Is Your Investment Professional Safeguarding Your Financial Information?
NASHVILLE – As the list of financial institutions targeted by organized cyber attacks continues to grow, the Tennessee Department of Commerce & Insurance’s (TDCI) Securities Division encourages consumers to talk with their investment professionals to determine what measures are being taken to safeguard sensitive information.
“As an investor, you have the right to ask questions and get answers in writing about the protection of your personal and financial information,” says TDCI Assistant Commissioner for Securities Frank Borger-Gilligan. “Take steps to ensure that your investment professional’s systems are updated with the latest anti-virus and anti-malware software, and that they have policies in place regarding information safety protocol.”
In September 2014, the North American Securities Administrators Association (NASAA) released results of a pilot survey designed to better understand the cybersecurity practices of state-registered investment advisers. These advisers account for more than half of the registered investment advisers conducting business in the United States.
The survey, conducted in early summer 2014 in nine states, found that 62 percent of firms have undergone a cybersecurity risk assessment, and 77 percent have established policies and procedures related to technology or cybersecurity. The pilot survey also found that very few state-registered investment advisers reported experiencing a cybersecurity issue.
While the relatively low rate of cybersecurity incidents identified in the pilot survey is encouraging, investors should think about the safety of their financial information, and talk with their investment professionals about what steps firms are taking to safeguard client information.
The TDCI Securities Division encourages investors to ask their investment professional the following questions compiled by NASAA:
• Cyber preparedness:
Has the firm addressed which cybersecurity threats and vulnerabilities may impact its business?
• Cybersecurity compliance program:
Does the firm have written policies, procedures, or training programs in place regarding safeguarding client information?
• Cyber insurance:
Does the firm maintain insurance coverage for cybersecurity?
• Cyber expertise:
Has the firm engaged an outside consultant to provide cybersecurity services for your firm?
• Cyber confidentiality:
Does the firm have confidentiality agreements with any third-party service providers with access to the firm’s information technology systems?
• Cyber incident:
Has the firm ever experienced a cybersecurity incident where, directly or indirectly, theft, loss, unauthorized exposure, use of, or access to customer information occurred? If so, has the firm taken steps to close any gaps in its cybersecurity infrastructure?
• Cybersecurity safeguards:
Does the firm use safeguards such as encryption, antivirus and anti-malware programs? Does the firm contact clients via email or other electronic messaging, and if so, does the firm use secure email and/or any procedures to authenticate client instructions received via email or electronic messaging, to work against the possibility of a client being impersonated?
For more investor education resources or to schedule an investor education outreach event for your group/club, visit the TDCI Securities Division at https://www.tn.gov/commerce/section/securities or call 615-741-2947.
###