Statement on Cybersecurity Risk Management Proposal for Investment Advisers, Registered Investment Companies, and Business Development Companies

The threat of cyberattacks on U.S. financial services firms is one of those issues that keeps me up at night. Financial services firms are leading targets of cyberattacks because “that’s where the money is.”[1]  Cyberattacks don’t just have the potential to disrupt individual firms and their immediate clients - they have the potential to cause market-wide instability. The G20 recently warned that cyberattacks could “disrupt financial services crucial to both national and international financial systems, undermine security and confidence and endanger financial stability.”[2]

Investment advisers and funds manage tens of trillions of investor dollars.[3]  They can be targeted directly or indirectly through the web of service providers that many firms must use to conduct business.[4] The latter creates a broad array of potential exposure and their critical business functions can be adversely impacted in numerous ways.[5] These potential points of vulnerability include the loss of customer’s personally identifiable information, the inability to access accounts or trade, the theft of intellectual property, confidential or proprietary information, or even the theft or loss of client assets.

Further, there has been an increase in the frequency and sophistication of cyberattacks[6]-- meaning a corresponding increase in risk to investors whose assets are held by the firms.

Given these realities, robust cyber hygiene practices are critical, both to safeguard investor money entrusted to firms and advisers and to guard against market-wide instability. Today’s proposal would require all registered advisers and funds to design and implement cybersecurity policies and procedures in order to be prepared for future cyber threats. And such policies and procedures would be subject to recordkeeping requirements so that deficiencies can be identified and addressed.[7]

Additionally, investors need relevant information to inform their investment decisions. And this holds true when it comes to cybersecurity risks. Today’s proposal would require advisers and funds to tell investors about the cybersecurity risks they anticipate, how they would handle those threats, and the nature and scope of any significant cybersecurity incidents that occurred in the past two years. Further, the proposal would require regulatory reporting of any significant cybersecurity incidents to the Commission within 48 hours, and prompt notification to investors.[8] This would give the Commission data to assess trends, identify emerging risks, and help coordinate responses to cyber incidents that have the potential to cause broader disruptions, as well as providing investors with information they may need to respond to the incident.

I support today’s proposed rules to enhance cyber practices by funds and advisers. And this is just one piece of the puzzle. This critical issue requires a comprehensive approach, and I look forward to future cyber-related Commission actions in other areas of our regulatory remit.[9]

Thank you to the Chair’s office, the staff in the Division of Investment Management, the Office of the General Counsel, and the Division of Economic and Risk Analysis for their thoughtful work on today’s proposal. I look forward to reviewing the comment letters and working with the staff as we move toward a final rule.