State Regulators Find 700 Cybersecurity Flaws At Advisor Firms

State securities regulators detected nearly 700 cybersecurity deficiencies during 1,200 coordinated exams of state-registered investment advisors, the North American Securities Administrators Association (NASAA) announced today at its annual conference in Seattle.

“Cybersecurity is a growing challenge and no investment advisor of any size can afford the loss in client trust—much less financial losses—that will result from a serious cybersecurity failure,” said Mike Rothman, NASAA president and Minnesota commissioner of commerce.

The findings come on the heels of the Securities and Exchange Commission’s admission last week that it’s EDGAR public company filing database had been hacked, providing intel for illicit trading gains.

The deficiencies were found during exams of advisors in 37 states and jurisdictions between January and June.

Top cybersecurity deficiencies include inadequate cybersecurity insurance or none at all; no testing of cybersecurity vulnerability; and a lack of procedures regarding securing or limiting access to devices.

To help advisors ramp up cybersecurity, NASAA just released a new online checklist that spans 89 assessment areas including identifying, preventing and detecting cybersecurity vulnerabilities: 

The online tool also details steps for assessing cybersecurity insurance coverage, making sure employee procedures don’t invalidate insurance claims and specific steps for recovering from a cybersecurity breach. State regulators say they want to see that each state investment advisor has plans and procedures for immediately notifying clients and authorities and filing an insurance claim if a security breach occurs.

The 1,203 examinations of state-registered investment advisors uncovered 7,907 deficiencies in 25 compliance areas, compared to 4,983 deficiencies in 22 compliance areas uncovered by 1,170 examinations in 2015. 

Many increases in deficiencies reported in 2017 can be attributed to the addition this year of cybersecurity and enhanced efficiencies in the state examination process, officials said.