Advisers Act Compliance and Cybersecurity: Rule 206(4)-7 and the Technology Program

What Rule 206(4)-7 says

17 CFR 275.206(4)-7 — the compliance rule — makes it unlawful for an SEC-registered investment adviser to provide advice unless it has done three things:

1. Adopted and implemented written policies and procedures reasonably designed to prevent violation of the Advisers Act and the rules under it.
2. Reviewed the adequacy of those policies and procedures, and the effectiveness of their implementation, at least annually.
3. Designated a chief compliance officer responsible for administering them.

Each of those three words carries weight in an examination. Implemented distinguishes a program from a binder. Effectiveness of their implementation is why a review that only re-reads the policy does not satisfy the rule. And designated means a specific person, not a committee that meets when something goes wrong.

Why cybersecurity is inside this rule

Rule 206(4)-7 never uses the word cybersecurity. It gets there by consequence. Consider what a technology failure can cause:

• Loss of required records is a books-and-records violation. See books and records.
• Exposure of client information is a Regulation S-P matter, and for an adviser it lands back here as well. See Regulation S-P.
• An extended outage can prevent the adviser from meeting obligations to clients.
• A compromised email account used to redirect a wire implicates the adviser’s fiduciary duty directly.

Because each of those is a potential Advisers Act violation, controls that prevent them are inside the program the rule requires. The SEC staff made the connection explicit in its IM Guidance Update 2015-02 on cybersecurity, which describes assessing the firm’s information and systems, creating a strategy to address the risks, and implementing the strategy through written policies and training.

The annual review, as examiners read it

This is the single highest-yield thing to get right, because it is where a program that exists on paper separates from one that operates.

A review needs a reasonable basis

A review with a reasonable basis has looked at output, not just intent. The question is not “does the policy say we do access reviews” but “what did the last access review find, and what happened to the accounts it flagged.” A short memo that names four tests and their results is stronger than a thirty-page restatement of the policy.

Practically, the review should be able to answer:

• What was examined this year, and what was deliberately not?
• What did each test show?
• What was remediated, and what was accepted as an open risk, with whose sign-off?
• What changed in the firm — new systems, new people, new vendors — and did the policies follow?

It has to be findable a year later

The review is also a record. Advisers Act Rule 204-2(a)(17) requires advisers to keep copies of the compliance policies and procedures in effect, along with records documenting the annual review. A review that lives in a personal folder is a record-keeping problem in addition to a compliance one.

Once a year is a floor, not a rhythm

The rule says at least annually. Firms that only look once a year tend to find twelve months of drift at once. The workable pattern is a light quarterly touch on the things that change — access, vendors, exceptions — feeding an annual conclusion that has something to conclude from.

What the CCO needs from technology

The designation in the rule creates an information problem: the CCO is accountable for controls they usually do not administer. The fix is to make reporting arrive on a schedule rather than on request.

A workable minimum, delivered quarterly:

• Accounts added, removed, and privileged, with exceptions
• Security incidents and near-misses, including ones that were contained without impact
• Patch and endpoint protection status, with the machines that are out of policy
• Backup and restore test results, including failures
• Vendor changes — new providers, expanded access, terminations
• Open control exceptions and their age

If those six arrive every quarter, the annual review is largely assembled before it starts.

Common findings

• The policies describe a firm that no longer exists — an on-premises server room, a vendor that was replaced two years ago, a headcount that has doubled.
• The annual review has no date or author.
• The CCO has no independent access to technology evidence and must request everything from the provider, which means the provider is effectively reviewing itself.
• Exceptions are remembered rather than recorded, so nobody can say how long the one unenrolled MFA account has been unenrolled.

Related sections

Regulation S-P for the substantive safeguards, vendor oversight for the service-provider half of the program, incident response and exam evidence for what the review is expected to produce, and monitor and review for the aggregated checklist.

Pylon’s delivery view of this work is on SEC & FINRA compliance and RIA cybersecurity.

Primary sources

• 17 CFR 275.206(4)-7 — Compliance procedures and practices
• 17 CFR 275.204-2 — Books and records, including 204-2(a)(17)
• SEC IM Guidance Update 2015-02 — Cybersecurity guidance
• SEC Division of Examinations