How the SEC will police advisers' lax cybersecurity

The SEC may be refining its approach to spurring good cybersecurity practices in advisers, but its expectations aren't slackening.

There's been "a conscious decision" at the agency to lead through the exam process, rather than enforcement, said David Glockner, regional director of the SEC's Chicago office.

"There've been a handful of enforcement cases in this area," Glockner said, "but if you step back and think about it, there are way more incidents, way more issues that pop up in exams than there are enforcement referrals or enforcement actions."

But even if the commission will discipline advisers sparingly and bring actions in the most egregious cases, officials want advisers to demonstrate that they are taking the issue seriously. Examiners will expect to review a firm's policies and procedures for protecting against data breaches and other threats to sensitive information.

SEC_RealEstate_Bloomberg

The budgeting app has already garnered support from NBA superstars and is looking for more growth.

9h ago
3 Min Read
Portrait of smiling girl with piggy bank in classroom

The retirement crisis looms larger than ever as new research shows how many U.S. adults have no long-term savings.

10h ago
3 Min Read

As managing director and lead of Kotter's European practice, Nick Petschek draws on his wide skill set to help organizations formulate and achieve their strategy and culture goals. Nick aids clients in surfacing the delta between organizational aspirations and reality, closing that gap together. His career journey has been one of constant curiosity and learning. From the awe-inspiring circus to the nimble world of unicorn startups, to the process-oriented United Nations, he has tackled challenges related to telling a compelling story and envisioning a new future, scaling, sustainability, and culture transformation. His clients have ranged in size and industry, with a focus on technology and government.

11h ago
Headshot of Nick Petschek

As a starting point, officials recommend advisers take an inventory of their digital assets to determine the various entry points that hackers could take to infiltrate their systems, including a thorough vetting of all the outside vendors a firm contracts with.

Compliance slideshow

Regulators have revealed what kind of issues advisors must address if faced with a review.

1 Min Read

To ensure that personnel throughout the firm are cognizant of the myriad cyber threats, the SEC urges firm leaders to elevate the issue as a business priority, appealing for a tone at the top that prevents cybersecurity issues from being marginalized as simply a matter for the IT department.

But in some firms, there remains a tension between business and cybersecurity concerns, according to Steven Levine, an associate regional director at the SEC's Chicago office.

Levine has warned about the compliance and supervision challenges facing the growing number of advisory firms that have adopted the broker-dealer model of maintaining a home office and multiple branches.

Often, branch managers look to bring in high-producing industry veterans who might resist the firm's cybersecurity policies and procedures, which puts additional onus on the chief compliance officer to lay down the law, Levine says.

For reprint and licensing requests for this article, click here.
Cyber security Compliance Regulatory actions and programs SEC
MORE FROM FINANCIAL PLANNING