An organisation can have every control in place and still fail an audit. The firewall is running, the laptops are patched, staff have sat through the training and the penetration test came back clean. Then a regulator asks for the written policy, the date it was last reviewed, the evidence that the testing happened and the list of every vendor with access to customer data, and the answers turn out to be scattered across four suppliers and somebody's spreadsheet. But being secure and being cyber compliant are different things, and as a business, you have to be both.
Two owners, one risk
According to the DTCC’s Cyber Resiliency in the Financial Industry Survey report, 49% of financial services organisations point to cloud and cyber security skills gaps as an internal challenge, with 33% citing a lack of internal security signals and 31% the inadequacy of identity and access management systems.
Today, cyber security sits with the CIO, the CISO and the IT security team, and it is measured on whether incidents get prevented, detected and answered. Cyber compliance, however, sits with the chief compliance officer alongside legal and risk, and it is measured on whether policies, procedures and documentation stand up when a regulator reads them. The recurring mistake is treating cyber compliance as an IT problem, which leaves a regulatory gap between two teams who each assume the other has it covered.
In the US, an examination by the Securities and Exchange Commission (SEC) of a registered investment adviser or broker-dealer now carries a dedicated cyber security assessment rather than a line item. A cyber sweep is the standardised version of that, sent to many organisations at once so the regulator can see how a whole category is performing. The 2024 amendments to Regulation S-P added notification obligations and formalised incident response, and the SEC Division of Examinations has said its focus includes whether governance practices, access controls, vendor oversight and incident response programmes are reasonably designed to safeguard investor records and assets. Examiners compare the documented policy against the operational evidence, and that comparison is where organisations fall short.
Scattered by design
Wealth managers can usually respond to every item on that request list, but the problem is that answers live in different places. Endpoint protection, for example, comes from one supplier while phishing training from another and penetration testing from a third. Vendor due diligence, on the other hand, comes from a spreadsheet that somebody updates between other duties.
Every control is real and working; what’s missing is a single trail behind them, which means the evidence has to be assembled from four reporting formats on four renewal cycles with no shared view of risk. Vendor inventories are the usual casualty because an organisation knows who supplies its portfolio management software and who holds custody, and is far less likely to have documented the e-mail provider, the CRM, the storage platform or the video conferencing tool – all of which touch customer information and are in scope. Doing this by hand is slow and expensive, and more so for smaller businesses with the least room to absorb it.
Compliance you can show
Smarsh Cyber Compliance was built for registered investment advisers and dealers and is deliberately not an endpoint detection and response product. What it does is map onto the examination rather than running alongside it. Endpoint monitoring covers computers and mobiles, including bring your own device environments, with automated controls for operating system updates, screen locks and VPN enforcement and one-click remediation for common issues.
Phishing simulation and security awareness training, delivered through a KnowBe4 partnership, sends simulated lures and routes anyone who clicks straight into training. Vulnerability assessment and penetration testing puts engineers against internal and external networks using real-world tactics and documents what they find.
Regulators are not asking anyone to be unbreachable. But the organisations that can produce a complete, current record of what they run, when it was tested and who has access have turned what is usually an annual scramble into routine governance. Cyber security defends the systems, cyber compliance proves it.
Share
