SEC warns CCOs about cybersecurity lapses.

• Position: CYBERSECURITY - Chief compliance officers - Securities and Exchange Commission

Gartner Inc. predicts that the importance of the personal cloud will continue to grow and that those responsible for building the digital workplace will be increasingly challenged as the personal cloud continues to evolve and intersect with IT initiatives.

The Securities and Exchange Commission (SEC) has put chief compliance officers (CCOs) on notice to carefully review and implement, where appropriate, the agency's latest cybersecurity guidance. Two recent remarks by SEC officials may have been a warning that the SEC plans to focus more on cybersecurity offenses and likely grabbed the attention of CCOs everywhere.

First, SEC Chief of Staff Andrew J. Donohue indicated that the SEC will continue to bring enforcement actions against CCOs for not addressing compliance issues, including cybersecurity. He challenged them to be "proactive" in their work and pointed to three recent SEC enforcement actions against CCOs on the grounds that they failed to implement compliance programs reasonably tailored to the specific needs of their firms. Two days after Donohue's speech, SEC Chair Mary Jo White announced: "While cybersecurity attacks cannot be entirely eliminated, it is incumbent upon private fund advisers to employ robust, state-of-the-art plans to prevent, detect, and respond to such intrusions."

Another message from the SEC came in the form of its recent enforcement action against investment advisor R.T. Jones Capital Equities Management for allegedly failing to establish cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information (PII) of about 100,000 individuals. As a result of these alleged violations, R.T. Jones agreed to pay a $75,000 penalty and undertake remedial efforts, including:

* Retaining multiple cybersecurity firms to assess the scope of the breach

* Removing all PII from its web server and encrypting all PII on its internal network

* Installing a new firewall and logging system

* Appointing an information security manager and implementing a written information security policy

*...