As markets grow more global and complex, so too are the threats through cyber intrusion, denial of service attacks, manipulation, misuse by insiders and other cyber misconduct. In the United States, aspects of cybersecurity are the responsibilities of multiple government agencies, including the SEC. Cybersecurity is also a responsibility of every market participant. The SEC is committed to working with federal and local partners, market participants and others to monitor developments and effectively respond to cyber threats.
Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
As outlined in a joint statement issued Dec. 16, 2020 by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Office of the Director of National Intelligence (ODNI), the U.S. government has become aware of a significant and ongoing cybersecurity campaign. Pursuant to Presidential Policy Directive (PPD) 41, the FBI, CISA, and ODNI have formed a Cyber Unified Coordination Group (UCG) to coordinate a whole-of-government response to this significant cyber incident. The UCG is intended to unify the individual efforts of these agencies as they focus on their separate responsibilities. This is a developing situation, and we continue to work to understand the full extent of this campaign. Please follow the links below to find helpful information published and updated by CISA:
GETTING IN THE KNOW
Investors increasingly rely on the internet to open investment accounts, check up on their holdings and make securities transactions. The SEC provides valuable guidance, including an Investor Alert and Investor Bulletin to help investors get in the know and protect themselves from cyber threats.
KEEPING A WATCHFUL EYE
The SEC provides cybersecurity guidance to help broker-dealers, investment advisers, investment companies, exchanges, and other market participants protect their customers from cyber threats. The agency also keeps a watchful eye over market participants, including by making cybersecurity a priority of its National Exam Program.
HOLDING THEM ACCOUNTABLE
The SEC uses its civil law authority to bring cyber-related enforcement actions that protect investors, hold bad actors accountable, and deter future wrongdoing. The Division of Enforcement’s Cyber Unit was established in September 2017 and has substantial cyber-related expertise. The Cyber Unit focuses on violations involving digital assets, initial coin offerings and cryptocurrencies; cybersecurity controls at regulated entities; issuer disclosures of cybersecurity incidents and risks; trading on the basis of hacked nonpublic information; and cyber-related manipulations, such as brokerage account takeovers and market manipulations using electronic and social media platforms.
Cybersecurity Risk Alerts
- Cybersecurity Risk Alert: Safeguarding Client Accounts against Credential Compromise
September 15, 2020
- Cybersecurity Risk Alert: Ransomware Alert
July 10, 2020
- Cybersecurity Risk Alert: Safeguarding Customer Records and Information in Network Storage - Use of Third Party Security Features
May 23, 2019
- Cybersecurity Risk Alert: Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P - Privacy Notices and Safeguard Policies
April 16, 2019
- Issuers / Public Companies
- Investment Advisers / Investment Companies
- Brokers and Dealers
- Self Regulatory Organizations
Providing Investors with Information
Investment Advisers/Investment Companies
Adopting release for ICA Rule 38-1 and IAA Rule 206(4)-7 (see Section II(A)(1) of the Adopting Release, which provides additional information about issues that the policies and procedures of funds or advisers should consider, certain of which are related to cybersecurity)
Engaging Government Agencies and Industry
Assessing Market Participant Readiness
Brokers and Dealers
Adopting release (see pages 232-236 for explanatory text)
Market Access Rule
Assessing Market Participant Readiness
DID YOU KNOW?
The SEC Division of Enforcement’s IT Forensics Lab hosts a highly specialized team of forensic analysts to assist in digital investigations, including cyber investigations.
Signup for news about this topic.
Modified: Feb. 26, 2021