The SEC has expanded considerably its efforts relating to cyber-security, beefing up its regulatory examinations with targeted sweeps for cyber-security, as well as maintaining an active cyber-security enforcement program.
The SEC began its cyber-security initiative in April 2014, announcing its first cyber-security sweep of brokerage and investment advisory examinations in an SEC Risk Alert, which also published its so-called examination module (i.e., questionnaire) for use on targets of the sweep. About a year after sweep, the SEC then published a report containing some strong sentiments about cyber-security and then, on September 15, 2015, announced its second cyber-security sweep, doubling down on its efforts, and once again providing an extensive examination module as a resource for regulated entities.
