Cybersecurity enforcement actions: is the SEC bringing strict liability cases?. Issue 1 (3rd May 2016)

• Record Type: Journal Article
• Authors: Rubin, Brian; Xu, Amy
• Is Part Of: Journal of investment compliance. Volume 17:Issue 1(2016)
• Page Start: 112
• Page End: 116
• Publication Date: 2016-05-03
• Subjects: Cybersecurity -- Securities and Exchange Commission (SEC) -- Financial industry regulatory authority (FINRA) -- Enforcement actions -- Broker-dealers -- Registered investment advisers; Institutional investments -- Law and legislation -- Periodicals; Securities -- Periodicals; 332.6
• DOI: 10.1108/JOIC-02-2016-0004
• Languages: English
• ISSNs: 1528-5812

Abstract

Abstract : Purpose: To analyze how the US Securities and Exchange Commission (SEC) has sanctioned broker-dealers (BDs) and registered investment advisers (RIAs) when cybersecurity breaches have occurred and to discuss whether the SEC is imposing a strict liability approach. Design/methodology/approach: Describes the cyber-attack of a small RIA, the remedial steps the RIA took after the attack, the SEC's enforcement action, why this particular case is noteworthy, and the case's implications for RIAs and BDs. Findings: RIAs and perhaps BDs may face strict liability from the SEC if they are victims of cybersecurity attacks. Practical implications: Firms may want to address the likelihood of an SEC enforcement action if a breach occurs by reviewing recent enforcement actions, SEC reports and statements, and FINRA reports and statements. Originality/value: Discusses the possible future of SEC enforcement actions regarding cybersecurity breaches.