OCIE-SEC and FINRA release groundbreaking cybersecurity guidance reports

The Office of Compliance Inspections and Examinations (OCIE) Securities and Exchange Commission (SEC), has released its hotly anticipated examination sweep summary results. The report summarizes the responses gathered from 100+ registered broker-dealers and investment advisors, as part of an initial fact-finding mission. The 28-point questionnaire was widely regarded as the first step toward the introduction and implementation of an industry-wide Cybersecurity Examination Initiative.

As previously reported, the OCIE-SEC will proceed with in-depth, independent testing not only in the U.S., but abroad. Testing is expected to delve deeper into areas evaluated through the initial 28-point questionnaire. The investigative phase was designed to give the SEC a better understanding of overall industry preparedness when it comes to cybersecurity.

Collectively, questions focused on the examined firms’ overall comprehension of the data they own, legislation that may regulate that data, existing cybersecurity risks and how they’re defending against those risks.

The findings promisingly highlight that a large number of participating firms have developed written security policies (93% of broker-dealers and 83% of advisors).

Results also indicate that a number of respondents have introduced proactive measures that include conducting regular risk assessments (93% of broker-dealers, 79% of advisors) and employing cybersecurity insurance (58% of broker-dealers, 21% of advisors).

Interestingly enough, industry regulatory authority FINRA (The Financial Industry Regulatory Authority) has also released an indispensable tool, dubbed the Report on Cybersecurity Practices (released February 2015).

As the SEC announced its Cybersecurity Examination Initiative in 2014, FINRA launched a targeted examination sweep to (similarly) gain an understanding of threats and vulnerabilities facing the industry today. The sweep was part of an ongoing FINRA cybersecurity initiative, which initially kicked off in 2007. FINRA’s extensive report details observations and findings that provide firms with incredible insight into key priorities as they work to strengthen their cybersecurity posture.

FINRA’s report groups its findings under several headings. Those include:

• Cybersecurity governance and risk management
• Cybersecurity risk assessment
• Technical controls
• Incident response planning
• Vendor management
• Staff training
• Cyber intelligence and information sharing
• Cyber insurance

FINRA describes the report as ‘an approach to cybersecurity grounded in risk management’, something that we at eSentire respect and staunchly promote.

Together, these two reports highlight the complexity of an industry undergoing radical change to confront evolving cybersecurity risks. Firms participating in these exams and fact-finding interviews are blazing a trail for the industry not just on a national platform - but also on a global stage. There’s no question that cyber threats will continue to pose significant risk to the industry. And while the ramifications from regulatory intervention may seem daunting, the resources developed as a result are critical tools that will help to defend the industry from cyber risk.