Cybersecurity for RIA Firms

We recently hosted 175 RIA firms on a webinar discussing the relevance and importance of protecting advisory clients from cyber threats.

We began by addressing three common misperceptions that sometimes prevail within our industry.

1) Cyber threats against RIA firms are rare.

Regrettably, this isn't the case. Just among our client base, we see attempted (and in one case successful) cyber frauds occur all the time. In fact, 10% of our clients (the clients of our clients, to be exact) have been the target of cyber fraud, usually by means of a hacked email account and a fraudulent wire request.

Michelle Wraight, vice president and chief privacy officer at Pershing agrees: “We’re seeing wire transfer fraud at epidemic levels,”

2) Cybersecurity is a “big firm” problem.

Every RIA - big or small - have points of vulnerability. In fact, regulators have specifically noted that smaller RIA firms will not get a pass when it comes to putting procedures in place to protect clients.

3) Cybersecurity is an IT issue.

Cybersecurity requires a multi-pronged approach. Effective cybersecurity goes way beyond information technology. Effective cybersecurity risk management is a cross-functional challenge that must also address operational processes, vendor management, regulatory requirements and human resources.

We then addressed the topic from a reguator's perspective. Regulators expect that compliance and risk management be an integrated part of the operations of your business. Cybersecurity is not just a technology concern.

The SEC's Office of Compliance Inspections and Examinations' (OCIE) recent cybersecurity initiative was designed to assess the preparedness of RIAs and ensure that firms are taking necessary steps to mitigate cyber threats. These include: preparedness, firm governance, identification and assessment of risks, protection of networks and information, remote access and funds transfer requests

We then provided some practical steps for RIAs to follow that would not only satisfy their regulatory expectations but also protect their clients from the very real threats that exist today. They include: maintaining a working knowledge of all clients (and their "normal" activity with respect to wire requests), securing mobile devices, securing hardware/office space and setting procedures and controls that govern how your firm processes client wire requests.

Read More

The AdvisorAssist CCO Series: Privacy & Information Security

A central element of your RIA firm’s fiduciary duty is the protection of clients’ confidential information. These responsibilities are laid out in your firm’s Privacy Policy.

A topic that is closely related to your duty of privacy and confidentiality is information security. Formal information security policy manuals for RIAs, a proposed (but not yet codified) regulatory requirement, offer many best practices that help advisors demonstrate their commitment to protecting client information.

The RIA Firm's Privacy & Information Security Responsibilities In a Nutshell

Supervised Persons of an RIA firm must keep confidential at all times any nonpublic information that they obtain during the course of carrying out their advisory responsibilities.

This includes client or prospective client identities, their identifying information (e.g. addresses, dates of birth, social security numbers), their investments and their account activity. (Some states maintain distinct definitions of identifying information that must be protected)

As a policy, Supervised Persons must not release confidential or nonpublic information without consulting the Chief Compliance Officer (“CCO”) in advance. When disclosure is necessary to conduct business for a client, nonpublic personal information should be limited to the extent necessary or appropriate.

At least annually, RIA firms must provide notice to clients describing the firm’s privacy policies, to the extent required by law. This can be accomplished by delivering a copy of the firm’s Privacy Policy.

Your firm’s Privacy Policy should contain the following:

1. What information you collect from clients
   
2. What sources you collect information from, over and above information provided by the client
   
3. Your firm’s basis for sharing this information
   
4. Any state-specific privacy regulations (Currently CA, MA, and VT have specific privacy laws that extend beyond federally-mandated rules.)
   

Advisors must also ensure that appropriate safeguards are in place to protect client information (i.e. information security practices).

Through the Regulator's Eyes

In 2000, the SEC adopted Regulation S-P, which covers the rules related to the Privacy of Customer Financial Information. In the hyper-networked, digital world we live in, regulators obviously want to continue to ensure the general public that their private information is adequately safeguarded. Regulation S-P requires advisors to adopt and maintain written supervisory procedures to protect the privacy of customer data.

CCO Best Practices for Privacy

• Provide a copy of your firm’s Privacy Policy to new clients along with your investment advisory agreement.
  
• Deliver a copy of your Privacy Policy to all clients at least annually. This is most easily accomplished by including it with your annual ADV delivery in April (October RIA firms with 6/30 fiscal year ends.)
  
• Confirm that your investment advisory agreements contain an acknowledgment of receipt of the privacy notice if required.
  

CCO Best Practices for Information Security

• Identify any reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information and personal information systems. Consider potential options to mitigate or eliminate these risks.
  
