Getting Your Information Security Program Up to Scratch

In 2017, the SEC’s Office of Compliance Inspections and Examinations (OCIE) reaffirmed that its examination priorities continue to include cybersecurity. Two years previously, OCIE detailed the following specific areas of focus:

  • Governance and Risk Assessment
  • Access Rights and Controls
  • Data Loss Prevention
  • Vendor Management
  • Training
  • Incident Response

These key areas should cover much of the cybersecurity risk that Investment Adviser (“IA”) firms will face. However, for firms with little to no experience in dealing with cybersecurity, covering the above can be a daunting task. By reviewing OCIE examination priorities and taking a step-by-step approach, a firm can create an Information Security Policy (ISP) suitable to its needs. An Information Security Policy should be a comprehensive document outlining how a firm handles matters related to cybersecurity. Everything from high-level policy to technical details will be within the Information Security Policy.

Governance And Risk Assessment

The OCIE 2015 examination priorities for governance and Risk Assessment provides as follows

“Examiners may assess whether registrants have cybersecurity governance and risk assessment processes relative to the key areas of focus discussed below. Examiners also may review the level of communication to, and involvement of, senior management and boards of directors.” – OCIE’s 2015 Cybersecurity Examination Initiative

When dealing with Governance and Risk Assessment, a firm should ask these questions:

  • Does the firm handle sensitive data?
  • Where is sensitive data located?
  • Who can access sensitive data?
  • How can sensitive data be accessed?
  • Who oversees IT decisions?

Each firm will have their own share of unique risks depending on the type of IA as well as the business environment in which it operates. When evaluating risk, a firm must first identify what is at risk. In most cases, the
answer will include data.

Want to read more?

Fill in the form below to download the full article.

Loading form...

Latest Content

Form CRS and Its Impact on State-Registered Advisers

While many investment advisers are starting to plan for Form CRS/Form ADV Part 3, one group of investment advisers can breathe a sigh of relief that this is a project that does not need to be on their ‘To Do’ list. As of now, no state regulator has adopted this disclosure document for state-registered advisers. … Continued

Effective Compliance Policies & Procedures and Annual Reviews: Meeting the Reasonably Designed Standards

Investment Advisers must perform an annual evaluation of the effectiveness of their compliance program. This starts with ensuring, maintaining and implementing reasonably designed policies and procedures. This ComplianceCast webinar covers the recent regulatory changes that may trigger a need to reevaluate your present policies. Who Conducts and How to Conduct the Annual Review Planning and … Continued

7 Reasons to Attend Our Scottsdale Fall 2019 Compliance Conference

If you’ve been considering joining us in Scottsdale for our Sept. 23-25 compliance event, here are seven reasons you should take the plunge now! The Best Mix of Informational & Educational Speakers – We just added OCIE’s Co-National Associate Director of Investment Adviser/Investment Company Examination Program Marshall Gandy to our stellar list of presenters. He joins ex-NFL star Merril … Continued