This is a community paste of different cybersecurity and IT related questions we have seen the SEC, FINRA, and SSBs send firms before showing up for an onsite interview or examination We have found the best way to prepare for a SEC cybersecurity audit is to study and prepare for the requests that will be coming your way. We hope this document helps Good Luck.
For each of the following practices employed by the Firm for management of information security assets, please provide the month and year in which the noted action was last taken; the frequency with which such practices are conducted; the group with responsibility for conducting the practice; and, if not conducted firm wide, the areas that are included within the practice. Please also provide a copy of any relevant policies and procedures.
• Physical devices and systems within the Firm are inventoried and assessed for risks.
• Software platforms and applications within the Firm are inventoried and audited.
• Maps of network resources, connections, and data flows (including locations where customer data is housed) are created or updated.
• Connections to the Firm’s network from external sources are catalogued and assessed.
• Resources (hardware, data, 2 factor-authentication, and software) are prioritized for protection based on their sensitivity and business value.
• Logging capabilities and practices are assessed for adequacy, appropriate retention, and secure maintenance.
Please provide a copy of the Firm’s written information security policy and employee usage agreements.
Please indicate whether the Firm conducts periodic risk assessments to identify cybersecurity threats, vulnerabilities, physical vulnerabilities and potential business consequences.
If such assessments are conducted:
a. Who (business group/title) conducts them, and in what month and year was the most recent assessment completed?
b. Please describe any findings from the most recent risk assessment that were deemed to be potentially moderate or high risk and have not yet been fully remediated.
Does the Registrant use any cloud-based storage (e.g., Dropbox, SkyDrive, Google Docs,etc.) for data backup or any other purpose?
If so, please list the vendors used and alldue diligence research associated with each vendor.
Is the Registrant using a personal or business version of the cloud storage?
Please provide a copy of the terms of service agreement from each cloud storage vendor that the Registrant is using.
Does the Registrant have any written policies and procedures to govern the use of/access of firm data? If so, please provide copies of the policies and procedures.
Has the Registrant ever had any data breaches or any other cybersecurity issues (e.g.,hacking incidents, ransomware, etc.)? If yes, please provide a timeline and describe the nature of the incident. If no, please describe how the firm monitors for breaches.
If cybersecurity roles and responsibilities for the Firm’s workforce and managers have been explicitly assigned and communicated, please provide written documentation of these roles and responsibilities. If no written documentation exists, please provide a brief description.
Please provide a copy of the Firm’s written business continuity of operations plan that addresses mitigation of the effects of a cybersecurity incident and/or recovery from such an incident if one exists.
Does the Firm have a Chief Information Security Officer or equivalent position? If so,please identify the person and title. If not, where does principal responsibility for overseeing cybersecurity reside within the Firm?
Does the Firm maintain insurance that specifically covers losses and expenses attributable to cybersecurity incidents? If so, please briefly describe the nature of the coverage and indicate whether the Firm has filed any claims, as well as the nature of the resolution of those claims.
Does the Registrant allow employees (or any person) to access any personal web-based e-mail accounts (e.g., Google, Yahoo Mail, Hotmail, etc.) from the firm’s networks? If no,what steps has the Registrant taken to block network access to personal e-mail?
Does the Registrant allow employees (or any person) to use their personal e-mail for business purposes? If yes, what types of information are transmitted via web-based e-mail? Is web-based e-mail used for client communications?
Does the Registrant use a web-based e-mail provider’s or its own server for e- mail? If the Registrant is using a web-based e-mail account does it have a business account with the provider? Do any other entities share the same email server?
Please provide a copy of the terms of service agreement from each web-based e-mail provider that the Registrant is using.
Does the Registrant maintain records of web-based e-mail communications? If so, how are the records maintained? Does compliance review web-based e-mail communications?
Does the Registrant have any written policies and procedures to govern the access to/use of/maintenance of/review of web-based e-mail? If yes, please provide copies of the policies and procedures.
Please identify any published cybersecurity risk management process standards,such as those issued by the National Institute of Standards and Technology (NIST) or the International Organization for Standardization (ISO), the Firm has used to model its information security architecture and processes.
Please indicate which of the following practices and controls regarding the protection of its networks and information are utilized by the Firm, and provide any relevant policies and procedures for each item:
1.The Firm provides written guidance and periodic training to employees concerning information security risks and responsibilities. If the Firm provides such guidance and/or training, please provide a copy of any related written materials (e.g.,presentations) and identify the dates, topics, and which groups of employees participated in each training event conducted since January 1, 2013.
2.The Firm maintains controls to prevent unauthorized escalation of user privileges and lateral movement among network resources. If so, please describe the controls, unless fully described within policies and procedures.
