How to Bolster Cybersecurity During a Pandemic

In this respect, SEC Chairman Jay Clayton himself opined, "Data systems are critical to the functioning of our markets and cybersecurity and resiliency are at the core of OCIE's inspection efforts."

Here are a few items we suggest RIAs specifically consider during those risk assessments, based OCIE's Cybersecurity and Resiliency Observations:

Access Management: OCIE highlights multi-factor authentication as an effective tool to mitigate both internal and external penetrations. In the context of the pandemic, RIAs should consider whether to implement or increase their use of multi-factor authentication, especially where users will be logging into firm systems from outside the firm's physical office.

Vulnerability Scanning: RIAs should establish a vulnerability management program that could scan network components, information systems, and endpoints. Because the RIA's endpoints may have spread well outside the office during the pandemic and they may be relying upon different vendors, they should consider the adequacy of their vulnerability management program and consider additional fortification if necessary.

Vendor Monitoring and Testing: As RIAs rely more on third-party service providers, OCIE apparently has increased its due diligence obligations for RIAs. This includes monitoring vendor relationships to ensure that they continue to meet security requirements and notify RIAs about critical personnel changes.

The pandemic may have put overwhelming strain on some of these vendors, and therefore, RIAs may be at risk of a service interruption that could ultimately damage their clients. Therefore, RIAs should consider additional communications with their vendors and evaluation of substitute vendors if necessary.

Risk Assessments: The risk assessment should identify, manage, and mitigate cyber risks relevant to the RIA's business. This includes identification and prioritization of "potential vulnerabilities, including remote or traveling employees or insider threats." In the case of the pandemic, RIAs should assess the increased risks of having its staff working from home or inability to access firm resources as they could at the office.

Thomas D. Giachetti is chairman of the Investment Management and Securities Practice Group of Stark & Stark, a law firm. He can be reached at [email protected].