• Adopt written policies that address the proper disposal of personal information that is not required to be maintained for Books and Records purposes.
  
• Be judicious about the amount of personal information that you collect and limit it to what is necessary to perform your duties.
  
• Adopt a “clear desk” policy (so that employees don’t leave sensitive information out in the open) and ensure that physical client files are locked when not in use.
  
• Limit systems access to active users (Supervised Persons) only and delete access credentials for departed staff.
  
• Ensure that work computers are set up to require periodic updates of strong passwords. Here’s a great tool to test exactly how strong your passwords are: HowSecureisMyPassword.net.
  
• Encrypt and password protect all portable electronic devices.
  
• Use encryption when sending data electronically.
  
• Secure and password protect wireless networks.
  
• Install (and update!) firewalls and anti-virus protection for all computers that are used to access client data (including personal computers if employees do work from home).
  
• Monitor and limit the information that is brought into your firm by new employees and ensure that this information is in accordance with the privacy policies of their prior employer and does not breach confidentiality agreements.
  
• Take reasonable steps to select and retain service providers that maintain appropriate safeguards for the personal information at issue. Request copies of your service providers’ information security protocols.
  
• Include information security training as part of your annual CCO meeting with Supervised Persons.

Read More

Cybersecurity: Best Practices and Webinar Replay

Webinar Replay

AdvisorAssist recently hosted a webinar titled "Cybersecurity for RIAs: How Safe are You?" Click here to watch or download the replay.

What you need to know

When seeking to act in their client’s best interest, registered investment advisors collect private information from their clients. This information forms the basis for the advice they will provide to their client, whether through consultation or discretionary investment management. Understandably, the advisor is in continuous possession of private client information while servicing a particular client, investor, or related participant.

Section 30(a) of Regulation S-P under the Gramm-Leach-Bliley Act of 1999 requires advisors (along with broker-dealers and investment companies) to adopt policies and procedures that create administrative, technical, and physical safeguards for the protection of customer records and information. These policies and procedures must must be reasonably designed to:

• Ensure the security and confidentiality of customer records and information;
• Protect against any anticipated threats or hazards to the security or integrity of customer records and information; and
• Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

The SEC has said that an RIA’s policies and procedures must include how advisors conduct periodic risk assessments, implement a firewall, encrypt private client information stored electronically, and maintain a response plan for cybersecurity incidents. Advisors are expected to anticipate potential cybersecurity events and have clear procedures in place rather than waiting to react once a breach occurs.¹.

Why You Should Care

Identify theft, cyber fraud and high profile security breaches have become common occurrences, especially among commercial merchants and asset managers. Previously, we covered common misperceptions that sometimes stop advisors from properly protecting advisory clients from cyber threats. Since then, the SEC Office of Compliance Inspections and Examinations (“OCIE”) published a series of Risk Alerts announcing a priority for examinations to identify cybersecurity risks and assess cybersecurity preparedness in the securities industry.

The focus of the OCIE during exams will be on the following areas:

• Governance and Risk Assessment, including the level of communication to, and involvement of, senior management and boards of directors.
• Access Rights and Controls, including a review of controls associated with remote access, customer logins, passwords, protocols to address customer login problems, network segmentation, and tiered access.
• Data Loss Prevention, including how advisors verify the authenticity of a customer request to transfer funds.
• Vendor Management, including due diligence with regard to vendor selection, monitoring and oversight of vendors, and contract terms.
• Training, including how procedures for responding to cyber incidents under an incident response plan are integrated into regular personnel and vendor training.

Our Recommendations

To ensure that your firm is keeping up with regulatory requirements and industry best practices in this area AdvisorAssist recommends that the CCO:

• Review written policies and procedures to ensure they include:
1. Identification of Cybersecurity risks
2. Controls in place to detect and mitigate the Cybersecurity risks
3. Assessment of points of vulnerability, both operational and technological
4. A mechanism to gauge the effectiveness of policies and procedures that protect the your networks and sensitive information
5. Descriptions of how you will respond to a breach of security
• Train your employees on cybersecurity policies. The policies must be communicated and enforced by the highest levels of management.
• Document all testing and monitoring of cybersecurity policies.
• Engage an independent third party provider to conduct internal and external vulnerability assessment scans and penetration tests.
• Review your Privacy Policy and update as needed.

^{1. See SEC Release No. 4204 published September 22, 2015. ↩ Back to note 1}

Contributors:
Brendan Furey
Michael Conlon

Read More

The AdvisorAssist CCO Series: Email Archiving & Surveillance

An important and modern advancement of the SEC’s “Books and Records Rule” is the review and storage of email activity by registered investment advisors (RIAs).

