Branch Offices Lack Policies for Protecting Client Records: SEC

In particular, SEC exam staff explains that firms were lax in the following areas:

1. Vendor management

In many instances, firms did not appear to reasonably ensure that their branch offices performed proper due diligence and oversight of their vendors as required by the firms' own policies and procedures.

2. Email configuration

Firms often use vendors to provide email services. SEC staff observed that in many instances, these services are managed from the main office where staff or vendors provide accounts for branches. However, in some instances, firms did not manage email accounts for branch offices.

3. Data classification

While they often maintained data classification written policies and procedures to identify where client records and information were stored electronically, firms did not always apply these policies and procedures to branch offices.

4. Technology risk

Though they maintained reasonable technology policies and procedures for their main office, firms did not apply any such policies and procedures in connection with their branch offices in some instances. As a result, branch office systems were more prone to compromises.

(Image: Adobe Stock)