Cybersecurity: The SEC Provides Guidance On Well-Known And Emerging Best Practices

At the end of January, the U.S. Securities and Exchange’s Office of Compliance Inspections and Examinations (OCIE) released its “Observations on Cybersecurity and Resiliency Practices” (Observations). While any guidance on cybersecurity from the SEC — one of the most active federal regulators of cybersecurity and data privacy disclosure and compliance — is welcome, the observations may not surprise those closely following privacy and cyber developments or the examinations and settlements pursued by the SEC and other regulators, such as the Federal Trade Commission.

The Observations serve as a good reminder and road map for leaders in corporate governance, compliance, law departments and technology of the best practices for both prophylactic cybersecurity and responsiveness during and after a breach. As the director of OCIE noted, the Observations are intended to foster and highlight observable best practices: “Through risk-targeted examinations . . . OCIE has observed