3.The Firm restricts users to those network resources necessary for their business functions. If so, please describe those controls, unless fully described within policies and procedures.
4.The Firm maintains an environment for testing and development of software and applications that is separate from its business environment.
5. The Firm maintains a baseline configuration of hardware and software,and users are prevented from altering that environment without authorization and an assessment of security implications.
6.The Firm has a process to manage IT assets through removal, transfers, and disposition.
7.The Firm has a process for ensuring regular system maintenance, including timely installation of software patches that address security vulnerabilities.
8.The Firm’s information security policy and training address removable and mobile media.
9. The Firm maintains controls to secure removable and portable media against malware and data leakage. If so, please briefly describe these controls.
10.The Firm maintains protection against Distributed Denial of Service (DDoS) attacks for critical internet-facing IP addresses. If so,please describe the internet functions protected and who provides this protection.
11.The Firm maintains a written data destruction policy.
12.The Firm maintains a written cybersecurity incident response policy. If so, please provide a copy of the policy and indicate the year in which it was most recently updated.Please also indicate whether the Firm conducts tests or exercises to assess its incident response policy, and if so, when and by whom the last such test or assessment was conducted.
13.The Firm periodically tests the functionality of its backup system. If so, please provide the month and year in which the backup system was most recently tested.
Please indicate whether the Firm makes use of encryption. If so, what categories of data,communications, and devices are encrypted and under what circumstances?
Please indicate whether the Firm conducts periodic audits of compliance with its information security policies. If so, in what month and year was the most recent such audit completed, and by whom was it conducted?
Please indicate whether the Firm provides customers with on-line account access. If so,please provide the following information:
a. The name of any third party or parties that manage the service.
b. The functionality for customers on the platform (e.g., balance inquiries, address and contact information changes, beneficiary changes, transfers among the customer’s accounts, withdrawals or other external transfers of funds).
c.How customers are authenticated for on-line account access and transactions.
d. Any software or other practice employed for detecting anomalous transaction requests that may be the result of compromised customer account access.
e. A description of any security measures used to protect customer PINs stored on the sites.
f. Any information given to customers about reducing cybersecurity risks in conducting transactions/business with the Firm.Please provide a copy of the Firm’s procedures for verifying the authenticity of email requests seeking to transfer customer funds. If no written procedures exist, please describe the process.
Please provide a copy of any Firm policies for addressing responsibility for losses associated with attacks or intrusions impacting customers.
Does the Firm offer its customers a security guarantee to protect them against hacking of their accounts? If so,please provide a copy of the guarantee if one exists and a brief description.
If the Firm conducts or requires cybersecurity risk assessments of vendors and business partners with access to the Firm’s networks, customer data, or other sensitive information, or due to the cybersecurity risk of the outsourced function, please describe who conducts this assessment, when it is required, and how it is conducted. If a questionnaire is used, please provide a copy. If assessments by independent entities are required, please describe any standards established for such assessments.
If the Firm regularly incorporates requirements relating to cybersecurity risk into its contracts with vendors and business partners, please describe these requirements and the circumstances in which they are incorporated. Please provide a sample copy.
If the Firm assesses the segregation of sensitive network resources from resourcesaccessible to third parties, who (business group/title) performs this assessment, and provide a copy of any relevant policies and procedures?
If vendors, business partners, or other third parties may conduct remote maintenance of the Firm’s networks and devices, describe any approval process, logging process, or controls to prevent unauthorized access, and provide a copy of any relevant policies and procedures.
For each of the following practices employed by the Firm to assist in detecting unauthorized activity on its networks and devices, please briefly explain how and by whom(title, department and job function) the practice is carried out.
• Identifying and assigning specific responsibilities, by job function, for detecting and reporting suspected unauthorized activity.
• Maintaining baseline information about expected events on the Firm’s network.
• Aggregating and correlating event data from multiple sources.
• Establishing written incident alert thresholds.
• Monitoring the Firm’s network environment to detect potential cybersecurity events.
• Monitoring the Firm’s physical environment to detect potential cybersecurity events.
• Using software to detect malicious code on Firm networks and mobile devices.
• Monitoring the activity of third party service providers with access to the Firm’s networks.
• Monitoring for the presence of unauthorized users, devices, connections, and software.
• Evaluating remotely-initiated requests for transfers of customer assets to identify anomalous and potentially fraudulent requests.
• Conducting penetration tests and vulnerability scans. If so, please identify the month and year of the most recent penetration test and recent vulnerability scan, whether they were conducted by Firm employees or third parties, and describe any findings from the most recent risk test and/or assessment that were deemed to be potentially moderate or high risk but have not yet beenaddressed.
• Testing the reliability of event detection processes. If so, please identify the month and year of the most recent test.
