Statement on Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies

Cyber-attacks have increased at an alarming rate in recent years in terms of size, frequency and sophistication. The Equifax breach in 2017 could cost the company as much as $700 million, and affected over 145 million consumers.[1] In 2019, SolarWinds experienced a major cyber breach that impacted nearly 18,000 of its customers, prompting the U.S. Department of Homeland Security to issue an emergency directive to all federal agencies.[2] The acceleration has continued unabated into 2021 with the Colonial Pipeline Company becoming the victim of an attack that heavily disrupted the flow of gas to the East Coast for days,[3] and one of the largest U.S. insurance companies reportedly paying $40 million to hackers after it suffered a ransomware attack.[4] In fact by some measures, we’ve seen a more than a 68% increase since 2020 in the overall number of data compromises,[5] and a concomitant rise in the sophistication of these bad actors.[6]    

Funds and their advisers, because of the data they store and manage, are enticing targets for such activity which can cause serious investor and market harm.[7] The proposal takes a much-needed holistic approach to the issue rather than the more discrete and piecemeal approach we’ve taken thus far.[8] Importantly, our efforts today acknowledge that cybersecurity threats can have a profound impact on the financial system, and establish the groundwork for a more collective and collaborative approach among a variety of parties including the adviser, the fund board, and others. This in turn will build transparency, responsiveness and accountability.

Today’s release includes important investor protections designed to address cybersecurity risks in a comprehensive way. For instance, the proposal includes a requirement for advisers and funds to adopt and implement written cybersecurity policies and procedures.[9] This will help establish a first line of defense in protecting both firms and investors, and is just one of many ways the proposal would increase investor protection and market integrity.

Another key provision of the proposal is the notification to the Commission of certain cybersecurity incidents.[10] This will enhance our ability to monitor and help address cybersecurity incidents that could have potentially broader system-wide impacts.[11] These provisions raise a number of questions. For example, the proposal would require notification to the Commission of an incident within 48 hours, but the notification to an adviser’s clients has no specific timeframe. Instead such notification would need to be made “promptly.” Should investor notification be tied to a more discrete timeframe to ensure timeliness? And, what specific information do investors need to know about such incidents?

I welcome the public’s input on these and all other provisions in the proposal, as we work to develop a transparent, nimble and accountable framework for investment advisers and funds. I also very much look forward to the Commission staff’s recommendation on cyber-related rules impacting issuers. I’m pleased to support this proposal, and I want to thank the staff in the Divisions of Investment Management and Economic Risk and Analysis, as well as the General Counsel’s office.