PLANADVISER - November/December 2022 - 23

C
Foil potential breaches with strong
data security practices
T
he Securities and Exchange Commission has clearly
signaled that retirement plan advisers must adopt and
implement prescribed best practices for their cybersecurity
programs. Cybersecurity should be a top priority for
advisers, and the SEC wants better, more consistent practices
combined with additional reporting and disclosure.
On February 9, the SEC proposed new cybersecurity
risk management amendments and rules for SEC-registered
investment advisers and investment companies. The
proposal's comment period closed in April, and there is no
date for the final release, though sources estimate the rule
will be published in early 2023. The agency's " Cybersecurity
Risk Management Fact Sheet " states that the proposal will:
1) address concerns about advisers' and funds' cybersecurity
preparedness while reducing risks for clients and investors;
2) improve advisers' and funds' disclosures about their cybersecurity
risks and incidents; and 3) improve the SEC's ability
to assess systemic risks and oversee advisers and funds.
Prescriptive Proposal
Each of the proposal's three categories contains detailed
guidance on what the SEC expects for compliance, stressing
that adhering to the new rules is mandatory even if the cost
to do so is a challenge. Per the proposal: " In the extreme, we
expect that registrants with no current cybersecurity policies
and procedures would have to bear substantial costs. "
The proposal incorporates established best practices
with multiple references to existing guidance from the
National Institute of Standards and Technology and the
Cybersecurity and Infrastructure Security Agency. The
SEC allows advisory firms flexibility with implementation,
however, recognizing that " there is not a one-size-fits-all
approach to addressing cybersecurity risks. "
The agency has taken a stronger position with this
proposal than in its previous cybersecurity guidance. " While
in the past the SEC has focused more on recommendations
and best practices, now the agency is shifting its stance to
implementing a prescriptive rule set and creating accountability, "
according to technology consulting firm ECI's report
" New SEC Rules for Cybersecurity Risk Management: How
Investment Advisers and Funds Should Respond Today. "
Cybersecurity Risk Management
The proposal's cybersecurity risk management section lists
multiple requirements, with an overarching theme that
informal, ad hoc cybersecurity plans will no longer suffice.
The required actions start with " periodic risk assessments "
to identify and classify a firm's digital assets and the possible
risks to those assets. For example, where does a firm's data
reside? Which technology partners and outsourced service
providers have access to the adviser's information systems?
What is the potential impact of a cybersecurity incident?
The SEC notes that assessments should be updated at
least annually, or more frequently if a firm makes significant
changes to its operation, such as moving to a new cloud
service provider, for instance.
practice management / cybersecurity
YBER
READY
Art by Lars Leetaru planadviser.com November-December 2022 | 23
http://www.planadviser.com
PLANADVISER - November/December 2022

Table of Contents for the Digital Edition of PLANADVISER - November/December 2022
