On May 17, 2017, the Office of Compliance Inspections and Examinations (OCIE) of the United States Securities and Exchange Commission (SEC) issued a risk alert highlighting the importance of registered broker-dealers, investment advisers and investment companies taking appropriate steps to protect themselves against ransomware in light of this past week’s WannaCry attack.^[1]

Following its recent cybersecurity sweep exam of 75 firms, OCIE observed that firms of all sizes should implement the following measures:

• Conduct Risk Assessments. According to the risk alert, 5% of the broker-dealers and 26% of investment advisers and investment companies examined did not conduct periodic risk assessments of critical systems to identify cybersecurity threats, vulnerabilities and the potential business consequences.
• Perform Penetration Tests. The risk alert also indicated that the sweep found 5% of broker-dealers and 57% of investment advisers and investment companies did not conduct penetration tests and vulnerability scans on critical information systems.
• Maintain Information Systems. The risk alert further noted that 10% of the broker-dealers and 4% of investment advisers and investment companies had failed to update a number of critical and high-risk patches to maintain the integrity and security of their information systems.

Risk alerts like this are rare and typically focus on regulatory issues that the SEC seeks to emphasize to its registrants – in this case, the compliance measures entities must implement to protect against ransomware and other cyber threats. These findings show that the SEC views risk assessments, penetration tests and patching as key elements of any firm’s cybersecurity program. They also show that investment advisers and investment companies appear to be behind the curve on implementing these measures despite previous guidance by the SEC’s Division of Investment Management and OCIE.^[2] Given these repeated warnings, firms that fail to incorporate these measures into their cybersecurity programs risk not only a cyber incident, but also an enforcement action by the SEC for not reasonably safeguarding customer information and planning for business continuity.

[1] SEC National Exam Program Risk Alert, Cybersecurity: Ransomware Alert (May 17, 2017), https://www.sec.gov/files/risk-alert-cybersecurity-ransomware-alert.pdf.
[2] See, e.g., SEC National Exam Program Risk Alert, OCIE’s 2015 Cybersecurity Examination Initiative (Sept. 15, 2015), https://www.sec.gov/ocie/announcement/ocie-2015-cybersecurity-examination-initiative.pdf; SEC Division of Investment Management, Cybersecurity Guidance (Apr. 2015), https://www.sec.gov/investment/im-guidance-2015-02.pdf.