SEC’s Division of Investment Management Provides Cybersecurity Guidance

April 28, 2015

The SEC's Division of Investment Management issued "Cybersecurity Guidance". The SEC stated that its guidance discusses a number of measures that funds and advisers may wish to consider when addressing cybersecurity risks. The Guidance states that there are a number of measures that funds and advisers may wish to consider in addressing cybersecurity risk, including the following, to the extent they are relevant:

• the nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses;

• internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems;

• security controls and processes currently in place;

• the impact should the information or technology systems become compromised; and

• the effectiveness of the governance structure for the management of cybersecurity risk.

In addition, advisers may want to create a strategy that is designed to prevent, detect and respond to cybersecurity threats that includes:

• controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls and/or perimeter defenses, tiered access to sensitive information and network resources, network segregation, and system hardening;

• data encryption;

• protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events;

• data backup and retrieval; and

• the development of an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.

Click here to access the guidance.


Investment Advisers, Investment Companies