PLANADVISER - Winter 2023 - 26

CONFERENCE COVERAGE
Staying Safe From Evolving Threats
Cybersecurity is a huge concern in all areas of life, critically
in the institutional investing and retirement plan industries.
Plan sponsors, asset owners and their advisers want to ensure
that their data, assets and systems-as well as those of their
providers-are safe. During our Cybersecurity 2023 livestream
" Staying Safe From Evolving Threats, " October 12, experts
discussed what risks exist; optimal practices for protecting
assets and data; and what regulations say, including how
best to comply with them. Below is some of our coverage of
the event. The recorded livestream is available on demand
at planadviser.com/cybersecurity2023.
Best Practices for
Cybersecurity Protection
To minimize the impact of potential
cyberattacks, organizations should:
work with investment managers
on complying with the Securities
and Exchange Commission's new
cybersecurity rules, adopt prevention
measures against threats, and
be prepared to respond if an attack
happens. These were the recommendations
of experts in the session " Best
Practices for Cybersecurity Protection. "
Percy Lee, an associate at Ivins,
Phillips & Barker, Chartered, discussed
the SEC's new cybersecurity rules,
which apply to public companies, registered
investment advisers, investment
companies and broker/dealers.
" These rules have generated a lot of
conversation, including some backlash,
since they were introduced last year,
so the rules have been delayed for now
[for certain organizations], " Lee said.
There are two sets of new SEC
cybersecurity rules. The first governs
publicly traded companies and was
finalized July 26, despite industry pushback.
This rule takes effect this year,
with initial disclosure requirements
effective December 18 and at later
dates for smaller reporting-companies.
The second set of rules governs
registered investment companies and
investment advisers and would require
them to adopt cybersecurity policies
and report digital incidents. This rule
was proposed in 2022 and remains
on the SEC's rulemaking agenda, but
the specific timeline for
finalization
remains unknown.
" According to the rules, which were
brought forward by the SEC in July, RIAs,
investment companies and broker/
dealers would have to adopt written
cybersecurity procedures and report
cybersecurity incidents, " Lee said.
Although these investment advisory
rules do not apply to retirement
plan fiduciaries in general, Lee recommended
that producers ask their investment
managers about their compliance.
" As far as the SEC rules go, it's important
to understand ... that [they're]
for public companies now, but I think
that's going to make its way to even
private firms that aren't traded, " said
Nick Brezinski, director of information
security and network at CAPTRUST.
Roger A. Grimes, a data-driven
defense " evangelist " at KnowBe4 Inc.,
agreed. " It's always good for any organization
to think about what the rules
are that apply to you and how you'd
respond if you got hit by some cybersecurity
incident, " Grimes said. " Just a
ton of people have been hit by ransomware
over the past couple of years. "
26 planadviser.com | Winter 2023 | Plan Management
http://www.planadviser.com/cybersecurity2023 http://www.planadviser.com
PLANADVISER - Winter 2023

Table of Contents for the Digital Edition of PLANADVISER - Winter 2023