• Using the analysis of events to improve the Firm’s defensive measures and policies.
Since January 1, 2016, has your Firm experienced any of the following types of events? If so, please provide a brief summary for each category listed below, identifying the number of such incidents (approximations are acceptable when precise numbers are not readily available) and describing their significance and any effects on the Firm, its customers,and its vendors or affiliates. If the response to any one item includes more than 10 incidents, the respondent may note the number of incidents and describe incidents that resulted in losses of more than $5,000, the unauthorized access to customer information,or the unavailability of a Firm service for more than 10 minutes.
The record or description should, at a minimum, include:
• The extent to which losses were incurred,customer information accessed, and Firm services impacted; the date of the incident; the date the incident was discovered and the remediation for such incident.
• Malware was detected on one or more Firm devices. Please identify or describe the malware.
• Access to a Firm web site or network resource was blocked or impaired by a denial of service attack. Please identify the service affected, and the nature and length of the impairment.
• The availability of a critical Firm web or network resource was impaired by a software or hardware malfunction. Please identify the service affected, the nature and length ofthe impairment, and the cause.
• The Firm’s network was breached by an unauthorized user. Please describe the nature,duration, and consequences of the breach, how the Firm learned of it, and how it was remediated.
• The compromise of a customer’s or vendor’s computer used to remotely access the Firm’s network resulted in fraudulent activity, such as efforts to fraudulently transfer funds from a customer account or the submission of fraudulent payment requests purportedly on behalf of a vendor.
• The Firm received fraudulent emails, purportedly from customers, seeking to direct transfers of customer funds or securities.
• The Firm was the subject of an extortion attempt by an individual or group threatening to impair access to or damage the Firm’s data, devices, network, or web services.
• An employee or other authorized user of the Firm’s network engaged in misconduct resulting in the misappropriation of funds, securities, sensitive customer or Firm information, or damage to the Firm’s network or data.
Since January 1, 2016, if not otherwise reported above, did the Firm, either directly or as a result of an incident involving a vendor, experience the theft, loss, unauthorized exposure, or unauthorized use of or access to customer information? Please respond affirmatively even if such an incident resulted from an accident or negligence, rather than deliberate wrongdoing. If so, please provide a brief summary of each incident or a record describing each incident.
Please indicate whether it was reported to the following:
• Law enforcement (please identify the entity)
• FinCEN (through the filing of a Suspicious Activity Report)
• FINRA
• A state or federal regulatory agency (please identity the agency and explain the manner of reporting)
• An industry or public-private organization facilitating the exchange of in formationabout cybersecurity incidents and risks
• What aspects of the continuity plan have been implemented?
• Whether the firm has identified any preliminary weaknesses or unforeseen issues since implementing its BCP?
• Whether the firm has encountered, thus far, any limitations in its ability to operate critical systems or conduct critical operations in connection with its personnel working remotely?
• Whether working remotely has affected the firm’s oversight of any of its third-party vendors or service providers?
• What does the Firm presently consider to be its three most serious cybersecurity risks,and why?
Please feel free to provide any other information you believe would be helpful to the Securities and Exchange Commission in evaluating the cybersecurity posture of the Firm or the securities industry.
How does the Firm identify relevant best practices regarding cybersecurity for its business model?
Please provide a copy of policies and procedures and any training materials related to information security procedures and responsibilities for trainings conducted since January 2017 for vendors and business partners authorized to access its network.Did the Firm update its written supervisory procedures to reflect the Identity Theft Red Flags Rules, which became effective in 2013 (17 CFR § 248—Subpart C—Regulation S-ID)?
Does the firm have:
(a) a written Business Continuity Plan;
(b) a Pandemic Continuity of Operations Plan; and/or
(c) equivalent informal plans or guidance (collectively, “BCP”)?
If so:
1.Briefly describe some of the aspects of the BCP that are particularly applicable to maintaining continuity of business operations when dealing with the COVID-19 pandemic(e.g., personnel working remotely).
2.Are there any business operations that cannot be performed remotely? If the firm has a BCP, has the firm activated/implemented its BCP in response to COVID-19? If so, please describe:
Is the firm prepared to have all of its personnel operate remotely for several weeks (e.g.,3+) or months, if required or appropriate? Are any personnel unable to operate remotely or unable to do so for several weeks or months?
Does the firm have a contingency plan if its essential personnel are unable to work, or only able to work on a part-time basis, for several weeks or months? For example, personnel may be incapacitated or are only able to work part-time if they are caring for children.
Has the COVID-19 pandemic created hardships for the firm (e.g., financial, human resources,or otherwise)?
Has the firm considered assessing the impact of COVID-19 on its business and operations? Ifso, is it underway, or when does the firm believe it will undergo this assessment?