As independent directors' comfort and sophistication with overseeing cyber security has grown, some are paying more attention to the security of third-party providers, according to board members, '40 Act attorneys and other experts.

They say that while vendors are notoriously difficult to oversee no matter the issue, given that they're a step removed from the adviser, there are certain measures boards can take to gain assurance that they are each running a tight ship – and that management is watching them closely.

That can mean making sure the adviser includes third parties in cyber-security training and incident-recovery plans. It can also involve asking the manager for periodic reports on how third parties as a group are handling cyber security.

"People going back to the idea that we are so connected today," says one independent director, who spoke on condition of anonymity. "I might have confidence in what [my firm] is doing, but are they confident in what their service providers are doing? If not, do we have the appropriate gates to prevent contagion? In this industry we're all so connected with our service providers."

Cyber security has been a major issue for the mutual fund industry in recent years, as it has for all sectors that store enormous amounts of customers' personal data. Big, headline-grabbing disasters, like the Equifax data breach, have kept the issue front and center.

The Securities and Exchange Commission has repeatedly issued guidance intended to help investment firms prevent similar attacks, as it did in February, and its Office of Compliance Inspections and Examinations has called on firms to implement policies and procedures for vendor management.

As a recent Ropes & Gray alert on the investment industry and cyber security notes, OCIE has "gone so far as to indicate that an element of robust policies and procedures is to require third-party vendors to periodically provide logs of their activities on a firm's network," which is a type of document that shows who is in what part of the network and for how long.

For Vikram Bhat, principal with Deloitte Risk and Financial Advisory Cyber Risk Services, directors may approach strengthening third-party cyber security by first understanding how exactly how the vendor fits into the overall enterprise.

"The questions directors can actually ask to truly understand [include] what is the governance process of the third party and how is that calibrated to the criticality of the service and – depending on the criticality – what is the degree of assurance you're seeking," he says. "In the contract, have you built in all the right provisions around cyber security, liability, indemnification, response?"

From there, a board can then adjust its approach accordingly. A ready-made, one-size-fits-all tack simply won't work.

Documentation is one way independent directors have been keeping on top of vendor cyber security, industry experts say.

The type suggested by OCIE is too granular to be useful to the board, says Elizabeth Reza, a partner at Ropes & Gray, who co-authored the firm's cyber-security update. But it may be useful to ask whether the adviser receives that kind of documentation and, if so, whether it has the capacity to review such logs, especially if vendors submit them in different formats, she says.

Bhat notes that there are other types of assurances advisers may receive, such as attestations or the results of penetration tests.

But, he says, it's important for directors to keep in mind that those documents are usually a sanitized version of events. After asking if the adviser receives them, directors may want to ask what the adviser is doing to follow up. That could include asking whether the adviser understands the level of talent at the vendor and how much the vendor has spent on its cyber security.

"That's always an indicator of where people have actually put their money and implemented the appropriate things," he says. "It does require judgment and experience."

Directors may also want to ask whether the adviser is including vendors in its "cyberwar" exercises – real-time security tests that help a firm understand if its protocols would actually work during a cyber attack, Bhat says.

"The question I would also ask is how prepared is an institution in working with the third party around incidents and cyber crises," he says. "Often, preparing is 80% of the battle, and understanding the different cyber scenarios that might come about really is helpful."

Including third parties in that process can identify weaknesses in the adviser and its vendors' capability to respond to and recover from an event, he says, as well as whether all sides communicate adequately during a crisis.

"It starts identifying and surfacing things that...interviews never could," he says. "And to some degree, it starts building confidence. You are more prepared or better prepared to deal with the incident."

It is important to make sure individual chief compliance officers understand who the key players at the third parties are, he says.

"It's one thing to have the official channels, but more often than not in the cyber business, there's a network," Bhat says. "Make sure that the chief compliance officer of the adviser has an understanding of who the actual talent and people are at the third parties, have some confidence...around that talent base because people are so important on this."

And it's important for boards to make note of instances when the adviser adds to or adjusts its approach to cyber security – as well as if it never does. Reza says it's vital for directors to know that the adviser's cyber security is keeping up with ever-changing technology.

"If you're not hearing about the enhancements and improvements," she says, "that would be a red flag."

In Quest for Cyber Security, Don’t Forget About Vendors

or

Quick links:

Most Popular