The SEC has identified the cybersecurity of registered investment companies (“funds”) and registered investment advisers (“advisers”) as an important issue. As such, the SEC has issued guidance highlighting the importance of the issue and discussing a number of measures that funds and advisers may wish to consider when addressing cybersecurity risks.
Key Take Away: The SEC recognizes that is it not possible for a fund or adviser to anticipate and prevent every cyber attack. However, the SEC believes appropriate planning to address cybersecurity and a rapid response capability may assist funds and advisers in mitigating the impact of any such attacks and any related effects on fund investors and advisory clients. Accordingly, the fund’s board should carefully review and consider the measures referenced in the SEC’s guidance.
Summary: In the SEC’s view, there are a number of measures that funds and advisers may wish to consider in addressing cybersecurity risk, including the following (the suggested measures are not intended to be comprehensive and other measures may be better suited depending on the operations of a particular fund or adviser):
- Conduct a periodic assessment of: (1) the nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses; (2) internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems; (3) security controls and processes currently in place; (4) the impact should the information or technology systems become compromised; and (5) the effectiveness of the governance structure for the management of cybersecurity risk.
- Create a strategy that is designed to prevent, detect and respond to cybersecurity threats. Such a strategy could include: (1) controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls and/or perimeter defenses, tiered access to sensitive information and network resources, network segregation, and system hardening (see definition of system hardening below); (2) data encryption; (3) protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events; (4) data backup and retrieval; and (5) the development of an incident response plan.
- "System hardening" refers to making technology systems less susceptible to unauthorized intrusions by removing all non-essential software programs and services, unnecessary usernames and logins and by ensuring that software is updated continuously.
- Implement the strategy through written policies and procedures and training that provide guidance to officers and employees concerning applicable threats and measures to prevent, detect and respond to such threats, and that monitor compliance with cybersecurity policies and procedures.
- Adopt compliance policies and procedures that are reasonably designed to prevent violations of the federal securities laws. For example, the compliance program of a fund or an adviser could address cybersecurity risk as it relates to identity theft and data protection, fraud, and business continuity, as well as other disruptions in service that could affect, for instance, a fund’s ability to process shareholder transactions.
- Implement a mechanism to monitor for ongoing and new cyber threats by gathering information from outside resources, such as vendors, third-party contractors specializing in cybersecurity and technical standards, and topic-specific publications and conferences, as well as participating in the Financial Services —Information Sharing and Analysis Center (FS-ISAC).
- Assess whether protective cybersecurity measures are in place at relevant service providers.
- Review contracts with service providers to determine whether they sufficiently address technology issues and related responsibilities in the case of a cyber attack.