SEC Uses "New" Cyber Enforcement Tool, Calls Out Board's Role

The U.S. Securities & Exchange Commission has issued a stern warning to every financial firm and board of directors under its watchful eye: get your cybersecurity programs in shape or face the consequences.

And it's doubtful the SEC's admonition is limited to the financial sector.

In a cease and desist order against Voya Financial Advisors, an Iowa-based investment adviser, the SEC used for the first time its "Identity Theft Red Flags Rule" to censure the firm for allowing hackers to access social security numbers, account balances and even details of client investment accounts. The SEC adopted the red flags rule five years ago but until now, has not enforced the rule, nor has it punished firms for ignoring it.