The Securities and Exchange Commission recently published a set of
observations designed to assist financial market participants.
While not legally binding, the observations are guideposts for
investment companies, securities issuers, and others. They outline
steps to improve cyber preparedness and to protect against
well-known and evolving cybersecurity threats faced by companies in
the United States and worldwide.
The observations come from the SEC's Office of Compliance
Inspections and Examinations. The OCIE operates the SEC's
National Exam Program, which is a risk-based inspection program
intended to protect investors and ensure market integrity. OCIE
collects and analyzes information on various measures that have
been taken by market participants. Information gathered includes
information about governance and risk management, access rights,
and data loss prevention. OCIE also looks at mobile security,
incident response resiliency and vendor management. Finally,
