January 2020

“An ounce of prevention is worth a pound of cure.”

The SEC’s Office of Compliance Inspections and Examinations (“OCIE”) issued new guidance on January 27, 2020 which further addresses the cybersecurity risk set confronting regulated financial entities. The report provides visibility into OCIE observations pertaining to effective mitigation of primary cybersecurity risk sets, including:

• Governance
• Access rights
• Data loss prevention,
• Mobile security
• Vendor management
• Incident response
• Employee training. 

The U.S. Securities and Exchange Commission (“SEC”) continues to make progress with its self-imposed mandate of expanding its investment adviser examination reach. Leveraging increased staff and proprietary risk analytics, the Commission maintained its examination coverage of registered advisers in 2019 versus 2018 despite an increase of nearly 4 percent in registered firms and a month-long suspension of examination activity due to the 2019 government shut down.  Examinations of registered advisers in fiscal year 2019 remained robust covering 15 percent of the registered adviser population.