There has been a recent flurry of news reports, analysis and webinars in the securities law world around the Securities and Exchange Commission's ("SEC's") Office of Compliance Inspections and Examinations ("OCIE") proposed 2014 Cybersecurity Initiative. Launched as a major news item this month after the SEC's OCIE published its April 15, 2014 Risk Alert devoted to the topic, the Cybersecurity Initiative redirects the financial industry's compliance focus back to SEC examinations, as OCIE purports to conduct exams on "more than 50 registered broker-dealers and registered investment advisers", focusing specifically on a firm's "cybersecurity preparedness." So what do you need to know the most from this latest Risk Alert? The areas that OCIE will be most concentrating on include:
- The entity's cybersecurity governance [through risk assessments, an inventory of technology, and internal policies and procedures ("P&P")];
- Identification and assessment of cybersecurity risks [malware, network breaches, etc.];
- Protection of networks and information [encryption, etc.];
- Risks associated with remote customer access and funds transfer requests [including external controls for authentication of identity];
- Risks associated with vendors and other third parties [tracking new software packages, etc.];
- Detection of unauthorized activity [how to track the notifications process for intrusions, etc.]; and
- Experiences with certain cybersecurity threats.