What You Need To Know About The SEC Cybersecurity Exam Priority

In a recent risk alert, the SEC announced that it was instituting a second exam priority focused on cybersecurity at broker-dealers and registered investment advisors. The SEC decided to conduct this second targeted exam due to its findings from an earlier cybersecurity exam priority.

This new initiative will focus on the following areas:

1. Governance and risk assessment: does a registrant have adequate governance and risk assessments processes and policies in place to address the following points.
2. Access rights and control: does a registrant have basic controls to prevent unauthorized access to the systems and information.
3. Data loss prevention: does a registrant have an adequate program to monitor electronic data that is sent out of the firm by employees or through third parties; are there unauthorized transfers being made.