Securities Regulation Daily Wrap Up, RISK MANAGEMENT—GAO says SEC better at own cyber defense but can do more, (Apr 29, 2016)
The GAO said the SEC had improved its information security but that the financial regulator can do more to protect its information technology assets from cybersecurity risks. The GAO made six published recommendations, although the GAO also made 30 recommendations on newly identified weaknesses in a separate report with limited distribution. The latest GAO report is a follow-up to an earlier review of the SEC’s financials.
The six specific recommendations cover a range of topics, including IT policies, systems inventories, and continuous monitoring. For example, the GAO noted problems with the SEC’s segregation of duties that could put its IT resources at risk. Segregation typically involves having multiple groups involved in the handling of critical processes so that no one individual or group can control the entire process and upset built-in checks and balances. The GAO said SEC staff had acknowledged risks in this area, but the agency had not documented management’s acceptance of those risks.
The SEC’s CIO replied that the agency concurred in all six of the GAO’s recommendations and that it had already addressed some of the GAO’s separately provided recommendations. With respect to EDGAR issues, the SEC said that some of the GAO’s prior worries were addressed by the retirement of agency IT resources while, in the context of separation of duties, the SEC explained that it relies on specialists who sometimes play multiple roles in order to maintain EDGAR.
RegulatoryActivity: RiskManagement