stores, and the technology systems utilized;

• The internal and external cybersecurity threats to and vulnerabilities of the adviser’s information and technology systems;

• The security controls and processes currently in place;

• The impact on the adviser in the event that the information or technology systems become compromised; and

• The effectiveness of the governance structure for the management of cybersecurity risk.

In addition, the guidance update also suggested that advisers should, among other things: (i) consider developing and testing certain strategies in order to prevent, detect and respond to cybersecurity threats; (ii) address cybersecurity threats through the creation of specific policies and procedures, personnel training and ongoing testing and monitoring; (iii) educate investors and clients on reducing their exposure to cybersecurity risks with respect to their accounts; (iv) assess the adequacy of the cybersecurity measures employed by their service providers and determine whether their service-provider contracts sufficiently address technology issues and related responsibilities that arise in the case of a cyberattack; and (v) consider whether insurance coverage related to cybersecurity risks is necessary or appropriate.

NFA Proposed Interpretive Notice. On August 28, 2015, the National Futures Association (NFA) issued and submitted a proposed interpretive notice on information systems security programs (ISSPs) to the Commodity Futures Trading Commission (CFTC) for approval. The proposed interpretive notice, if adopted, would require NFA member firms (e.g., registered commodity pool operators (CPOs) and commodity trading advisors (CTAs)) to adopt and enforce a written ISSP. The proposed interpretive notice would also provide guidance on information systems security practices that member firms should adopt and customize to their particular business activities and risks.