Posts

Cybersecurity for Broker-Dealer Firms

Cybersecurity for Broker-Dealer FirmsAs a broker-dealer firm executive, you know that one of FINRA’s key mandates is to help prevent cyberattacks against its regulated firms. The Financial Industry Regulatory Authority, or FINRA, is, of course, a not-for-profit regulatory organization authorized by Congress to protect investors and ensure market integrity in the United States. This post will explore some of the most common cybersecurity threats faced by FINRA firms.

What are the Most Common Cybersecurity Threats for Broker-Dealer Firms?

Now more than ever, broker-dealer firms rely on their technology infrastructure the cyber landscape presents a regular number of security challenges requiring robust preparedness for brokerages and other financial services firms.

1. Imposter Websites

According to FINRA, member firms routinely report phony websites posing as FINRA members and using registered names and company data to establish fraudulent sites that market investment services and products. These sites attempt to steal both personal information and money by leading visitors to believe they are interacting with a bona fide business.

2. Customer And Firm Employee Account Takeovers (ATOs)

Email account takeovers can occur with both customer or firm personnel accounts and begin with a comprised email account. Cybercriminals can gain unauthorized access to email accounts through data breaches, phishing emails, or websites that trick users into clicking on malicious links allowing them to execute unauthorized transactions in financial accounts, firm systems, bank accounts, and credit cards.

One of the dangers of an ATO for an employee account includes criminals creating fake identities to establish accounts for automated clearing house (ACH) or wire fraud.

3. Malware and Ransomware

Malware is malicious software and can take many forms, including viruses, spyware, and ransomware. These malevolent programs can steal data, encrypt it, delete it, and even hold it for ransom by infiltrating and taking over computing operations. Phishing is one of the most common ways that malware is introduced. Ransomware is a type of malware that, when launched, can encrypt data and prevent access to networks until a ransom is paid to the attacker.

4. Data Breaches

A data breach is a security incident in which hackers gain unauthorized access to confidential data like financial records or personally identifiable information (PII). Data breaches can lead to financial losses, reputational damage, lawsuits, and fines and penalties.

What Can FINRA Firms do to Prepare?

Core Cybersecurity for Broker-Dealer FirmsEarlier this year, FINRA, along with the SEC, Homeland Security, and other agencies, alerted members to the increased likelihood of cyber attacks as part of the invasion of Ukraine with a Sheilds Up warning.

In a recent op-ed, written by Jen Easterly, the director of CISA, and Chris Inglis, the national cyber director, the pair consider when the Sheilds Up warning might be lifted:

When will we be able to put our shields down? In today’s complex, dynamic, and dangerous cyberthreat environment, the answer is that our shields will likely be up for the foreseeable future.

For broker-dealer firms, this means continuing to follow the guidance provided by FINRA as well as cybersecurity professionals with experience within the financial services sector. There are cybersecurity controls that can mitigate the risk of cyber attacks.

To learn more, download our Guide to Effective Cybersecurity Controls for Broker-Dealer Firms.

Additionally, our Cybersecurity Threats and Effective Controls for FINRA Firms Infographic provides a quick overview of the threats faced by FINRA firms, as well as the controls to implement to reduce the risks from those threats.

Combining Cybersecurity Controls and Expertise

Balancing business initiatives with security and technology can seem challenging, particularly for broker-dealer firms without an internal team of cybersecurity experts, but Coretelligent can help. We offer our expertise and robust cybersecurity solutions to solve the challenges of the highly regulated financial services industry. In addition, we have years of experience working with broker-dealer firms and other firms like hedge funds, venture capital, and family offices. As a result, we understand the pain points these firms face in the digital world and have the solutions—from compliance and cybersecurity to growth and business transformation—to solve them.

Life Sciences Industry Innovation is Where Business & Technology Intersect

Life Sciences Industry Innovation is Where Business & Technology IntersectThe life sciences industry is experiencing a period of rapid growth. Not only does the sector produce life-saving and life-enhancing treatments, but it is fueling investment across the globe. For example, 78 startups went public in 2020 in the biotech sphere, representing a 77% increase from the previous year. Additionally, the first half of 2021 saw already seen 62 biopharma companies progress to IPO status. With the increased demand for innovative drugs, medical devices, and other therapies in the wake of the ongoing COVID-19 pandemic and vaccine development, various trends within the industry (like changes to clinical trials), and increased levels of investment, 2022 is shaping up to be a big year for the sector.

