OCIE Risk Alert Relating To Safeguarding Customer Records And Information In Cloud-Based And Other Network Storage

On May 23, 2019, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) issued a Risk Alert regarding the storage of electronic customer records in network and cloud-based storage solutions. The Risk Alert signals OCIE’s continued focus on cybersecurity and data privacy policies and practices of investment advisers and broker-dealers.¹

Compliance Concerns

The Risk Alert details a number of OCIE Staff concerns observed in recent examinations of registered firms relating to the electronic and cloud-based storage of customer records, including failures to:

• adequately configure the security settings on the firm’s network storage solution to protect against unauthorized access and to implement policies and procedures addressing the security configuration of the network storage solution;