On February 3, 2015, the U.S. Securities and Exchange Commission (“SEC”) staff released two publications: the results of an examination sweep of 57 registered broker-dealers and 49 registered investment advisers, and guidance for investors on how to best protect their online brokerage accounts from fraud. These two publications represent the latest in a string of attempts by the SEC to encourage the companies it regulates to prepare for, defend against, and respond to cyber-attacks. The SEC’s focus on cybersecurity likewise occurs within the context of calls for greater regulatory action in both the securities and financial institutions field and across the U.S. economy as a whole.

I. Background: The SEC’s Authority to Regulate Cybersecurity -

The SEC’s authority with respect to cybersecurity and data privacy stems from two sources.