## Facts

- R.T. Jones Capital Equities Management, Inc. was a registered investment adviser providing managed-account services to retirement-plan participants through a program called “Artesys.”
- The firm collected and stored sensitive personally identifiable information (PII), including names, birthdates, and Social Security numbers, for more than 100,000 individuals, including thousands of clients.
- From at least September 2009 through July 2013, the firm stored PII on a third-party-hosted web server without adopting written policies and procedures addressing the security and confidentiality of that information or protection from anticipated threats and unauthorized access.
- The firm lacked basic safeguards referenced by the SEC, including periodic risk assessments, a firewall for the web server, encryption of PII on the server, and incident-response procedures.
- In July 2013, an unknown intruder gained access and copy rights to data on the server, rendering the PII of more than 100,000 individuals vulnerable to theft.
- There was no indication that any customer’s personal information was misused.
- After the incident, the firm retained cybersecurity firms to investigate, notified affected individuals, offered identity-theft monitoring, appointed an information security manager, and adopted and implemented written information-security policies.

## Issues

1. Whether a registered investment adviser violates Rule 30(a) of Regulation S-P by storing customer PII on a third-party web server without adopting and implementing written policies and procedures reasonably designed to protect that information from anticipated threats and unauthorized access.
2. Whether exposure of PII to increased risk, without evidence of actual misuse, can support enforcement for failure to maintain required safeguards under Regulation S-P.

## Decision

- The SEC instituted administrative cease-and-desist proceedings under Sections 203(e) and 203(k) of the Investment Advisers Act of 1940 and resolved the matter by accepting the firm’s offer of settlement (without admitting or denying the findings, except as to jurisdiction).
- The SEC found the firm failed to adopt and implement written policies and procedures reasonably designed to protect customer records and information as required by Rule 30(a) of Regulation S-P.
- The SEC ordered:
  - censure;
  - a cease-and-desist order from committing or causing future violations of Rule 30(a) of Regulation S-P; and
  - a $75,000 civil monetary penalty.

## Legal Principles

- Rule 30(a) of Regulation S-P requires registered investment advisers to adopt written policies and procedures reasonably designed to:
  - ensure the security and confidentiality of customer records and information;
  - protect against anticipated threats or hazards to the security or integrity of customer records and information; and
  - protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.
- A firm may violate the Safeguards Rule by failing to adopt and implement written, reasonably designed protections for customer information, even if there is no proof of identity theft or financial loss.
- In evaluating whether safeguards are “reasonably designed,” the SEC may consider the absence of common security controls and governance measures (e.g., risk assessments, firewall protection, encryption, and incident-response procedures) as evidence of inadequate policies and procedures.
- Post-incident remediation and cooperation may mitigate sanctions but do not eliminate liability for pre-incident failures to maintain required written safeguards.

## Conclusion

The SEC concluded that R.T. Jones violated Regulation S-P’s Safeguards Rule by maintaining large volumes of customer PII on an internet-accessible server without written, reasonably designed security policies and procedures, and imposed a censure, cease-and-desist order, and a $75,000 penalty despite no showing of actual misuse of the data.


In re R.T. Jones Cap. Equities Mgmt., Inc., Investment Advisers Act Release No. 4204 (Sept. 22, 2015)