Innovation is the driver of the current expansion within the life sciences market. However, the key to maximizing this ROI, or Return on Innovation, requires that business and technology synchronize. This imperative calls for a carefully planned IT roadmap that enables companies to achieve a competitive advantage and improve business outcomes throughout the development, startup, growth, and expansion stages.

To help executives better understand the timeline, Coretelligent has developed a chart outlining the technology and business needs of the life sciences ecosystem throughout their life cycle. Download our datasheet Innovation is Where Business & Technology Intersect outlining how to plan your company’s IT strategy as you move through funding phases.


To dive deeper, download our data sheet → Innovation is Where Business & Technology Intersect.


In an earlier post, we shared some of the IT challenges faced by early-stage life sciences organizations. With this post, let’s take a deeper look at later-stage companies and what their IT strategy should be focused on as they scale.

What are the main IT priorities of life science firms as they move into their growth and expansion stages?

 

→ Employ technology for data management

As biotech, biopharma, and other life science enterprises grow, managing data increases in scale and complexity. As a result, cloud-based solutions and SaaS applications must align to ensure that enterprise data is available, usable, consistent, reliable, and secure. Employing the right technology solutions, including cloud-based services, backup and recovery, and others that store, manage, and protect data are critical at this stage.

→ Leverage technology to drive innovation

Not only has innovation come to the life sciences space, but it’s also bringing emerging technological trends with it. Advances in Artificial Intelligence (AI), Robotic Process Automation (RBA), Machine Learning (ML), Cloud/Big Data, and other developing technologies are evolving as disrupters to the sector. Successful life science companies will envision how to capitalize on these tools.

→ Optimize technology to grow operations

Even as innovative technology trends shift the landscape, IT becomes more integral to the core business operations as companies scale. While some may be using a managed IT model, most companies likely employ co-managed solutions during the later stages. A co-managed service provider empowers internal IT staff to drive technology delivery at scale and focus on strategic priorities. A technology partner can lighten the load by fulfilling tech support, plug critical skill gaps, and complement in-house capabilities with specialized technology services.

→ Utilize technology to ensure security and compliance

As a life science firm grows, compliance requirements increase in size and scope. At the same time, these companies have become more attractive targets for cybercriminals. As a result, life science firms must prioritize implementing robust cybersecurity tools and compliance processes to keep pace with evolving regulations while protecting sensitive data from bad actors.


Related Content → GxP and FDA 21 CFR Part 11 Compliance with Egnyte for Life Sciences.


Developing IT Growth Strategy for the Life Sciences Industry

The life sciences industry is booming, and the future looks even brighter. But the key to success involves more than just innovation—effective growth also depends on how well your life sciences company can leverage IT capabilities throughout your life cycle. In building out an effective IT strategy for startups, begin by understanding where your organization stands today, followed by preparing for those IT areas that will require digital transformation. Furthermore, leveraging new technologies like AI, RPA, ML, and Big Data, can help accelerate your progress and open up new opportunities in the journey towards achieving your goals.

To sum up, you need to understand what’s possible before embarking on any journey. By taking stock of current practices, planning ahead, prioritizing initiatives based on pain points, incorporating new technologies, and teaming up with a technology partner, you’ll be well-positioned to meet future growth. Coretelligent is an industry leader with extensive experience in the life sciences sector. To learn more about how Coretelligent can help your company successfully scale so that growth doesn’t stifle innovation, talk to one of our technology experts today.

security and compliance for financial services

security and compliance for financial services

From operational processes to security challenges and regulatory uncertainty, the financial services sector has very specific IT requirements. Whether you are interested in scaling vertically or horizontally, simply maintaining secure document management and compliant levels of access for employees can be difficult. Managing complex financial services workflows and meticulous processes requires intensely powerful technology, which can be more expensive than financial services firms can afford and still fuel growth engines. With the rise of platforms and partners dedicated to the digital needs of financial services firms, it is more important than ever to fully vet the security and compliance levels of your systems while forging ahead with digital transformation.

Safely Taking Advantage of the Benefits of Cloud

In many ways, cloud computing has paved the way for financial services firms to envision new ways of doing business that are faster, more automated, more compliant and more secure. Managing the huge amounts of data inherent in financial services has caused many firms to shy away from privately hosted or aggregated data centers and move exclusively to the cloud. While the cost-savings can be significant with this shift, the instant scalability of cloud computing is what has been most seductive. The variability of transaction rates over time allows for faster scaling and better control over the consistency of transactions. Even with all the benefits, not all cloud storage and transactions are the same as the security of your cloud partner could be the chink in your armor that cybercriminals are hoping to exploit.

