On September 15, 2015, the SEC’s Office of Compliance Inspections and Examinations (OCIE) issued a Risk Alert providing additional guidance on key focus areas for round two of its cybersecurity examinations. Specifically OCIE stated exams will “involve more testing to assess implementation of firm procedures and controls.” The Commission intends to focus on the following areas as a means to collect information on cybersecurity-related controls and assess the controls in place at firms:
Governance and Risk Assessment: According to the Alert, OCIE may evaluate the governance and risk assessment process for areas including, but not limited to, access control, employee training, third-party/vendor management and IT systems management. Examiners also expect to see that assessments and associated policies are specific to a firm’s business.
Access Rights and Controls: OCIE warns that the lack of basic access controls and user management policies can result in unauthorized access to systems and information. Examiners may request details on how a firm manages user rights and what supporting technologies are in place.
The following article is part of our Hedge Fund Insiders Article Series and was contributed by TriNet. Read more articles from the Series HERE.
Beginning January 1, 2016 every U.S. firm with 51-100 employees will be migrated to the “small group market” for healthcare benefits, as part of Affordable Care Act (ACA) mandated changes. Currently, in many states the small group market encompasses firms with 50 or fewer employees. But for policies that renew in 2016, this market will be expanded to include companies with up to 100 full-time employees.
Companies with 51-100 employees, who previously enjoyed the “economies of scale” benefits associated with being in the large group health care market, will become part of the small group market as of their first renewal on or after January 1, 2016. While this change will happen across the U.S., we believe its impact will be very significant in New York State.
What mid-size businesses can expect from ACA changes:
Healthcare premiums, on average, will increase – potentially significantly – and the access to a wide-array of rich benefit plans these companies previously enjoyed is likely to be reduced. This is because New York State’s small group healthcare market is “community-rated,” which means the demographics (for example, average age of employees) at a firm have no impact on small group market healthcare pricing. New York State currently prohibits insurance rate variations based on the demographic characteristics of the firm. This is in stark contrast to the rest of the country, where firms are priced based on their employee “census”- thus taking into account their demographic characteristics. We believe this will result, on average, in significantly higher healthcare premiums – especially if the firm has a relatively young average age composition, as so many New York financial firms do.
“Small group” market plans will be “canned,” meaning you will now have to select your benefits from a group of plans that the carrier offers – and plans cannot be modified. This will likely cause firms with 51-100 employees to lose some of the previous benefits they were able to offer employees. As a result, this change is likely to affect deductibles, out-of-network coverage, advanced infertility treatments and lower limits on certain services.
Companies that have 51-100 employees and a relatively young demographic composition will likely be hit with significant healthcare premium increases, as the small group community rates will be much higher than what they currently pay. By my calculations, some groups could see premiums increase as high as 50 percent for plans similar to what they offer today.
The following article is part of our Hedge Fund Insiders Article Series and was contributed by Haynes and Boone, LLP. Read more articles from the Series HERE.
Cybersecurity risks pose an increasingly significant threat to investment advisers. In early 2015, the Securities and Exchange Commission’s (the “SEC”) Office of Compliance Inspections and Examinations (“OCIE”) identified its annual adviser examination priorities which reflect certain practices perceived to present heightened risk to investors and/or the integrity of US capital markets, one of which was cybersecurity compliance and controls. In April 2015, the SEC’s division of investment management (the “Division”) issued guidance (the “Guidance”)  reinforcing cybersecurity as a priority for advisers and suggesting that advisers implement cybersecurity risk assessment plans, response strategies, and written policies and procedures. Included below are measures advisers should consider (some of which are directly from the Guidance) when addressing cybersecurity risks relating to their operations:
Risk Assessment. Advisers should conduct assessments of: (1) the nature, sensitivity and location of information that it collects, processes and/or stores and the technology systems it uses; (2) internal and external cybersecurity threats to and vulnerabilities of the adviser’s information and technology systems; (3) security controls and processes currently in place; (4) the impact should its information or technology systems become compromised; and (5) the effectiveness of the governance structure for the management of cybersecurity risk.
We take our thought leadership efforts seriously around here, and we’re always interested in educating our clients and partners about technology issues that can affect them. We’re also fortunate to be invited to speak frequently on a variety of hedge fund technology topics – most recently, cybersecurity. Our own Managing Director, Vinod Paul, participated in a panel session last month in New York dedicated to this topic.
