Reasonable Threat Intelligence
Managed Service Providers Under Attack In the past month, a Managed Service Provider (MSP), or what many registered investment advisers might utilize as their outsourced IT Provider, was breached, exposing up to 2000 user endpoints to issues of disruption and perhaps worse. The IT Vendor was subsequently urged to pay ransom [...]
SEC Plows the Field of Cyber-Enforcement
Takeaways from the Voya Breach and Settlement (Order distributed on September 26, 2018) Voya Financial Services, Inc. (“VFA”) Similar to past enforcements and, notably, the 2015 action and settlement with R.T. Jones, the SEC has invoked Rule 30(a) of Regulation S-P (the “Safeguards Rule”) in a broad swipe at a firm’s [...]
SEC Observations on Cybersecurity Sweep 2
Suggestions to Achieve Greater Maturity On Monday, the SEC released “Observations” on the seminal 2015 Cybersecurity Examination Initiative or what they are now referring to as “Sweep 2.” While we find this document to be an unremarkable kitchen-sink of cyber-findings, the SEC has offered a concept for what they consider to [...]
Regulatory Rollback and Cybersecurity
Should Current Political Winds Impact Your Approach? A tremor ripped through the Investment Adviser and Broker-Dealer space last week as President Trump signed an Executive Memorandum, a call to investigate of the “Fiduciary Rule” and a likely precursor to specific attempts to roll back Dodd–Frank “Wall Street Reform and Consumer Protection [...]
2017 Exam Priorities – The SEC & The Cyberlandscape
Examination Priorities - Making Your Program Real The Priorities: More of The Same The SEC launched its 2017 Exam priorities last week. For the last couple of years, when the long-awaited priorities have been released, I have been reminded of a press conference that the late Presidential candidate and Senator, Fred [...]
Inventories Revisited
Inventories Revisited - Making Your Asset Lists Work for You Inventory_Web.jpgIT Security in the Investment Adviser space faces an interesting quandary: does security drive compliance, or does compliance drive security? From the security side, the continuous call is that compliance with regulations should come as a result of good security. In [...]