The Rising Importance of RegTech

There was FinTech, and now RegTech: the technology utilized to ensure you are fully complying with the regulatory authorities of the world. This is particularly crucial for financial services firms that often work with individuals and organizations around the globe. This dramatically increases the complexity of the challenges you are facing, and as more countries adopt their specific data privacy policies the intricacy of avoiding regulatory risk will skyrocket. Financial services firms must either comply with these regulations or choose not to do business in that region, something that can severely hamper growth potential for the future. Many organizations are being faced with the option of patching together multiple existing systems and workflows, hoping to capture the spirit of regulations without full confidence that compliance has been achieved. Finding a way to create flexible and scalable — not to mention compliant and secure — systems will continue to be a challenge for financial services firms that manage their technology internally.

Reducing Risk from Security and Compliance for Financial Services Sector

In an ever-changing regulatory and security climate, financial services firms that attempt to meet the obligations set forth by regulators by utilizing manual processes can quickly cause inconsistencies that are not easily discovered without a full audit of systems and processes. Where RegTech can step in is through creating a more resilient base for the organization, allowing for greater scalability as new reporting, security and workflow requirements come to light. Solutions that include AI and machine learning in cybersecurity are often able to detect abnormal activity within a network, aiding in financial crime detection procedures by scanning millions of transactions in a short period of time. Employing machine learning solutions ensures that the systems are able to grow over time — improving their ability to detect inconsistencies and alert technology and business staff to a potential situation.

Trusted Cybersecurity is Vital to Scalability

Third-party vendor risk is often underestimated but is a topic that should be brought top-of-mind for financial services professionals. The highly sensitive information stored within the financial services sector and the increasing data privacy regulations have made the level of security for partners and your data storage providers a key concern. Knowing that your cloud provider has resources dedicated to cybersecurity provides distinct advantages in the face of ever-shifting compliance reporting and security risks.

Finding the right mix of proactive support, regulatory knowledge and cybersecurity experience can be difficult for firms in the financial services sector. With their compliance assurance and engineering excellence, the professionals at Coretelligent are helping financial services organizations find the path forward to scale. Our consultants and technicians represent a broad spectrum of technical expertise, ensuring we have the resources in place to support growing financial services organizations across the country.

Proactive cybersecurity support

Proactive cybersecurity solutionsImproving the operation of your business often starts with consolidation: creating a more cohesive structure that eliminates redundancy and slashes inefficiencies throughout the organization. Business leaders have been focused in this direction for generations, often looking for the smallest advantages that will allow them to outpace the competition. With the renewed focus on cybersecurity, it’s not unusual for businesses to focus more on protecting the security of their organization than attempting to improve operational excellence. What you may not realize is that some of the same initiatives that will help smooth operational hurdles can also provide added levels of cybersecurity. What can be difficult is finding the spaces where you can bring these goals into alignment and create a comprehensive strategy that addresses the holistic needs of the organization and provide proactive cybersecurity support.

Shifting Cybersecurity From a Defensive Strategy

As hackers continue to expand their reach throughout the business community, technology leaders often double-down on the defensive postures that can help guard against the immediate threats of ransomware, phishing emails and direct data breaches. While these are important steps, it’s also important that you create a more active role for cybersecurity within the organization. Consider the cybersecurity and data security compliance requirements as enablers of innovation that will help the business move forward, instead of restrictive policies that are being forced upon the organization. This mental shift offers a broader scope that can become a platform for evolutionary change within the business.

Proactive Cybersecurity Support as a Competitive Advantage

The same work that you’re doing to build your cybersecurity posture and disaster recovery strategies provides your business with an opportunity to review business processes that have been part of institutional knowledge for years and challenge the status quo. Businesses often find that there are high-level items that can quickly be resolved, as well as finding deeper growth options that will reduce work blockages and help you maintain a greater velocity for your business. Business leaders may find that situations that have been causing inefficiencies can be overcome if the changes are in alignment with best practices for cybersecurity and business continuity. In this way, focusing on cybersecurity actually becomes a competitive advantage for your business, tightening operations and removing inconsistencies. While it is easy to see how these strategies could enhance the operations of the organization, getting started or even scoping the breadth of the necessary changes can be overwhelming. This is one of the reasons that businesses are shifting to a co-managed IT services model that allows internal teams to focus on the future while the day-to-day operations and Help Desk support are managed through a network of trusted providers.