Featuring speakers from Eze Castle Integration, Citrin Cooperman, Akin Gump, and CFO Consulting Partners, the panel spoke candidly about how the cybersecurity landscape is evolving for financial services firms and how they can begin to comply with recent recommendations from the SEC and FINRA. Following are some highlights from the event. If you’d like to listen to the podcast of the panel, click here.
Many firms question whether they need to do anything to comply with SEC cybersecurity recommendations. The answer is yes. And it’s more than technology firms need to employ.
Cybersecurity governance is a critical component. Who is in charge beyond the IT team? Someone at the firm needs to take accountability for this process and interface with various functions to ensure compliance. Ideally, a Chief Compliance Officer or Chief Information Security Officer should handle.
Last week, we partnered up with law firm Sadis & Goldberg to host a webinar where we discussed the Securities and Exchange Commission’s (SEC) Division of Investment Management’s latest cybersecurity guidance recommendations and offered firms clear direction on satisfying these new requirements from both a legal and technology perspective. Featured speakers included John Araneo, counsel, and Lance Friedler, partner at Sadis & Goldberg, as well as Eze Castle Integration’s Managing Director Vinod Paul. To watch a full recap of the webinar, click here or scroll down.
Cyber Threats Across the Industry
The cyber threat landscape is changing rapidly, and our speakers shared examples of how developed hackers are targeting all industries, not only financial services. Araneo gave two examples of data breaches from two companies that were recently penalized by the SEC for failure to meet requirements. The first example was from a firm that failed to use strong passwords and allowed access to systems after long periods of computer inactivity, resulting in a penalty and mandatory independent security consulting for two years. The second firm failed to enforce the use of anti-virus software, leading to an unauthorized trade from a customer’s account and resulting in fines totaling over $100,000.
Beyond mismanagement of internal cyber controls, phishing and ransomware are other targeted approaches our speakers noted they are seeing across the industry, as hackers are targeting executives by sending fake emails to try to phish sensitive information or attaching files that could infect entire systems. In the case of ransomware, if a user opens an email that is infected, it will lock down files and the only way to recover the files is to buy a key from the hacker. As the sophistication of cyber hackers increases, firms are expected to shore up securities and employ best practices to protect sensitive company information – a goal the SEC is targeting with their most recent cybersecurity guidance recommendations.
In the context of information technology, social engineering refers to the act of tricking people into divulging confidential or sensitive business information, and breaking security policies. This form of attack infiltrates companies by targeting their weakest access point, which predominantly is a firm’s employees.
The Art of the Phishing Con
Let’s examine a popular technique for social engineering known as phishing. In a phishing scheme, the hacker broadly disseminates a fraudulent email with aim to acquire sensitive data, such as, login credentials, IT resources or banking information. The message may request the recipient to submit personal information or to click on a link embedded with malware. Although this approach rarely dupes sophisticated users, a distracted employee could make one mistake and compromise a firm’s entire network.
Did you know that the average cost of a data breach is $3.8 million? Or, that the consolidated average cost incurred for each record of lost or stolen sensitive and confidential information has increased six percent (6%) since 2013 from $145 to $154? A recent study of 350 companies spanning 11 countries reported the aforementioned statistics, representing a twenty-three percent (23%) increase in data breach consolidated costs.
Welcome to the third installment of our SEC Cybersecurity Guidance Update video series. Our third (and last) video covers what the SEC is telling registered investment advisers about having written information policies and procedures. You can watch the first two videos below or HERE and HERE.
In Part 1 of the SEC's recent cybersecurity guidance update, the regulatory body highlighted the need for cyber risk assessments across multiple areas of a registered firm's organization. Continuing to address how firms should prepare for security incidents before they occur, Part 2 of the SEC's guidance update focuses on how hedge funds and registered investment advisers should prevent, detect and respond to security incidents.
Take a look at the latest installment of our video series or scroll down to read a brief recap.
Categorized under: Security Launching A Hedge Fund Cloud Computing Disaster Recovery Hedge Fund Due Diligence Hedge Fund Operations Hedge Fund Regulation Infrastructure Communications Outsourcing Business Continuity Planning Trends We're Seeing Videos And Infographics
We are excited to release the first in Eze Castle Integration's three part SEC Cybersecurity Guidance Update video series.
In case you missed it, in April 2015 the SEC issued a Guidance Update on Cybersecurity Risks and Expectations for registered investment companies and registered investment advisers. The three point guidance update addresses the need for Cybersecurity Assessments, Strategy and Written Policies plus Procedures.
So to get you up to speed quickly, we’ve created this video series. In this first (90 second) video we cover SEC cybersecurity guidance around conducting periodic risk assessments. Be sure to come back next week for our next two videos.