The written risk and threat assessment is, in my experience, the single most-requested document in an SEC cybersecurity examination. Rule 206(4)-7 requires advisers to identify risks and review the adequacy of their controls. Regulation S-P requires written safeguards reasonably designed to protect customer information. Neither obligation can be satisfied by a policy that asserts the firm is secure. Both require evidence that the firm looked, found what was actually there, and acted on it.
The rest of this article is free to read with a BrainTrust account. Free members also get every Insight, the Securing Compliance exam report, the Mock SEC Cyber Exam, and the Document Review Matrix — name and email, no card.