Protect your business from operational slowdowns when you explore the Co-Managed IT Services from Coretelligent. This approach allows us to empower your internal technology teams to drive innovation at scale while relying on Coretelligent to provide the best-in-class cybersecurity and infrastructure solutions that your business needs. Our team has expertise providing trusted technical support, in-depth strategies, planning and more to a range of businesses from life sciences and financial services to manufacturers.

Multifactor Authentication

Multifactor Authentication

Multifactor authentication (MFA) is a security technology that requires multiple methods of authentication from distinct categories of credentials to verify a user’s identity. It is a crucial component of a robust multilayered cybersecurity posture to help mitigate the risk of a cyber-attack. It is also considered a best practice for organizations of all sizes and across all sectors to meet compliance standards—especially in highly-regulated sectors like financial services and life sciences.

Multifactor Authentication Explained

The multifactor authentication method should be familiar to all readers at this point. Companies from Apple and Google to Facebook and Amazon utilize (or require) multifactor authentication to reduce risk. Many more will follow in their footsteps as the threat landscape intensifies from cyber-attacks and data breaches and as regulatory agencies require the process.

When MFA is implemented, systems require users to present a combination of two or more qualifications to verify their identity for login. The first authentication consists of a password, which is all that’s required with single-factor authentication. The second verification can vary but often involves asking for a code sent via text or email to a device or account that has previously been verified.

MFA increases security because even if one credential becomes compromised, unauthorized users will not be able to meet the second authentication requirement and will not be able to access the device, network, or database. MFA prevents the unauthorized access of data—including personally identifiable information, intellectual property, and financial assets—by a third party who may have discovered a single password through illegal channels or via a phishing attack.

Multifactor authentication is an element of identity and access management, which consists of policies and practices designed to manage access to enterprise resources and keep systems and data secure. Additionally, Privileged Access Management (PAM) is a subset of IAM that allows for an even more granular distinction between users and access to more sensitive data.

Two-Factor vs. Multifactor vs. Adaptive Multifactor

Two-factor authentication (2FA) is the simplest and most common form of multifactor authentication. With 2FA, users must supply two distinct proofs of identity for access. In nearly every case, two-factor authentication is a massive improvement over single-factor.

On the other hand, two-factor authentication might not be flexible or robust enough for certain situations and specific industries. With MFA, more than two factors are required for authentication, enabling more variables and security. To elaborate, MFA can grant degrees of access across a broad spectrum of possibilities depending on various data points and multiple factors obtained from the login.

Adaptive Multifactor Authentication is yet another certification tool that uses contextual information and business rules to determine which authentication factors to apply to a particular user, at a certain time, and in a specific situation. It combines user authentication with AI and is an effective tool for balancing security requirements and the user experience. Adaptive MFA also makes access decisions based on data, such as: consecutive login failures, geo-location, geo-velocity (or the physical distance between consecutive login attempts), device type, time of day, and 3rd party intelligence data.

MFA and Multilayered Cybersecurity

While MFA can help strengthen your security, it is still best employed as part of a multilayered cybersecurity program based on a defense-in-depth strategy. Defense-in-depth is a cybersecurity model that employs continuous multilayered security for real-time, holistic protection. The reality of today’s cyber threats is that no one cybersecurity practice is enough to protect on its own. Instead, overlapping layers of cybersecurity protections are recommended. A layered defense helps security organizations reduce vulnerabilities, contain threats, and mitigate risk.

It is also important to note that it is still critical to practice good cyber hygiene, even with MFA. Organizations should set password management policies and educate end-users about best practices. Such policies should include requirements for unique passwords and review the frequency of password rotation, among others.

Which is Right for Your Organization?

The answer to this question depends on the specific needs of your business. However, in general, as the threats faced by organizations have become more sophisticated, it has become clear that single-factor authentication is no longer enough to protect data and systems.

Organizations must implement additional layers of security, and MFA is an essential part of that process. Therefore, when selecting an MFA solution, it is important to consider your firm’s needs and choose a solution that will be easy to use and manage by both your IT team and your end-users.

Reach out to our security experts for help in determining which is the right solution for your business and security needs. We can help you assess your risk exposure, determine any compliance requirements for your sector, and evaluate the ease of deployment and implementation necessary, along with other factors.


