SEC Watchful Eyes Focus On Cybersecurity and Protecting Personal Information #cybersecurity 
Information privacy used to be a fairly simple thing. Systems – what systems there were – weren’t so interconnected and information wasn’t so easy to share with thousands (millions) of people all over the world. Security used to come down to gaining physical access to the information, which was usually on paper. If you couldn’t get to the paper, you couldn’t get to the information. Yet those very analog days are long gone, and most of us have come to recognize that our personal information assets are no longer so tangible that we can touch them and feel them and keep them secured safely in the lockbox in the closet. What’s disturbing about the landscape of security in the cyber-world is that it is risky to trust not just the systems but the users – including the folks you want and need to trust – with your personal information. It isn’t that you can’t trust anyone these days. You just can’t trust that everyone is taking the precautions necessary to protect YOUR information. You need to be sure.
Trust has always been an essential element in business and finances, and in every business relationship there is some element of it present. The prudent customer performs necessary due diligence before entering into any business arrangement, but there are often factors taken for granted in the review; factors which are overlooked or remain unconsidered, often due to an essential level of trust which is placed with the other party. This is among the issues identified by the SEC as it relates to broker/dealers and their recognition of the importance of securing their clients personal information. Yet recognition of the risk and responsibility isn’t always enough, especially with the number and makeup of bad actors out there. As the threat landscape changes, so must the approaches and technologies used to protect information from those threats.
Consumers place a high level of trust with their financial advisors and generally provide them with a great deal of personal information, and the broker-dealers and advisors generally recognize the importance of protecting the personal information they are entrusted with. The problem is that these entities too often approach the problem of information security and protection as something with static and unchanging requirements. Compliance in establishing a baseline of protection is met. A lack of ongoing diligence required to adjust to new threats and changing conditions… not so much. According to a summary report on the subject issued by the SEC in February 2015, the “vast majority” of examined broker-dealers and advisors have adopted written information security policies, yet the report goes on to discuss additional measures and constant reviews which should be applied to better guard the personal information of consumers.
Most of the examined firms reported that they have been the subject of a cyber-related incident. A majority of the broker-dealers (88%) and the advisers (74%) stated that they have experienced cyber-attacks directly or through one or more of their vendors. The majority of the cyber-related incidents are related to malware and fraudulent emails.
National Exam Program Risk Alert issued By the Office of Compliance Inspections and Examinations (“OCIE”); Volume IV, Issue 4 February 3, 2015
Among the agencies placing focus on the issues of cybersecurity and personal information protection is the SEC. Within the SEC (Securities and Exchange Commission) is an office called the Office of Compliance Inspections and Examinations (OCIE). The OCIE exists to “protect investors through administering the SEC’s nationwide examination and inspection program”. Registered entities examined by this office (in Washington, DC and the Commission’s 11 regional offices) include broker-dealers, transfer agents, investment advisers, investment companies, municipal advisors, the various national securities exchanges, clearing agencies, and certain self-regulatory organizations (SROs) such as the Financial Industry Regulatory Authority (FINRA) and the Public Company Accounting Oversight Board (PCAOB).
In February 2015, OCIE published a summary of observations of the findings from a SEC-sponsored Cybersecurity Roundtable which included SEC Commissioners and staff as well as industry representatives. The roundtable discussion, held in March 2014, focused on the important part cybersecurity plays in preserving the integrity of the market system and protecting customer data. On the heels of the roundtable came a Risk Alert published by OCIE, in which it announced a series of examinations and tests aimed at the identification of cybersecurity risks and assessing the preparedness of the securities industry to meet the challenge. After all, federal securities laws require registered investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.
