NIST Proposes Update to Cybersecurity Framework to Address Service Provider Oversight

Many investment advisers and broker-dealers have embraced the NIST Cybersecurity Framework since it was first released in 2014, using it to formalize the mapping of risks and controls as part of a comprehensive cybersecurity program. Alas, cybersecurity risks continue to grow, and so too must the response to those risks keep pace. What has become clear from the SEC’s cybersecurity enforcement actions to date is that vendors and service providers to advisers and broker-dealers have access to a wealth of information and data about a firm and its clients, and that a breach or security incident involving the service provider can have privacy impacts for the IA or BD.

Recognizing the significance of service provider relationships and interdependencies on operational risk, the National Institute of Standards and Technology (NIST) proposed an update to its Cybersecurity Framework on January 10, 2017. The proposed changes in version 1.1 are in draft form pending a comment period which is open until April 10, 2017. The draft proposes to amend the Cybersecurity Framework by:

  • Adding a new section on cybersecurity measurement to help define consistent terminology for aligning business actions, results, cybersecurity expenditures, and cybersecurity metrics
  • Updating the Framework Core by adding a new category within the Identify function for Supply Chain Risk Management (ID.SC), which is essentially a focus on the policies, procedures, and controls to manage the risks posed by a firm’s third party vendors and service providers. The new category will include, among other things, an assessment of whether vendors are appropriately identified, prioritized, required to adhere to certain contractual obligations for information security, monitored for compliance with such terms, and included within the scope of business continuity testing.
  • Enhancing the Protect -> Access Control category (PR.AC) to include authentication, authorization, and identity verification, and renaming the category as “Identity Management and Access Control” to reflect that access is closely tied to an understanding of the identity of the party requesting access
  • Adding explanatory text throughout the Framework to describe how Implementation Tiers can be used in conjunction with the Current Profile and Target Profile. A tier is a way to benchmark the strength of a firm’s cybersecurity program, with higher tiers reflecting a more comprehensive and proactive program. The tiers are: Tier 1 (Partial), Tier 2 (Risk Informed), Tier 3 (Repeatable), and Tier 4 (Adaptive).

A redlined version of the NIST Cybersecurity Framework as updated by the proposed draft is available here.

Latest Content

Schedule 13D/13F Clarity on ETF Issues

Do I need to file a 13D or 13G if my client accounts hold in excess of 5% of an ETF? Generally, no. The SEC has granted no-action relief to ETFs with respect to compliance with Section 13(d) of the Securities Exchange Act. Section 13(d) was designed to require disclosure when holders begin to accumulate … Continued

New Remedy Coming for SEC’s Custody Rule?

The SEC’s Custody Rule continues to be a common source of confusion and a landmine for noncompliance. Custodial paperwork has caused huge headaches for investment advisers, who are not a party to the agreement and may not even have a copy of the custodial new account paperwork. The issue with existing guidance is that it … Continued

SEC Issues MiFID II No-Action Relief

Some industry anxiety was assuaged on October 26 with three no-action letters that offer relief for some US regulated broker-dealers and investment advisers regarding European MiFID II regulations. The letters followed consultation with the European authorities, and are designed to address concerns that investors could lose access to valuable research. MiFID II is a series of regulations … Continued

Regulatory Changes Impacting RICs and Service Providers

A year ago, the SEC adopted Investment Company Reporting Modernization Rules and Forms, as well as rules pertaining to liquidity risk management programs and swing pricing. New forms N-Port and N-Cen along with amendments to Regulation S-X significantly change the current reporting regime for most registered investment companies (RICs) because they require more comprehensive disclosure and … Continued

Publicly Available Information Heightens Need for Cybersecurity Vigilance

For any business, “ports” that allow for communication generally need to be open (for example, ports 80 and 443 for websites, and port 500 for VPN access). While most of these ports allow you to engage in critical functions, there are often ports that remain open despite being unneeded or unused. These available ports present … Continued

Mailing List

Subscribe to the Ascendant Compliance email list for the latest compliance resources, conferences, ComplianceCasts™, and more.

Loading form...

Contact Us

Ascendant works together with clients to identify and assess critical needs through customized plans. If you need assistance with compliance functions, regulatory services, cybersecurity or technology tools, we’d love to speak with you.