The FISMA Focus IPD

In the wake of the promulgation of new cybersecurity regulations by New York State’s Department of Financial Services, Colorado has proposed cybersecurity regulations for broker-dealers, investment advisers and other fund managers in the ever-changing privacy landscape. Financial services firms subject to the rule-making and regulatory authority of the Financial Industry Regulatory Authority (FINRA)  and the United States Securities and Exchange Commission (SEC), however, will find that much of what states require is generally reflected in existing rules and the regulatory interpretations of them.

The SEC earlier this year specifically noted that cybersecurity would be one of its examination priorities of broker-dealers, funds and investment advisers. Further, the SEC recently issued an alert on the proliferation of ransomware and repeated the need for those subject to SEC oversight to have adequate cybersecurity procedures, tests and reviews in place. While the New York and Colorado regulations may appear to be new in substance, a significant portion of the issues these regulations address are discussed in detail by the SEC in prior guidance cited in its May 17, 2017, alert. Namely, the need for documented “audit trails” and the substance and nature of systems testing appear in other SEC alerts and in the New York and Colorado regulations. Certainly, attention should be paid to those distinctions to ensure compliance with independent state obligations.