The watchful eyes of the SEC are looking directly at broker-dealers and advisers, bringing additional attention to messaging about the requirement for these entities to protect consumer personal information. The message is more likely to be heard when it includes the threat of censure and big fine. In September 2015 the SEC charged an “investment adviser with failing to adopt proper cybersecurity policies and procedures prior to a breach”. According to the SEC release, the firm “failed to establish the required cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information (PII) of approximately 100,000 individuals, including thousands of the firm’s clients.” Also in September, the OCIE communicated another Risk Alert notifying of their intent to focus on cybersecurity compliance and controls, including information about the next round of examinations which will include more testing to evaluate firms’ implementations of procedures and controls around information protection and cybersecurity.
Gathering information on information security and privacy practices is not always easily accomplished for the SEC OCIE. FinCin (US Dept of the Treasury Financial Crimes Enforcement Network), on the other hand, seems to get more reports of breaches from broker-dealers than does OCIE. Maybe it is due to the advisor wanting to take more the role of the victim rather than admittance of culpability in any way, but the OCIE reports that roughly 65% of broker-dealers that acknowledged receiving fraudulent emails, for example, reported them to FinCen, yet perhaps 7% or fewer actually reported the information to law enforcement or other regulatory agencies. It is the public report of the breach which gets the attention, and which continues to spur the efforts within the OCIE.
Public reports of cybersecurity breaches occur with too much frequency. Sadly many of these events are due to failures or weaknesses in basic controls – failures which might have been identified if testing and review of basic processes, systems and controls was part of regular procedure. With some of the largest data breaches possibly resulting from hacking of 3rd party vendor systems and platforms, review and assessment of vendors and suppliers must also be folded into the realm of consideration. Failure to protect personal information of consumers and clients is risk to not just the firm or the client, but also to the entire market. Risk reduction and management is among the focus areas for OCIE, a charter which supports the recent creation of the Office of Risk and Strategy, and which recognizes the challenge in gaining the information necessary to effectively inform the SEC and the market on cybersecurity issues.
Make Sense?
J
No retailer wants to become the next Target (pun intended). Payment card fraud costs businesses and consumers billions of dollars every year. What’s even more frightening, many of the breaches in the news are the result of innocent participants inadvertently granting access to the bad guys. The Target breach in 2013 exposed the data of 110 million payment cards. Hackers got into the network using perfectly good credentials of the HVAC company. Sometimes password security just isn’t enough, which might bring in to question the security of all those SaaS subscriptions and online shopping sites folks use these days.
Make Sense?
In today’s business world, risk, uncertainty and volatility are just par for the course – everyday realities of simply being in business. Nothing is certain, they say, except death and taxes. Yet there is a fine art to driving profitable growth in a business, and adapting to existing and emerging risk takes a great deal of experience, information and agility. While planning and process development may occur at many levels within the organization, it is the FP&A (financial planning and analysis) capability which helps top performing businesses be top performers.
Running applications online, or “in the cloud” using today’s parlance, is top priority for a lot of businesses. It’s not that these organizations have a burning desire to post their financials to the web, which is what a lot of folks thought was going to happen when we first suggested they use their financial applications online. Rather, business owners and managers have begun to recognize and experience the benefits of connecting their various locations, remote and mobile workers with real time access to business applications and data. Further, centralization of IT coupled with outsourced IT management and subscription service pricing has introduced financial and operational benefits which make businesses more cost-efficient as well as more agile. From being the basis for foundational process and workflow improvements to allowing the repositioning of IT costs from capex to opex, online application services are proving their value in various ways every day.
Make Sense
Manufacturing, particularly custom manufacturing or ETO (engineering to order) is among those industry types that could benefit tremendously from a more intimate and detailed approach to accounting. Unfortunately, it is often difficult to find experienced professionals with not simply a competence in working with manufacturing industry sector clients, but specifically with ETO process. Building to order is one thing, but finding the way to improve efficiency and profitability when every job is a custom encounter takes additional skills and a lot of data. 
There is ‘big change a comin’ for retailers, merchants and any business that accepts credit cards for payments, and there are a great many businesses that are completely unprepared for it. The change, what is being referred to as the “
Cooper Mann Consulting 