SEC Fine Against Morgan Stanley Underscores Focus On Cybersecurity

Morgan Stanley Smith Barney LLC recently agreed to pay a $1 million penalty to the U.S. Securities and Exchange Commission after a Morgan Stanley employee downloaded and exposed sensitive investor information. This penalty reflects the SEC's insistence on greater cybersecurity controls among its registrants. As the Director of Enforcement, Andrew Ceresney stated, "Given the dangers and impact of cyber breaches, data security is a critically important aspect of investor protection, we expect SEC registrants of all sizes to have policies and procedures that are reasonably designed to protect customer information."

Over a three year period, a Morgan Stanley employee downloaded personal information from nearly 730,000 investor accounts to a personal server in his home so that he could conduct "cold calls." Although Morgan Stanley's policies and safeguards prohibited downloading information to thumb drives, they did not prohibit employees from downloading information to