About Chris

As Chief Technology Officer at Coretelligent, Chris Messer is a transformational and strategic IT leader who establishes and leads Coretelligent’s technical vision and technological development. Click here to learn more about Chris.

Core CISO Risk Management

Core CISO Risk ManagementThis is the debut post from Coretelligent’s Chief Information Security Officer (CISO), Jason Martino. Jason will be regularly sharing his thoughts about information security on the Coretelligent blog.

With the shift towards security as a business priority, the role of the Chief Information Security Officer (CISO) has expanded and gained prominence within corporate structures. CISOs have long been the subject matter experts on cybersecurity best practices, but as the threat landscape has changed, so too has the position in the ongoing effort to protect company assets and manage risk management.

As the CISO of Coretelligent, I am responsible for our internal cybersecurity and compliance programs. I function as a conduit between IT and business and weigh in on IT and non-IT decisions, ranging from access control reviews and vendor selection to mergers and acquisitions. I also educate staff and customers on their roles in this increasingly dangerous threat environment.

At Coretelligent, we understand the risk of an inadequate security posture. Our C-suite appreciates and values the expertise of its information security professionals in evaluating and mitigating risks and connecting them to business objectives. Unfortunately, in my experience, I have seen too many businesses that do not give their security team a seat at the table. From my perspective, those businesses are still thinking of IT security as a cost center and not a revenue center. This approach is out of step with today’s reality of protecting assets in addition to a company’s reputation and brand.

To persuade any executives who need convincing, here are three takeaways that every CISO wishes their executives would better understand about information security and its role within risk management.

3 Things Your CISO Wants You to Know About Cybersecurity and Risk Management

 

1. Cybersecurity is About Risk Management and Not the Sole Responsibility of IT

Treat cyber risks as a risk-management issue and not solely as an IT function. Facing increased cyber threats, companies must address cyber risk in a business context or face dire consequences, including lost revenue, loss of critical data, reputational damage, compliance fines and penalties, and even the complete failure of the business. Therefore, risk needs to be identified and reduced to an acceptable level as guided by the company’s risk tolerance.

Companies must seek out and mitigate cyber risk on many levels and integrate cyber risk management throughout the organization. Unfortunately, when some executives think about information security, they mistakenly consider it a function of the IT team. But information security and information technology require different skillsets and involve entirely different responsibilities.

2. Prioritize and Practice Policy

Given the opportunity to assess hundreds of companies’ policies, I’ve realized that most companies treat policy as a checkbox activity. However, policy is more powerful than you realize.

Essentially cybersecurity is everyone’s responsibility, but executive buy-in is critical in successfully implementing an effective strategy. Executive buy-in is the crucial first step in aligning business objectives to policy and eventually to practice.

Second, creating policy shapes behavior to manage obligations and mitigate risks. Policies explain requirements for specific processes and the responsible parties involved. Keep content at a high level to avoid overloading policies with best practices, procedures, and other details that will overwhelm non-experts. Policies should be clear and achievable, setting the tone for behavior and expectations.

3. Focus on the Basics

If my inbox is any indication, there is an endless amount of vendors that claim their product or service will make your business more secure. While that may be true in some cases, it is critical to start with a good foundation. Just like you cannot decide to learn a language and become fluent overnight, focus on the fundamentals when mitigating risk. Advanced security products, services, and techniques will not be effective if you do not first build a solid foundation.

Asset management is the beginning of any security journey. To that end, create an inventory of your organization’s IT infrastructure and data and repeat this process continuously. You cannot protect an asset or confidential data if you do not know it exists. This process will allow you to understand your risk exposure. Additionally, an inventory is necessary for knowing where, when, and how to implement security patching versus functional patching.

Not all data is created equal. A one-size-fits-all approach to data protection just does not work in today’s data-driven business landscape. To that end, a tiered approach to protecting data may be more effective than blanket coverage. For example, consider who needs access, data storage and recovery costs, compliance requirements, and other parameters in determining your organization’s strategy. However, it is imperative that you identify and protect the crown jewels—the data assets that generate the most value for your company—and develop a plan that provides the best coverage for those assets.

Once you have a clear outline of your assets, the next step is to perform a risk assessment. Just as all data is not created equal, not all risks are equivalent. This exercise will enable your organization to identify and prepare for the most critical threats.