Emails (as well as their attachments) fall under the regulatory definition of “written messages” and, therefore, are subject to the archiving requirements defined within the Books and Records Rule. Likewise, CCOs are expected to ensure that the content of these electronic communications remain within regulatory guidelines and consistent with the fiduciary standard to which they are held.

Email Archiving & Surveillance in a Nutshell

So what does your firm need to do with email? The Books and Records Rule for RIA firms states that “written messages” are subject to archiving requirements. Specifically, written messages must be kept (with some exceptions) for a period of five years, the most recent two of which must be stored on-site or immediately accessible from your office. (As is the case with all books and records, cloud-based systems that are accessible from on-site are considered "on-site".) Email messages that fall under the Books and Records Rule are those sent by employees of registered investment advisors that fall into any of these categories:

• Compliance Program
• Client Management
• Trading
• Marketing
• Business Management
• Potentially others, depending on your firm’s specific business practices.

For more detail on the Books and Records Rule, please see our prior blog post here, and also the text of the full rule here.

Email Archiving
Email messages and attachments must be archived in a manner that preserves their original record state. It is the CCO's responsibility to ensure that all email records are maintained and protected from any alternation or destruction. Similar to your other books and records, regulators allow for cloud-based, electronic storage of email messages and attachments. The key is that you can demonstrate your ability to:

• reasonably safeguard them from loss, alteration or destruction,
• prevent unauthorized access from individuals outside your firm, and
• retrieve archived messages in their original recorded state based on keyword searches, employees and/or specific time frames.

Technology controls of archived email should be understood and reviewed periodically to ensure that they are immune to tampering, that is, that they cannot be altered or destroyed, to ensure that archives remain free from the threat of alteration or the accusation of wrongdoing by means of altering archival data. Note: Your “inbox” does not demonstrate the proper archiving standard expected by regulators because anyone who has access to that inbox has the ability to alter or destroy messages or attachments.

Email Surveillance
While the Books and Records Rule requires that you keep copies of your email messages and attachments, there is no specific requirement to monitor or periodically search emails. With that said, your firm’s chief compliance officer (CCO) is expected to follow procedures to detect risks and prevent bad conduct, so it is considered a best practice to conduct some level of proactive surveillance.

CCOs would therefore want to implement some periodic review of the messages that are sent and received, so as to ensure compliance with SEC (or state) regulations, like adherence to your Code of Ethics and advertising constraints, among others. The frequency and depth of review should be based on the structure and complexity of your firm’s business.

Through the Regulator’s Eyes

Regulators will focus on two aspects of your email system: the quality of your archive, and your surveillance process. In their view, these tasks are designed to protect your business and clients from unauthorized access or disclosure of sensitive data, and also to ensure that your firm is actively monitoring its staff and addressing issues internally. Regulators expect you to be able to retrieve any email sent or received that may be used to substantiate your finances, support the decisions made on behalf of your clients, or validate that you are always adhering to your fiduciary duty.

Recently, the SEC Commissioners’ opinion has also clarified that a firm’s obligation to produce electronic records includes employees’ personal email messages, Instant Messages (IMs), text messages and personal computer hard drives when they are used for business purposes.

Thinking through an advisor complaint will help define the expectations that will be placed on your firm during an examination. Regulators are required to respond to every complaint lodged against an RIA, and in that response, they may request any and all emails sent and received between the firm and the client involved. As such, you want to be confident that those records exist and are ready to retrieve. A complete history of all communications through the past five years in a readily accessible archive will allow you to promptly respond to the regulator’s request and reach a resolution. Additionally, the regulators will wonder why it reached this point, and look to your policy and process of email surveillance and the business practices that surround them. Regulators want to ensure that you are reasonably monitoring your employee’s communications that are subject to the Books and Records Rule, to verify you have a satisfactory level of prevention to internally address potential issues before they escalate. In response, you will want to provide reports and supporting documentation of email surveillance performed by the firm.

Most states enforce the Books and Records requirement on registered investment advisors in a manner consistent with the SEC, but you are under the oversight of state regulators, you’ll want to familiarize yourself with their requirements as well.

