By Shawn Waldman, CEO, SecureCyber
If your firm is registered with the SEC, the SEC just handed you a roadmap. Its Division of Examinations recently released its Fiscal Year 2027 Examination Priorities. This report spells out what examiners plan to look at over the next year.
Cybersecurity is on the list again. This year, AI is right next to it.
The report is a staff statement, not a new rule. But it tells you exactly where examiners will spend their time. Firms that read it now and act on it will walk into their next exam in much better shape.
What the SEC Will Check on Cybersecurity
Examiners will review your written policies and procedures in these areas:
- Leadership oversight. Who is in charge of cybersecurity and how leadership stays involved.
- Protecting sensitive data. How you keep client information from leaving the firm.
- Access and accounts. Who can log in to what, and how you manage user accounts.
- Responding to attacks. How you respond to and recover from incidents, including ransomware.
- Your vendors. The risks that come from outside service providers and shared technology, and how well you manage them.
- AI-written phishing emails that look real.
- Deepfake voice and video used to trick staff. Think of a phone call that sounds exactly like your CEO asking for a wire transfer.
- Written safeguards to protect customer information (administrative, technical, and physical).
- An incident response program for when someone gets unauthorized access to customer information.
- Procedures for notifying customers.
- How you oversee your service providers.
- Investment advisers, with extra focus on advisers who have never been examined or registered recently.
- Broker-dealers.
- Investment companies, such as mutual funds and ETFs.
- Transfer agents and funding portals, which the SEC also named for the amended Regulation S-P.
The SEC also flagged firms that let third parties access client accounts. It warned that existing controls may not be enough to protect client assets and data.
AI Is Now on the Exam List
The SEC uses the term "super intelligence," or SI. Most of us just call it AI.
The report makes a simple point. Criminals are using AI to launch attacks faster and make them harder to spot. So examiners will look at how your firm has prepared for things like:
If your firm uses AI tools in its own work, expect questions there too. Examiners will look at how you monitor those tools, whether what you tell clients about them is accurate, and whether automated advice fits each client's goals.
Customer Data Rules: Regulation S-P and Regulation S-ID
Regulation S-P covers how you protect customer information. Under the amended rule, examiners will look at:
Regulation S-ID covers identity theft. Examiners will look at how you spot and respond to warning signs, especially account takeovers and fraudulent transfers. They will also check whether you have updated your Identity Theft Prevention Program for newer risks, like AI and stolen passwords.
Who This Applies To
What to Do Now
You do not need to wait for an exam letter. Here is where I would start:
- Check your written policies against real life. If the policy says one thing and your team does another, that is a finding waiting to happen.
- Test your incident response plan. Walk through a ransomware scenario with your team. Make sure your customer notification steps are written down.
- List every vendor that touches client data or accounts. Know what each one can access and how you check on them.
- Train your people on AI scams. Set a simple rule: any request to move money or change account details gets verified with a call back to a known number.
- Clean up access. Remove old accounts, limit access to what each person needs, and require multi-factor authentication.
- Update your Identity Theft Prevention Program. Add red flags for AI-driven fraud and stolen passwords.
- Write down how you use AI. If your firm uses AI tools, document how they are monitored and make sure what you tell clients is accurate.
- Get an outside set of eyes. It is far better to find gaps yourself than to have an examiner find them for you.
The Bottom Line
The SEC has told you what it will ask. The firms that do well in an exam are the ones that can show their work: clear policies, a tested plan, and proof they are watching their vendors and the new AI threats.
Questions about getting your firm ready? Contact SecureCyber at (937) 388-4405, info@secdef.com, or secdef.com.
Source: U.S. Securities and Exchange Commission, Division of Examinations, "Fiscal Year 2027 Examination Priorities." This post is for general information and is not legal advice.