SEC Warns Advisers and Broker-Dealers to Protect against Ransomware

The SEC’s Office of Compliance Inspections and Examinations (OCIE) issued a Risk Alert about recent ransomware attacks and offered some best practices for smaller firms for dealing with ransomware incidents.  Based on a recent review of 75 registrants, the OCIE staff recommends that firms perform a cyber-risk assessment, conduct penetration and vulnerability tests, and ensure software maintenance including adequate software patches.  The OCIE staff stressed the importance of developing a “rapid response capability.”  OCIE found widespread deficiencies among advisers during its review: 57% did not conduct penetration and vulnerability testing and 26% did not conduct periodic risk assessments of critical systems.

OUR TAKE: Cybersecurity has become one of the most significant compliance issues facing investment management firms.  CCOs and their bosses must take action to address outside threats.  We recommend reviewing the SEC’s 2014 guidance.