The U.S. Securities and Exchange Commission Shares Observations For Combating Cybersecurity Threats

Recently, the U.S. Securities and Exchange Commission’s (“SEC”) Office of Compliance Inspections and Examinations (“OCIE”) shared insights on cybersecurity risks that it gathered “[t]hrough thousands of examinations of broker-dealers, investment advisers, clearing agencies, national securities exchanges and other SEC registrants[.]”  These insights were compiled into a report titled “Cybersecurity and Resiliency Observations” “to assist market participants in their consideration of how to enhance cybersecurity preparedness and operational resiliency.”  The OCIE’s observations include practices and approaches to managing and combating cybersecurity risk in the areas of governance and risk management, access rights and controls, data loss prevention, mobile security, incident response and resiliency, vendor management, and training and awareness.”  While noting that there is no one-size-fits-all approach for cybersecurity, the SEC explained that “every organization can compare its cybersecurity practices with the collective knowledge of industry experts that OCIE has collected.”