Regulatory Expectations for Cybersecurity Practices at Broker‐Dealers

February.02.2021

In Vo. 54, No.1 of the Review of Securities & Commodities Regulation, Orrick partners Daniel Nathan and Heather Egan Sussman examine how cybersecurity has become an increasingly important priority for broker-dealer regulators as the number of data breaches has grown rapidly in recent years. In this article, they also focus on rules, regulations, and extensive guidance from the Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA). Daniel and Heather then turn to the lessons to be drawn from the law and guidance and conclude with a discussion of SEC and FINRA enforcement actions arising from cybersecurity failures and the lessons to drawn from those cases.

Read More

The Review of Securities & Commodities Regulation is an analysis of current laws and regulations affecting the securities and futures industry. If you have questions about your cybersecurity incident preparedness practices, please contact one of the authors.

Authors

Heather Egan Partner, Cyber Privacy and Data Innovation, Global Compliance & Regulatory

Boston

See my bio

D:+1 617 880 1830
E: [email protected]

Practice:

Technology & Innovation Sector
Finance Sector
Energy & Infrastructure Sector
Cyber Privacy and Data Innovation
Global Compliance & Regulatory
Government Investigations and Enforcement Actions
Technology & Innovation
Fintech
Environmental, Social & Corporate Governance (ESG)
Strategic Advisory & Government Enforcement (SAGE)

vCard

See full bio

Heather Egan Partner

Boston

Heather partners with clients to reduce the risk of privacy and security incidents. In the event of an incident, she helps companies respond, successfully guiding them through investigation, remediation, notification and any ensuing government inquiries. She provides comprehensive crisis management support and companies rely on her to manage their response to catastrophes, investigations and government probes involving conduct by employees, contractors and third parties.

To help clients navigate complicated global regulatory compliance challenges, she leads comprehensive cybersecurity and privacy assessments worldwide, vets risks in corporate transactions, conducts internal investigations stemming from data incidents, and drafts and negotiates contracts concerning data-related vendors and arrangements. She regularly counsels businesses on how to mitigate risks associated with the collection, use, retention, disclosure, transfer and disposal of personal data. Outside of the U.S., she manages teams of talented counsel around the world to deliver seamless advice for clients that operate across many jurisdictional lines, developing comprehensive privacy and cybersecurity programs that address competing regulatory regimes.