SEC Begins Cyber Sweep of Investment Advisers with Focus on Cloud Storage
A sweep of investment advisers is underway by the U.S. Securities and Exchange Commission, which has sent out many letters to firms over the last week requesting information about their use of cloud providers.
The move could be part of the SEC’s Phase 3 Cybersecurity Exam Initiative, and is likely related to the April Regulation S-P Risk Alert about how firms are protecting personally identifiable information (PII) they store on cloud provider systems. Relatedly, the SEC may be interested in collecting information on whether firms are disclosing cloud vendors on Form ADV Schedule D, Item 1.L.
Many filers do not disclose cloud vendors on Form ADV, since the question asks for the location of books and records other than your office or principal place of business, and technically, records on cloud systems are accessible from a registrant’s office through a web browser. The Omgeo No-Action Letter from August 2009 permits advisers to store records in the cloud as long as the adviser can access those records from their office. Typically, we see firms disclose on the ADV the location of hard copy records, CDs, etc., at Iron Mountain or other physical storage vendors, as well as the locations of any alternate office locations at which original records are kept. Some firms do disclose cloud providers such as Global Relay, Smarsh and Mimecast, etc. although most don’t. SEC staff stated at a recent conference that it has observed an increased use of cloud providers by registrants.
Firms are using so many cloud vendors from portfolio management systems to Office365 to Dropbox to CSS’ own Ascendant Compliance Manager that the list in Section 1.L would likely be dozens of entries if every firm disclosed every location of electronic records. The SEC is interested in learning whether advisers have a handle on all the locations they are storing PII and other sensitive data. And in a new OCIE Risk Alert released May 23, 2019, “Safeguarding Customer Records and Information in Network Storage,” it is clear that the SEC is also focusing on whether advisers and broker-dealers have properly configured data storage solutions to use available security features to safeguard against unauthorized access. Maintaining a current data inventory of the locations of PII and which data is stored where, as well as conducting adequate oversight of these third party cloud providers, are essential components of a reasonably designed cybersecurity program.
CSS is currently running a “Getting Practical with Cyber” series of webinars. Our next, “In the Driver’s Seat: Your Critical Role in Cyber Resiliency,” takes place on June 11 at 2 pm ET. Register by clicking here.
For more information on how CSS can help you evaluate your cybersecurity program, visit our Shield page.