Cybersecurity & 2017 SEC Exam Priorities

In September 2015, the SEC announced it was starting Phase 2 Cybersecurity Exam Initiative exams in which the SEC started doing more in-depth testing of policies, procedures and controls at firms. For example: testing a firm’s access provisioning policy by standing over the shoulder of various employees to confirm whether they could or couldn’t access certain files and folders on the network.

In January 2016, the SEC’s Exam Priorities announced a continuation of the Phase 2 exams.

Now in January 2017, it appears that Phase 2 is over, and this more in-depth testing has found its way into SEC examinations in general.

Granted, some exams might not focus on cybersecurity at all, but the ones that do are likely to now include a more in-depth examination of it, and the SEC will be looking to corroborate that you are doing what your policies say you are doing, and that you have policies on things they expect you to have policies on when it comes to cyber.

At the upcoming Ascendant Compliance Management conference, “Revolutionizing Compliance: The Matrix of Regulation, Operations & Technology,” we will be covering things on the SEC’s cybersecurity request list – what documentation they expect, what types of controls they expect, what policies they expect; how to test various policies ahead of time; ways to improve your firm’s training and security awareness program – since some firms are being called out for inadequate cyber training and since the SEC is using the benefit of hindsight to fine firms that have a cyber incident that comes to light during an exam.

Translation: more training reduces the likelihood of a cyber incident in the first place.

If you need to gain a deeper understanding of the SEC’s views of cybersecurity and how it might affect your firm, join us in Naples on April 3-5. For more information, read our agenda by clicking here.

Related Content

Latest Content

OCIE Examined 15% of RIAs in 2017

In 2017, the SEC examined 2,114 investment advisers, approximately 15 percent of the 14,000+ registered investment advisers, the SEC confirmed in its Fiscal Year 2019 Congressional Budget Justification Annual Performance Plan. In the same report, the SEC said the staff will continue to improve its efforts of RIAs, noting that nearly 35 percent of all … Continued

Ascendant’s Adam DiPaolo Discusses Hypothetical & Model Performance Marketing Pitfalls

A Jan. 12 article in HFMCompliance titled “Best practice for hedge funds using hypothetical and model performance” outlines best practices for hedge fund managers when using hypothetical performance or model data in marketing efforts, and how managers relying on such data can avoid enforcement actions. Adam DiPaolo, Senior Consultant in Ascendant’s Private Funds group, is quoted in the … Continued

SEC’s Exam Priorities Offer Insight Into National Exam Program

On February 7, 2018, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) issued their 2018 Examination Priorities (see Ascendant’s summary here). In addition to defining their examination priorities for the year, the OCIE staff offered some insight into the National Exam Program.  Specifically, they defined the following five principles in executing their exam priorities: … Continued

SEC Updates: ICO Gatekeeper Standards, SEC/CFTC Swap Rules

SEC Chairman Jay Clayton had some stern advice for market professionals, especially gatekeepers, who he said need to act responsibly and hold themselves to high standards. Speaking via videoconference during Securities Regulation Institute’s recent annual conference, he said, “To be blunt, from what I have seen recently, particularly in the initial coin offering (“ICO”) space, they … Continued

Mailing List

Subscribe to the Ascendant Compliance email list for the latest compliance resources, conferences, ComplianceCasts™, and more.

Loading form...

Contact Us

Ascendant works together with clients to identify and assess critical needs through customized plans. If you need assistance with compliance functions, regulatory services, cybersecurity or technology tools, we’d love to speak with you.