A dually registered broker-dealer and investment adviser (the “Respondent”) was sued by the SEC on September 29, 2009 for failing to require, among other things, that its registered representatives maintain antivirus software on the personal computers which were used to access customer account information on the firm’s intranet and trading platform. In addition, the SEC claimed that the Respondent did not have adequate procedures in place to review its registered representatives’ computer security measures. In particular, the SEC claimed that Respondent’s internal auditors did not audit branch office computers to determine whether anti-virus software was installed nor did they have adequate procedures in place to follow up on potential computer security issues uncovered during branch audits or when registered representatives contacted Respondent’s technology help desk for computer related assistance.
