SEC Requests Financial Firms' Security Details

The Securities and Exchange Commission plans to study the information security policies, procedures, and levels of preparedness of businesses in the financial services sector.

In an announcement issued earlier this month, the SEC's Office of Compliance Inspections and Examinations (OCIE) said it would be "conducting examinations of more than 50 registered broker-dealers and registered investment advisers, focusing on areas related to cybersecurity" -- government-speak for anything involving information, computers, and security.

The agency's stated rationale for conducting the examinations is to "help identify areas where the Commission and the industry can work together to protect investors and our capital markets from cybersecurity threats." Interestingly, the agency added that "this guidance is not a rule, regulation, or statement of the commission," suggesting that the information would be amassed -- at least initially – only for information-gathering purposes.

What form will those examinations take? While no final version of the exam has been released, the OCIE included in its announcement a 28-question sample cyber security document that poses questions around such areas as risk identification, safeguarding firms' networks, securing remote customer access and fund-transfer requests, working with vendors, and detecting unauthorized activity. The agency said the questions are based in part on the "Framework for Improving Critical Infrastructure Cybersecurity" released by the National Institute of Standards and Technology in February.

[Investments in security startups are taking off. Read Venture Capital: The Lifeblood Behind Security Innovation.]

What's especially notable about the SEC's announcement is that the examination isn't predicated on telling businesses what to do or presenting them with a checklist. Instead, it says that maintaining correct risk-based controls is the responsibility of any individual business, and that those controls will be unique to the business. For now, the SEC wants details about what businesses are doing and why they're doing it.

"The philosophy here... is very rigorous; it's very risk-based, comprehensive, and specific to an organization," said Carl S. Young, managing director and chief security officer at computer investigations, intelligence, and risk management firm Stroz Friedberg, speaking by phone. "I was quite encouraged by this exam and the message it sends in terms of people recognizing that this is not a checklist-oriented problem."

According to Young, the Commission is also showing it now wants more than assurances from financial firms. "They've recognized that there needs to be some kind of scrutiny that goes beyond people saying, 'We're OK,' " he noted.

One of the exam's top questions, for example, is this request: "Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

But businesses may also face further inquiries from the SEC. "They caveated pretty hard by saying this is not a safe harbor, and there may be other questions," Young points out.

The SEC's examination announcement comes in the wake of a March roundtable, hosted by the agency, which was designed to investigate what role the SEC should play when handling two issues: ensuring that public companies have robust information security defenses in place, and ensuring the security of the market infrastructure and of any organization that must comply with SEC regulations.

"As an SEC commissioner, I have become particularly concerned about the risks that cyberattacks pose to public companies, and to the capital markets and its critical participants, including the exchanges, clearing agencies, transfer agents, broker-dealers, and investment advisers," said SEC commissioner Luis A. Aguilar at the roundtable. "Cyberattacks aimed at these market participants can have devastating effects on our economy, on individual consumers, and on the markets and investors that the SEC was created to safeguard."

Of course, the new exam isn't the agency's first move to solicit information security particulars from financial firms. In 2011, the SEC began requiring public companies to begin releasing some security-related information. "That guidance makes clear that material information regarding cyber security risks and cyber incidents is required to be disclosed," said SEC chairwoman Mary Jo White at the roundtable.

Agency officials have continued to study how businesses have responded to that requirement. "With regard to the public company discussion, I am particularly interested in hearing whether the current disclosure regime under the 2011 guidance is working or how it could be improved," said Aguilar.

Last year, per Regulation S-ID, the SEC also began requiring some financial services firms and creditors to create identify theft programs and comply with Identity Theft Red Flags Rules.

When it comes to the cybersecurity examination, which 50 businesses might the agency first look at? One likely scenario is that the agency will try to study organizations both large and small from a variety of different financial sectors. "That's my view," says Stroz Friedberg's Young. "If they can categorize them into food groups, then I'd take a hard look at what the results of the exam were, then I'd modify the exam and propagate it outwards."

The results of the SEC's exam may have ramifications far beyond the financial services industry. "This may be a watershed announcement," says Young. "It wouldn't shock me if other agencies followed suit."

NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.