The SEC’s cyber security rules are coming in April 2023

Policies and procedures

1. Adopt and implement cyber security policies and procedures
2. Tailor policies and procedures to fit the nature and scope of the business.
3. Indicate parties responsible for administration, implementation, and communication.
4. Reviewed at least annually

Risk assessment

1. Categorize and prioritize risk.
2. Identify Service providers that receive, maintain or process adviser or fund information (Vendor Management).
3. Risk assessment should include written documentation.
4. Risk assessment should be conducted periodically.

User security and access

1. Require standards of behavior (Acceptable Use Policy, or AUP).
2. Identify and authenticate individual users.
3. Create procedures for distribution, revocation and replacement of passwords or authentication methods.
4. Restrict access to adviser or fund information or those who require access to perform their job function.
5. Secure remote access technologies

Information protection

1. Assess the sensitivity and importance of adviser or fund information.
2. Identify any adviser or fund information that is personal.
3. Assess where and how adviser or fund information is access, stored and transmitted AND monitoring this information in transmission.
4. Assess adviser or fund information systems access control and malware protection. Assess the potential effect of a cyber security incident involving an adviser or fund information on the adviser or fund and its clients or shareholders including the ability to continue to provide service.

Threat and vulnerability management

1. Detect, mitigate, and remediate threats and vulnerabilities through ongoing monitoring including internal and externally facing systems.
2. Once identified threats and vulnerabilities should minimize the window of opportunity to exploit vulnerable hardware and software.
3. Adopt policies that establish accountability including intake, assignment, escalation, remediation, and testing.

Cyber security incident response and recovery

1. Implement measures to detect respond to and recover from a cyber security incident including the continued operation of the fund or adviser, the protection of systems and information therein, the sharing of communications both internal and external as well as reporting to the Commission.
2. Prepare written documentation of ANY cyber security incident including response and recovery from an incident.

Annual review and required written reports

1. Review and assess the cyber security policies and procedures including any changes over the review period.
2. Prepare a written report that contains: the annual review, the assessment, control tests performed, and documentation of any cyber security incidents that occurred since the last report as well as any material changes in policies and procedures since the last report.

Fund board oversight

1. The fund’s board must approve the funds cyber security policies and procedures and review the written report in cyber security incidents and material changes to the cyber security policies.
2. Board oversight should not be a passive activity.

Recordkeeping

1. Advisers must maintain a copy of their cyber security policies and procedures that are in effect or have been in effect for the last 5 years.
2. a copy of the written report/annual review for the last 5 years.
3. a copy of any completed ADV-C completed for the last 5 years.
4. Records of documenting cyber security incidents including response and recovery for the last 5 years.
5. Records documenting a risk assessment for the last 5 years.

Incident reporting (Form ADV-C)

1. Disclose and Report a cyber security incident via the IARD system and completion of form ADV-C within 48 hours.
2. Amend and update the form as new information is uncovered and as necessary.
3. A new form housed within the IARD system for the reporting of a cyber security incident. See sample attached.

Adviser disclosure of a cyber security incident

1. Disclose cyber security risks in plain English.
2. “Cyber security Risks and Incidents” will be added to Form ADV’s narrative brochure, or Part 2A.
3. Disclose ALL cyber security risks that could materially impact advisory services as well as how they address, prioritize, and address risk
4. Deliver an interim disclose to existing clients.
5. List cyber security incidents within the last 2 fiscal years that led to harm the adviser or clients.

Fund disclosure of a cyber security incident

1. Disclose cyber security risks in plain English to prospective and current investors.
2. The fund would be required to disclose any significant fund cyber security incident that has occurred during its last two fiscal years.