Navigating the US Securities and Exchange Commission's evolving expectations for cybersecurity preparedness

Abstract

The US Securities and Exchange Commission expects its registered broker-dealers, investment advisers and investment companies to implement cybersecurity safeguards through policies and procedures reasonably designed to protect customer records and information, as well as to prepare generally for cybersecurity threats that could undermine the ability to meet regulatory obligations. However, the manner in which registrants are expected to accomplish these goals is uncertain given the SEC's reliance on a principles-based standard, non-specific staff guidance, and the contextualisation of its expectations through enforcement actions. This paper explains the bases of the SEC's approach to cybersecurity preparedness and the challenge of navigating through changing and uncertain expectations, and then offers simple steps to understand and respond to regulatory signals when choosing appropriate cybersecurity measures, as well as memorialising that a firm has acted with the appropriate standard of care.