SEC Requests Financial Firms Security Details

SEC asks 50 businesses for copies of their security policies, procedures, and controls in an effort to help the industry bolster cybersecurity protection.

The Securities and Exchange Commission plans to study the information security policies, procedures, and levels of preparedness of businesses in the financial services sector.
In an announcement issued earlier this month, the SECs Office of Compliance Inspections and Examinations (OCIE) said it would be conducting examinations of more than 50 registered broker-dealers and registered investment advisers, focusing on areas related to cybersecurity -- government-speak for anything involving information, computers, and security.
The agencys stated rationale for conducting the examinations is to help identify areas where the Commission and the industry can work together to protect investors and our capital markets from cybersecurity threats. Interestingly, the agency added that this guidance is not a rule, regulation, or statement of the commission, suggesting that the information would be amassed -- at least initially – only for information-gathering purposes.
What form will those examinations take? While no final version of the exam has been released, the OCIE included in its announcement a 28-question sample cyber security document that poses questions around such areas as risk identification, safeguarding firms networks, securing remote customer access and fund-transfer requests, working with vendors, and detecting unauthorized activity. The agency said the questions are based in part on the
Framework for Improving Critical Infrastructure Cybersecurity
released by the National Institute of Standards and Technology in February.
[Investments in security startups are taking off. Read
Venture Capital: The Lifeblood Behind Security Innovation
.]
Whats especially notable about the SECs announcement is that the examination isnt predicated on telling businesses what to do or presenting them with a checklist. Instead, it says that maintaining correct risk-based controls is the responsibility of any individual business, and that those controls will be unique to the business. For now, the SEC wants details about what businesses are doing and why theyre doing it.
The philosophy here... is very rigorous; its very risk-based, comprehensive, and specific to an organization, said Carl S. Young, managing director and chief security officer at computer investigations, intelligence, and risk management firm Stroz Friedberg, speaking by phone. I was quite encouraged by this exam and the message it sends in terms of people recognizing that this is not a checklist-oriented problem.
According to Young, the Commission is also showing it now wants more than assurances from financial firms. Theyve recognized that there needs to be some kind of scrutiny that goes beyond people saying, Were OK, he noted.
One of the exams top questions, for example, is this request: Please provide a copy of the firms written information security policy. A businesss response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.
But businesses may also face further inquiries from the SEC. They caveated pretty hard by saying this is not a safe harbor, and there may be other questions, Young points out.
The SECs examination announcement comes in the wake of a March roundtable, hosted by the agency, which was designed to investigate what role the SEC should play when handling two issues: ensuring that public companies have robust information security defenses in place, and ensuring the security of the market infrastructure and of any organization that must comply with SEC regulations.
As an SEC commissioner, I have become particularly concerned about the risks that cyberattacks pose to public companies, and to the capital markets and its critical participants, including the exchanges, clearing agencies, transfer agents, broker-dealers, and investment advisers, said SEC commissioner Luis A. Aguilar at the roundtable. Cyberattacks aimed at these market participants can have devastating effects on our economy, on individual consumers, and on the markets and investors that the SEC was created to safeguard.
Of course, the new exam isnt the agencys first move to solicit information security particulars from financial firms. In 2011, the SEC began requiring public companies to begin releasing some security-related information. That guidance makes clear that material information regarding cyber security risks and cyber incidents is required to be disclosed, said SEC chairwoman Mary Jo White at the roundtable.
Agency officials have continued to study how businesses have responded to that requirement. With regard to the public company discussion, I am particularly interested in hearing whether the current disclosure regime under the 2011 guidance is working or how it could be improved, said Aguilar.
Last year, per Regulation S-ID, the SEC also began requiring some financial services firms and creditors to create identify theft programs and comply with
Identity Theft Red Flags Rules
.
When it comes to the cybersecurity examination, which 50 businesses might the agency first look at? One likely scenario is that the agency will try to study organizations both large and small from a variety of different financial sectors. Thats my view, says Stroz Friedbergs Young. If they can categorize them into food groups, then Id take a hard look at what the results of the exam were, then Id modify the exam and propagate it outwards.
The results of the SECs exam may have ramifications far beyond the financial services industry. This may be a watershed announcement, says Young. It wouldnt shock me if other agencies followed suit.
NISTs cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the
Protecting Critical Infrastructure
issue of InformationWeek Government today.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
SEC Requests Financial Firms Security Details