Since it first announced its “Cybersecurity Initiative” in April 2014, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) has been relentlessly setting its sights on RIA’s information security programs. In fact, as recently as its 2020 Examination Priorities, OCIE noted it will “continue to prioritize information security in each of its five examination programs.” I spoke to my partner, and our cyber expert, Cary Kvitka, regarding this ever-increasing important issue.
We’ve been helping RIAs draft customized cybersecurity policies and procedures under Regulation S-P, Rule 30(a) since April 2014. Among other things, it broadly requires RIAs to adopt written policies and procedures addressing technical safeguards to protect their clients’ data “against any anticipated threats or hazards to the security or integrity of customer records and information; and protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.” Therefore, when we customize written cybersecurity policies and procedures for our clients, we have turned to OCIE’s published guidance to help identify and address their expectations.
Read More about Cybersecurity Amid the Current Pandemic