A critical component of any risk assessment involves identifying threats and vulnerabilities to IT assets. This step connects your inventory to the associated risks and allows your organization to develop a roadmap to mitigate those risks. A useful tool in completing this task is a risk heat map. A risk heat map is a data visualization tool that can help identify, prioritize, and communicate your risk exposure. In addition, it can highlight where best to allocate resources to mitigate risk.

Mitigating Risk Management

I have no doubt that there is more that your organization’s CISO would like to share with you. So, reach out to them and to our experts here at Coretelligent to learn more about protecting your business and mitigating your risk.


JasonAbout Jason

Jason Martino is passionate about the intersection of security and compliance. He is responsible for Coretelligent’s internal cybersecurity programs, governance, risk, compliance activities, and educating staff and customers on an ever-evolving threat landscape.

Financial services institutions have long been a top target for cyber threats. Access to a large amount of sensitive and confidential information makes the financial sector a target-rich environment for cyberattacks. In addition to mitigating cybersecurity threats, financial firms must also prioritize maintaining and strengthening compliance. These balance of these two priorities presents a unique set of challenges for companies in financial services.

With the inherent diversity of the financial services sector and the shifting cybersecurity and compliance landscape, identifying a one-size-fits-all set of vulnerabilities for all financial services institutions is impossible. However, there are common vulnerabilities to be aware of.

  • Reactively Evaluating Current Cybersecurity Posture:

    Institutions cannot address cybersecurity and compliance vulnerabilities of which they are unaware. Moreover, leaving these vulnerabilities unaddressed can have costly consequences. If unaddressed until an incident occurs, institutions have no choice but to utilize a reactive approach that can leave the business facing outages and shaken customer confidence. Instead, financial service firms should consider taking a proactive approach. By utilizing Coretelligent’s Cybersecurity Evaluation Checklist designed for financial services as a jumping-off point, financial service firms can do an initial assessment of existing vulnerabilities to discuss with a managed service provider (MSP).

  • Ransomware Attacks:

    As the world continues to become more digitally integrated, opportunities for ransomware attacks grow exponentially. In a ransomware attack, attackers use malware to gain access to your organization’s systems or data and hold that data until a ransom is paid by the organization. The results of these attacks are devastating. In addition to the price of the ransom, there are legal fees and other costs associated with damage control, as well as potential loss of data.

  • Access Vulnerability:

    Flaws in various levels of access to information can leave sensitive data exposed and vulnerable for attackers. Cybersecurity integration is key across all divisions and at all levels of access in an organization. Cybercriminals will seek to exploit any weaknesses identified at any level, regardless of the internal structure of the business.

  • Managing Compliance:

    The evolution of information technology has increased the compliance burden on the financial services industry. Financial service organizations are amongst the most regulated business segments in the U.S. However, simply maintaining compliance may no longer be enough. Instead, actively managing compliance risk and strengthening compliance overall is key in earning customer confidence and avoiding costly penalties.

  • Business Continuity:

    What comes next if the worst happens and a cyberattack hits your company? Is your data backed up safely? How quickly would you be able to restore access to users? A proactive and dynamic backup and disaster recovery solution is critical for preventing business interruption and loss of essential data, which could trigger a compliance violation. Off-the-shelf, onsite backup solutions often do not provide the level of performance required to meet the needs of financial and investment organizations. It is vital to establish a solution before an outage to ensure timely recovery and minimize interruption time for clients.

Addressing security and compliance vulnerabilities may seem challenging, but Coretelligent can help. Working with Coretelligent means working with an IT partner who understands both the security and compliance needs of the financial services sector. Contact us today at 855-841-5888 or fill out our online form.

Cybersecurity for RIAs

Cybersecurity for RIAsOn February 9th, the Securities and Exchange Commission (SEC) voted to create new and amend existing rules around cybersecurity risk management for registered investment advisers (RIAs) and funds.

“The proposed rules and amendments are designed to enhance cybersecurity preparedness and could improve investor confidence in the resiliency of advisers and funds against cybersecurity threats and attacks,” said SEC Chair Gary Gensler.

The rules would oblige RIA firms to develop and implement written policies and procedures to reduce cybersecurity risks that could harm clients and fund investors. The proposed regulations would also force advisers to report cybersecurity incidents like data breaches involving client information to the SEC.

Additionally, the proposed changes call for publicly disclosing cybersecurity risks and any significant incidents from the last two fiscal years in their marketing materials and registration statements. The SEC is also proposing new recordkeeping requirements to improve the availability of cybersecurity-related information and help streamline the SEC’s inspection and enforcement capacity.

