The Cost of Safety

As the SEC continues its focus on cybersecurity, investment managers and broker-dealers are under intense pressure to be cyber-compliant. Not only must investment managers focus on protecting themselves and their customers from cyber attacks, they must now follow the SEC guidance to prevent fines and penalties resulting from a security breach. It is clear from the release of its Cybersecurity Examination Sweep Summary that the SEC is raising the standard of expectations regarding cybersecurity, but how can investment managers become cyber-compliant while controlling costs?

First, understand how to protect yourself and your investors. The SEC offers guidance with a three-step approach.

Cybersecurity Guidance*
Three-Step Approach. The Guidance Update sets forth a three-step approach:

1. Assess threats, vulnerabilities and defensive measures currently in place;
2. Design a strategy to prevent, detect and respond to cybersecurity threats; and
3. Implement that strategy through written policies and procedures, internal personnel training and external client education.

By making a true firmwide commitment to cybersecurity, investment managers protect their investors, preserve the firm’s reputation, and avoid potentially debilitating penalties and fines.

Furthermore, what now is SEC guidance on cybersecurity may quickly evolve into SEC regulation. In fact, on September 22, 2015, the SEC settled charges against a St. Louis-based investment advisor for failing to establish required procedures to safeguard customer information in violation of Rule 30(a). According to Co-Chief of the SEO Enforcement Division’s Asset Management Unit Marshall S. Sprung, “As we see an increasing barrage of cyber attacks on financial firms, it is important to enforce the safeguards rule even in cases like this when there is no apparent financial harms to clients.”

So, yes, the cost of protecting your customers from cyber threats is high, but can you afford not to?

*  New SEC Cybersecurity Guidance: What is means for Fund Managers May 4, 2015, Shulte Roth & Zabel.