Alerts

SEC Cybersecurity Risk Alert Urges Firms to Protect Against Ransomware

Alerts / May 19, 2017

On May 17, 2017, the Office of Compliance Inspections and Examinations (OCIE) of the United States Securities and Exchange Commission (SEC) issued a risk alert highlighting the importance of registered broker-dealers, investment advisers and investment companies taking appropriate steps to protect themselves against ransomware in light of this past week’s WannaCry attack.[1]

Following its recent cybersecurity sweep exam of 75 firms, OCIE observed that firms of all sizes should implement the following measures:

  • Conduct Risk Assessments. According to the risk alert, 5% of the broker-dealers and 26% of investment advisers and investment companies examined did not conduct periodic risk assessments of critical systems to identify cybersecurity threats, vulnerabilities and the potential business consequences.
  • Perform Penetration Tests. The risk alert also indicated that the sweep found 5% of broker-dealers and 57% of investment advisers and investment companies did not conduct penetration tests and vulnerability scans on critical information systems.
  • Maintain Information Systems. The risk alert further noted that 10% of the broker-dealers and 4% of investment advisers and investment companies had failed to update a number of critical and high-risk patches to maintain the integrity and security of their information systems.

Risk alerts like this are rare and typically focus on regulatory issues that the SEC seeks to emphasize to its registrants – in this case, the compliance measures entities must implement to protect against ransomware and other cyber threats. These findings show that the SEC views risk assessments, penetration tests and patching as key elements of any firm’s cybersecurity program. They also show that investment advisers and investment companies appear to be behind the curve on implementing these measures despite previous guidance by the SEC’s Division of Investment Management and OCIE.[2] Given these repeated warnings, firms that fail to incorporate these measures into their cybersecurity programs risk not only a cyber incident, but also an enforcement action by the SEC for not reasonably safeguarding customer information and planning for business continuity.

As demonstrated by our 2017 Data Security Incident Response Report, which analyzes the more than 450 cyber incidents our Privacy and Data Protection team handled in 2016, BakerHostetler has unparalleled experience when it comes to responding to attacks and managing cybersecurity risks. We regularly work with clients in the financial services sector to conduct risk assessments and develop legally-compliant cybersecurity programs to help identify, prevent and respond to data security incidents.

If you have any questions about this alert, please contact Marc D. Powers at mpowers@bakerlaw.com or +1.212.589.4216, Theodore J. Kobus III at tkobus@bakerlaw.com or +1.212.271.1504, Melinda L. McLellan at mmclellan@bakerlaw.com or +1.212.589.4679, Jonathan A. Forman at jforman@bakerlaw.com or +1.212.847.2855 or any member of BakerHostetler’s Hedge Fund Industry, Securities Litigation and Regulatory Enforcement or Privacy and Data Protection team.

Authorship credit: Melinda L. McLellan and Jonathan A. Forman


[1] SEC National Exam Program Risk Alert, Cybersecurity: Ransomware Alert (May 17, 2017), https://www.sec.gov/files/risk-alert-cybersecurity-ransomware-alert.pdf.
[2] See, e.g., SEC National Exam Program Risk Alert, OCIE’s 2015 Cybersecurity Examination Initiative (Sept. 15, 2015), https://www.sec.gov/ocie/announcement/ocie-2015-cybersecurity-examination-initiative.pdf; SEC Division of Investment Management, Cybersecurity Guidance (Apr. 2015), https://www.sec.gov/investment/im-guidance-2015-02.pdf.

Baker & Hostetler LLP publications are intended to inform our clients and other friends of the firm about current legal developments of general interest. They should not be construed as legal advice, and readers should not act upon the information contained in these publications without professional counsel. The hiring of a lawyer is an important decision that should not be based solely upon advertisements. Before you decide, ask us to send you written information about our qualifications and experience.

Blog

In The Blogs

Previous Next
Data Privacy Monitor
IAB Unveils Solution for Interest-Based Advertising and CCPA "Do Not Sell" Right
By Kyle R. Fath, Gerald J. Ferguson, Alan L. Friel, Linda A. Goldstein
September 19, 2019
On September 17, 2019, numerous stakeholders in the digital advertising industry – including publishers, advertisers/brands, AdTech companies and law firms (including numerous representatives from BakerHostetler) – convened at the...
Read More ->
Data Privacy Monitor
CCPA Exceptions: What Qualifies as Activity ‘Wholly Outside' of California?
By Arielle L. Brown, Melinda L. McLellan
September 18, 2019
Much has been said about the scope of the California Consumer Privacy Act (CCPA) and the far-reaching implications the law will have on businesses throughout the United States. Although it is true that the territorial reach of the law is...
Read More ->
Data Privacy Monitor
CCPA Amendments – Where They Stand Today
By Taylor A. Bloom, Alan L. Friel
September 17, 2019
A little more than 100 days prior to the effective date of the California Consumer Privacy Act (CCPA), six amendments (A.B. 25, A.B. 874, AB 1146, A.B. 1202, A.B. 1355 and A.B. 1564) to the act were approved by California lawmakers at the...
Read More ->
Data Privacy Monitor
Just How Far Does California's New IoT Security Law Reach?
By Daniel A. Pepper
September 13, 2019
On January 1, 2020, California’s new Internet of Things (IoT) Security Law goes into effect. The law is the first IoT-specific security law in the United States and, simply put, requires all IoT devices sold in California to be equipped...
Read More ->
Data Privacy Monitor
Less Than a Month to Go Until Nevada Privacy Law Effective Date
By Alan L. Friel, Shea M. Leitch
September 12, 2019
As discussed in our previous blog post on the topic, Nevada’s amendments to its privacy law are set to go into effect Oct. 1, 2019. Less comprehensive in scope than the much-heralded CCPA, the Nevada privacy law amendment has received...
Read More ->