CCO Best Practices for Email Archiving & Surveillance

• Create another inventory list of all possible avenues of communication, including your company email system(s), CRM to the extent it can send and receive messages, social media websites, standard mail through a post office, text and instant messaging, cloud-based file sharing like DropBox, and others.
• Consider creating an approved technology and device list, so as to limit unauthorized use of communications and limit the scope of your firm’s technology usage for the purposes of monitoring and regulatory examination. For example, requiring that business communications and documents are transmitted only through company-owned computers or devices.
• Don’t be surprised when regulators request to review personal email or messages sent, received or stored on personal devices, such as personal cell phones, so as to ensure that there is no business usage of those devices, and prepare your employees for those requests.
• Don’t approach email surveillance and archiving as a compliance chore. The best practice in the long term is foster strong relationships between compliance and the individuals that are subject to your firm's compliance program. For instance, ensure that compliance is represented in any discussions related to operational or technology changes.
• Periodically conduct email surveillance by searching for keywords (e.g. “complaint”, “performance”, “guarantee”, “superior”, “great performance”, “guaranteed performance”.)
• Integrate your email surveillance and archiving requirements into your firm’s technology architecture to generate a culture of compliance among your technology operations, and keep current with any changes in your technology policies and procedures.
• Perform due diligence on vendors that provide your firm with applicable communication streams, such as cloud-based email archiving service providers, to verify they have appropriate physical, electronic and procedural safeguards. Document the results of this due diligence and include in your annual CCO report.

---

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program. Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Michael D. Conlon

Photo Courtesy of: http://www.flickr.com/photos/epublicist/

Read More

RIA Technology "Integration" Can Mean Many Things

Assembling a "dream team" of technology partners and vendors helps form the foundation for long term profitability and enterprise value.  With so many powerful technology options available to the advisor today, constructing the optimal "portfolio" of tools has never been more critical.

This process includes understanding key points of integration among vendors. "Integration" is not a black and white concept, but rather shades of grey along a spectrum.

• “Lite” integration, for instance, often simply means “single sign on” capabilities. Some integrations rely solely on data feeds between two programs, often with human intervention which has its obvious flaws. 
• "Application Programming Interface" (API) or web service integrations expose data from one application to another (ideally 2-way delivery) on a daily (“asynchronous”) or real-time (“synchronous”) basis. 
• “Full” integration will have all major functions updating in a real-time/2-way sync, with checks and balances and no human intervention.

Proper vendor due diligence includes developing a deeper understanding of exactly how integration occurs between two vendors.  The good news is that the prevailing winds call for more (not less) integration.  In the meantime, be sure to:

1. Develop a "technology roadmap" that identifies your desired points of integration and takes into consideration future plans for your RIA
2. Consider your workflows and processes prior to bringing on new technology
3. Coordinate among technology partners to understand exactly how technologies fit together

What are the key points of integration within your advisory firm?  

Are there areas where you could envision improvement?

Read More

Using Google Sites for Compliance

Google Sites can be a great way to deliver and manage secure content for your advisory firm.


Tough to beat the features you get for the cost (Google Apps for Business is $50 per user per year).


Data Security and Audit Trails
Google has amazing security and redundancy through its SAS70 Type II data centers. Some of the features that attracted us to their tools include:


1. SSL Encrypted, Secure Site with 10.5GB or more of space
2. Full audit trail of all site actions, including postings, document additions/changes
3. Never lose a document - Google will allow you to repost the most current version of a document, but they do not delete the old version.
4. Create a timestamped activities list - You can track client discussions, projects, compliance tasks and more.


Manage your Compliance Policies and Procedures
Harcopies of policies and procedures often have limited utility these days. They are harder to search and find what you need. They become an administrative nightmare in distributing updates. You get the point.


Consider moving your core policies and procedures to the cloud: 


1. Maintain your required business continuity plan ("BCP Plan"). This enables you to maintain a current BCP Plan in one central location that is accessible to all employees. You can easily link to other resources, such as vendor websites, your core systems, etc. Integrate Google Maps and Directions...


2. Maintain written supervisory procedures. Whether you upload a Word document or create an indexed manual online, Google's powerful search will allow you to isolate the key information you need immediately. Have a question on personal securities trading? A typical search would pull up your policy in the manual, your code of ethics and any certifications you might post.


3. Store your core documents. Don't lose the core templates for your business, including client agreements, investment policy statements, and other documents.


4. Create centralized lists of compliance activities:

• Gifts and entertainment log
• Restricted securities lists
• Conflicts of interest matrix
• Checks received logs
• Trade error log
• Compliance program change log
• Books and records matrix
• Client complaints log

5. Share and collaborate internally and with partners. You can provide temporary access or even dedicated portals for your business partners.


For more information on how your RIA firm can benefit from a secure intranet, contact Chris Winn at 617-532-0925 or email at cwinn@advisorassist.com.


AdvisorAssist can implement an RIA Compliance Intranet for your firm.

Read More