The U.S. Securities and Exchange Commission (SEC) has published guidance to help firms in the securities market enhance their cybersecurity preparedness and operational resiliency.

 

The observations highlight certain approaches taken by market participants in the areas of governance and risk management, access rights and controls, data loss prevention, mobile security, incident response and resiliency, vendor management and training and awareness. The observations highlight specific examples of cybersecurity and operational resiliency practices and controls that organizations have taken to potentially safeguard against threats and respond in the event of an incident.

 

“Data systems are critical to the functioning of our markets and cybersecurity and resiliency are at the core of OCIE’s inspection efforts,” said SEC Chairman Jay Clayton.  “I commend OCIE for compiling and sharing these observations with the industry and the public and encourage market participants to incorporate this information into their cybersecurity assessments.”

 

“Through risk-targeted examinations in all five examination program areas, OCIE has observed a number of practices used to manage and combat cyber risk and to build operational resiliency,’ said Peter Driscoll, Director of OCIE.  “We felt it was critical to share these observations in order to allow organizations the opportunity to reflect on their own cybersecurity practices.”

 

For Governance and Risk Management, for example, the SEC recommends:

 

• Policies and Procedures. Adopting and implementing comprehensive written policies and procedures addressing the areas discussed below and identified risks.
• Testing and Monitoring. Establishing comprehensive testing and monitoring to validate the effectiveness of cybersecurity policies and procedures on a regular and frequent basis. Testing and monitoring can be informed based on cyber threat intelligence.
• Continuously Evaluating and Adapting to Changes. Responding promptly to testing and monitoring results by updating policies and procedures to address any gaps or weaknesses and involving board and senior leadership appropriately.
• Communication. Establishing internal and external communication policies and procedures to provide timely information to decision makers, customers, employees, other market participants, and regulators as appropriate.