OCIE Identifies Security Risks To Cloud-Based Records Storage

In a Risk Alert, the SEC Office of Compliance Inspections and Examinations ("OCIE") urged broker-dealers and investment advisers to review their practices and policies governing the storage of electronic information, particularly as to customer information maintained in the cloud.

During examinations, the OCIE staff observed firms:

• that store electronic records using third-party services (e.g., cloud-based storage) failed to use the data protection tools that the service provider made available to them;
• were not sufficiently configuring the security settings to safeguard against unauthorized access;
• lacked adequate policies, procedures or contractual provisions to ensure that the security settings or vendor-provided network storage solutions were configured in alignment with the firm's policies; and