Cybersecurity graphic

As markets grow more global and complex, so too are the threats through cyber intrusion, denial of service attacks, manipulation, misuse by insiders and other cyber misconduct. In the United States, aspects of cybersecurity are the responsibilities of multiple government agencies, including the SEC. Cybersecurity is also a responsibility of every market participant. The SEC is committed to working with federal and local partners, market participants and others to monitor developments and effectively respond to cyber threats.

d

CYBERSECURITY UPDATE:

CISA and its partners are responding to active, widespread exploitation of a critical remote code execution vulnerability in Apache’s Log4j software library. Log4j is very broadly used in a variety of consumer and enterprise services, websites, and applications—as well as in operational technology products—to log security and performance information. An unauthenticated remote actor could exploit this vulnerability to take control of an affected system. For more information please visit: CISA’s Apache Log4j Vulnerability Guidance.

Get Information on Ransomware

Ransomware attacks are increasing in scale, sophistication, and frequency, victimizing governments, individuals, and private companies around the world. The Cybersecurity and Infrastructure Security Agency (CISA) has launched StopRansomware.gov a one-stop resource for individuals and organizations of all sizes to reduce their risk of ransomware attacks and improve their cybersecurity resilience.  This webpage brings together tools and resources from multiple federal government agencies under one online platform.  Learn more about how ransomware works, how to protect yourself, how to report an incident, and how to request technical assistance.

GETTING IN THE KNOW

Investors increasingly rely on the internet to open investment accounts, check up on their holdings and make securities transactions. The SEC provides valuable guidance, including an Investor Alert and Investor Bulletin to help investors get in the know and protect themselves from cyber threats.

c

KEEPING A WATCHFUL EYE

The SEC provides cybersecurity guidance to help broker-dealers, investment advisers, investment companies, exchanges, and other market participants protect their customers from cyber threats. The agency also keeps a watchful eye over market participants, including by making cybersecurity a priority of its National Exam Program.

a

HOLDING THEM ACCOUNTABLE

The SEC uses its civil law authority to bring cyber-related enforcement actions that protect investors, hold bad actors accountable, and deter future wrongdoing. The Division of Enforcement’s Cyber Unit was established in September 2017 and has substantial cyber-related expertise. The Cyber Unit focuses on violations involving digital assets, initial coin offerings and cryptocurrencies; cybersecurity controls at regulated entities; issuer disclosures of cybersecurity incidents and risks; trading on the basis of hacked nonpublic information; and cyber-related manipulations, such as brokerage account takeovers and market manipulations using electronic and social media platforms.

SEC Resources

Self Regulatory Organizations

Regulation SCI

SEC Cybersecurity Roundtable

External Resources

Are You Cyber-Savvy?

Take the quiz!

DID YOU KNOW?

The SEC Division of Enforcement’s IT Forensics Lab hosts a highly specialized team of forensic analysts to assist in digital investigations, including cyber investigations.

Cybersecurity Risk Alerts

Email Updates

Signup for news about this topic.