Would Your Firm’s Cybersecurity Policy Meet Regulatory Muster?

"We have the technology, reporting and policies built into our platform that will be customized based on the RIA's written policies," explained Stillman. "The RIA and their compliance team must create the actual security policy themselves. However, working with Stark & Stark to prepare the policy makes the process very simple because they have already included our core capabilities into the cybersecurity policy and can now modify the policy to meet each client's unique requirements."

The final step in the process is for Right Size Solutions to customize the technology policies to match the RIA's newly written Cybersecurity Policy.

Stillman told ThinkAdvisor in a recent interview that it's important for advisors to be able to prove to regulators that their written policies are actually being implemented. State and SEC examiners, he says, will first ask if the advisor has a written policy, but they will "turn around and audit what you've written down, [comparing those policies] to what's implemented in [the firm's] technology." For instance, "If you said I want a complex password policy and you create a password that's 1, 2, 3, 4, then those two things don't jibe and that's when the auditors start getting excited," Stillman says. Right Size, he says, "makes sure that whatever [the advisory firm has] written down in a policy, we have implemented that policy from a technology perspective and that we are able to report on what that is. So when an auditor comes in and says, 'prove to me that you're auditing emails, what is that process,' we are able to say here is the process, the reports and the results of [the advisor's] work."

Stillman says that it will "build" a cybersecurity policy that can be tweaked to accommodate the firm's specific needs. For instance, "some firms may want us to control and manage their mobile devices and others may say 'we have a policy that says we're not going to use those devices to communicate with clients,' so we don't need those sections" of a specific policy.

—

Articles by Tom Giachetti, chairman of the securities practice group of Stark & Stark, on ThinkAdvisor:

• SEC Is Getting Into the Weeds
• Personal Securities Reporting: Push Back at Your Peril
• Cybersecurity: The SEC's Critical Initiative