iOn April 15, 2014, the SEC’s Office of Compliance Inspections and Examinations (OCIE) issued a National Exam Program Risk Alert entitled “OCIE Cybersecurity Initiative.” In the Risk Alert, OCIE states that it will conduct an initial set of examinations of more than 50 registered broker-dealers and registered investment advisers to gain information about the industry’s recent experiences with certain cybersecurity threats and the level of the industry’s cybersecurity preparedness. Specifically, OCIE indicates that the examinations will focus on cybersecurity governance, identification and assessment of cybersecurity risks, protection of networks and information, risks associated with remote customer access and funds transfer requests, risks associated with vendors and other third parties, detection of unauthorized activity and experiences with certain cybersecurity threats.
The Risk Alert includes a seven-page appendix of sample requests for information and documents that may be used by OCIE in the conduct of the examinations and encourages compliance professionals to use the appendix as a tool to help “assess their firms’ level of preparedness, regardless of whether they are included in OCIE’s examinations.”
