RIA Cybersecurity

• Develop cybersecurity policies: RIAs must create and document policies and procedures to manage cybersecurity risks.
• Educate employees: RIAs should educate their employees about cybersecurity.
• Develop incident response plans: RIAs must create and document plans for responding to cyber incidents.
• Disclose cybersecurity incidents: RIAs must disclose cybersecurity incidents and risks to clients, investors, and other market participants. The SEC requires that RIAs report cybersecurity incidents within four business days.
• Notify customers of unauthorized access: RIAs must notify customers of unauthorized access to their sensitive customer information as soon as possible, but no later than 30 days.

Non-compliance with the SEC’s cybersecurity rules can result in penalties such as regulatory fines, reputational damage, loss of client trust, and legal action.