Not Cyber-Security Month, But Still…
June is not cybersecurity month (there is one, it’s October), but there has been some recent discussion about cybersecurity, Reg S-P, and related matters. In part, this is the result of upcoming implementation deadlines, as well as recent reminders by the SEC during the spring conference season. On the more ‘retail’ end, the Wall Street Journal recently included a quiz for readers asking “How Much Do You Know About Cyber Scams?”
The statistics are sobering. Cyber scams have risen 33% over the last year with the most victimized group (60 and over) also being the wealthiest group. This statistic should not be surprising, but what was startling was that “investment fraud” was the most common scam against the elderly costing, on average, $83,000 per occurrence (customer service scams steal approximately $1.5B in aggregate). If these are your clients, or your client’s clients, it would be both prudent and caring to take a look not only at your policies and procedures, and how they’re implemented, but also how they affect the investors whose interests our industry serves.
Before we round another quarter, take a few minutes to brush up on changes to Reg S-P and related guidance:
- Develop an incidence response program – know what you’ll do if something goes wrong with you, a vendor, or a client;
- Vendor oversight – their weakness is your weakness, so make sure they are doing their part to protect you both;
- Communicate with clients – not only if something goes wrong, but help them understand how they can protect themselves (and you) with clear email and text communication policies, two-factor authentication, awareness of phishing scams, etc.;
- Keep detailed records – to instill confidence not only in regulators, but also clients; and
- Implementation deadlines – don’t see the implementation dates as a time to get started, but prepare well ahead of time as a matter of best practices.
Being attentive to cybersecurity concerns should be a part of excellent client service, not just meeting the minimum to avoid regulatory scrutiny.