SEC Warns Firms to Improve Data Security at Branch Offices

The SEC Division of Examinations ("EXAMS") reminded regulated firms to apply the same standards of care to safeguard customer records at branch offices as with main offices.

In a Risk Alert, EXAMS highlighted the Safeguards Rule ("Regulation S-P") that requires firms to adopt written policies and procedures that address the "administrative, technical and physical safeguards for the protection of customer records and information." EXAMS stated that branch offices of firms often have access through technology to the same customer records as main branches, yet they have not adopted or implemented the same written policies and procedures to safeguard this information leading to instances of cybersecurity and data breaches.

EXAMS staff outlined common risk issues with branch office governance of customer data, including:

• Vendor Management - failure by many branch offices to adequately supervise vendors providing cybersecurity, technology or operational support, resulting in "weak" security settings on systems and applications;

• Email Configuration - lack of policies and procedures addressing branch office email configurations that are not controlled by the main office and that may be supplied from vendors without the technical requirements adequate to secure the branch offices’ email program, resulting in some account takeovers and compromised emails;

• Data Classification - lack of written procedures causing failure to classify confidential customer data as such, resulting in customer records and information being compromised;

• Access Management - lack of "policies and procedures requiring password complexity and multi-factor authentication for remote access to firm systems," resulting in data breaches; and

• Technology Risk - lack of implementation of "written policies and procedures for inventory management, patch management, and vulnerability management" resulting in branch offices not being up to date with system patches and upgrades.