Reach out if your firm needs assistance complying with and implementing these and other cybersecurity compliance standards. Coretelligent offers solutions, including CoreArmor and CoreBDR, to meet the compliance requirements and security needs of the RIAs, advisory firms, and other financial advisors. With over 16+ years of practice helping clients navigate a multitude of IT compliance regulations and strengthening their cybersecurity program, we can help your firm understand and meet its regulatory requirements.

 

SEC Compliance Rule

SEC Compliance RuleIndicates significant changes to regulations for broker-dealers, investment companies, RIA, and other market agents.

The SEC has been signaling the expansion of the compliance around cybersecurity for public financial firms for some time. Increased and intensified state-sanctioned cyber-attacks, data breaches, and ransomware have spotlighted the risk to the U.S. economy, its investment markets, and its investors.

“The economic cost of cyberattacks is estimated to be at least in the billions, and possibly in the trillions, of dollars,” said SEC Chair Gary Gensler in a speech on January 24th. “Hackers have attacked broker-dealers, government agencies, meat processors, and pipelines. These attacks can take many forms from denials-of-service to malware to ransomware.”

Referencing the 2021 Robinhood breach and the SolarWinds incident from 2020, Gensler mentions the joint work of the FBI, CISA, and the Biden administration is ratcheting up to curb the plague—not the COVID-19 pandemic, but the scourge of cybercrime.

He shares that the SEC is looking at ways to strengthen the financial markets’ cyber readiness and hints at a new and expanded compliance framework.

In terms of policy, there are three areas under scrutiny: cyber hygiene and preparedness, cyber incident reporting to the government, and disclosures to the public.

These areas call for IT solutions that prepare for, respond to, and report cyber events. Practices like access management and end-user training, which both reduce the likelihood of cyber incidents, will need to be implemented and reinforced. Additionally, a robust backup system and a disaster recovery plan should be developed or expanded for responding to any events that may happen. Depending on the specific language that ends up in new or expanded regulations, additional IT solutions will most likely be needed for compliance.

As far as which type of organizations may be facing new and strengthened regulations—the list includes SEC registrants in the financial sector, including broker-dealers, investment companies, registered investment advisers, and others. Also in the crosshairs are public companies, third-party service providers, and other organizations not currently registered with SEC, but which support or interact with SEC-registered companies.

Specific regulations that the SEC is proposing to change:

  1. Expanding Regulation Systems Compliance and Integrity (Reg SCI) to cover more entities, including market-makers, broker-dealers, and other financial entities. Reg SCI requires SEC registrants have robust sound technology programs, business continuity plans, testing protocols, data backups, and more.
  2. Implementing new regulations for financial sector registrants, like investment companies, investment advisers, and broker-dealers, not covered by Reg SCI around cybersecurity hygiene practices and incident reporting.
  3. Modernizing Regulation S-P, which deals with data privacy, changing the scheduling and content of notifications to clients about data breaches involving personally identifiable information.

These changes would significantly impact a wide array of companies and subject them to expanded or newly instituted regulations that they may not be prepared to meet.

If your organization requires assistance with keeping up with and implementing these and any other cybersecurity compliance requirements, reach out to our experts. Coretelligent has a suite of solutions, including CoreArmor and CoreBDR, designed to address the compliance and security needs of the financial sector. With over 16+ years of experience helping clients navigate a whole host of IT compliance regulations and bolstering their cybersecurity posture, we can help your firm understand and meet its regulatory requirements.

 

 

 

Solving Cybersecurity on-demand webinar

On-demand webinarWe get it. As executives and IT professionals, you are busy. To that end, we are debuting a new series of short on-demand webinars intended to answer the most commonplace requests we receive. These webinars are designed to connect your firm’s real-world problems with the solutions that address them. They are short and available on your timetable—no signing up for a scheduled webinar and then missing it because you get pulled into a meeting!

The first video is for financial services firms needing guidance on strengthening cybersecurity readiness and compliance response.

Better understand how to effectively respond to the moving target of the twin challenges of cybersecurity and compliance with our free on-demand webinar.

This short compliance and cybersecurity webinar focuses on the following topics:

  • IT Pillars of compliance
  • Cybersecurity priorities for SEC compliance
  • Tips on how to improve cyber readiness and meet compliance
  • And more!

→ Sign up here to watch the webinar.

On-demand webinar