In the wake of the "WannaCry" ransomware attack last month, the Securities and Exchange Commission found a wide range of information security practices, procedures and controls among broker-dealers, investment companies and advisors.
The study, conducted by OCIE’s National Examination Program staff, involved a review of 75 SEC registered broker-dealers, investment advisers and investment companies to assess industry practices and legal, regulatory and compliance issues associated with cybersecurity preparedness.
As noted above, they found a wide range of information security practices, procedures and controls, though they said those may be tailored to the firms’ operations, lines of business, risk profile and size.
The SEC noted that firm practices were observed during this Initiative that the staff believes may be particularly relevant to smaller registrants in relation to the WannaCry ransomware incident, including:
- Cyber-risk assessment: The review found that 5% of broker-dealers and more than a quarter (26%) of advisers and investment management firms examined did not conduct periodic risk assessments of critical systems to identify cybersecurity threats, vulnerabilities and the potential business consequences.
- Penetration tests: Five percent of broker-dealers and 57% of the investment management firms examined did not conduct penetration tests and vulnerability scans on systems that the firms considered to be critical.
- System maintenance: All broker-dealers and 96% of investment management firms examined have a process in place for ensuring regular system maintenance, including the installation of software patches to address security vulnerabilities. However, 10% of the broker-dealers and 4% of investment management firms examined had a significant number of critical and high-risk security patches that were missing important updates.
The SEC’s Division of Investment Management and OCIE have provided guidance and information that firms may wish to consider when addressing cybersecurity risks and response capabilities.
