SEC Tackles Cybersecurity for Financial Services Sector

You’ve probably heard the news: cybersecurity is a big deal these days. And when it comes to protecting sensitive consumer information from cyberattacks, arguably no industry faces a bigger burden of responsibility than financial services. The SEC’s Office of Compliance Inspections and Examinations (OCIE) went so far as to list information security for investment firms among its top enforcement priorities for 2020.

Based on audits of financial services companies, the SEC published a report last month on the OCIE’s observations on sound information security and “the maintenance and enhancement of operational resiliency.” It appears to be part of a larger push by government entities like the National Security Agency to encourage companies across the board to beef up their cybersecurity programs.

OCIE’s advice for financial services firms covers many aspects of information security, including data loss, governance, mobile devices and vendor management.

Governance and risk management

As would be expected, the OCIE puts the onus on executives to make cybersecurity a priority inside their companies. “Effective cybersecurity programs start with the right tone at the top, with senior leaders who are committed to improving their organization’s cyber posture through working with others to understand, prioritize, communicate, and mitigate cybersecurity risks,” the report states.

The report includes three specific elements of security programs that the OCIE deemed to be effective:

  • A cybersecurity risk assessment;
  • Written policies and procedures addressing those risks; and
  • Implementation and enforcement of those policies and procedures.

The OCIE also says companies are instituting testing and monitoring for their protocols, along with ways to respond promptly to the results.

Data loss prevention

The report details a series of strategies for keeping data from being lost or misused. For example, companies can perform routine reviews of things like software code and web applications to look for vulnerabilities. Additionally, the OCIE approvingly notes that some companies take steps to ensure that old hardware and software delete sensitive information.

Vendor management

When it comes to working with outside parties, the OCIE says some firms are establishing specific security requirements and safeguards to be applied in vetting vendors. There are also risks associated with vendor outsourcing that should be considered, such as the use of cloud-based services.

Mobile security

Given the growth of mobile devices and applications, it comes as little surprise that companies are developing strategies to counteract their specific vulnerabilities. As an example, companies are using “mobile device management” applications for functions like business email and calendars. Companies are also training employees on effective security practices for mobile devices.

Other aspects of information security covered in the report include how to respond to security breaches, training and awareness for employees, and user access rights and controls. All things considered, it’s better for issuers to address these boring topics now, before they become much more exciting – and expensive – in the wake of a preventable cyberattack.

Latest Articles

Companies Grapple with Appropriate Disclosures for Cybersecurity

You could make a strong case for the SolarWinds hack of 2020 as the most significant cybersecurity event in history to date. Russian hackers launched a massive online attack throug...

Read More

Beware the Buzzy Press Release

In the world of corporate communications, press releases play a pivotal role in disseminating news. However, a recent study shows that companies are also using press releases strat...

Read More

SEC Already Facing Legal Challenge to Buyback Rules

Shareholders of technology giant Apple might have experienced feelings of déjà vu earlier this month. In announcing its financial results for 2023’s second quarter, the company als...

Read More