Law / United States / 
Ohio
Investment adviser physical security and cybersecurity policies and procedures
Ohio Adm. Code 1301:6-3-15.1(E)(1)(u)
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an investment adviser licensed with the Ohio Division of Securities or required to be licensed under Chapter 1707 of the Revised Code (reached by declaring that you are a broker-dealer, investment firm or investment adviser); an adviser licensed in Ohio whose principal place of business is in another state, which is registered as an investment adviser there and complies with that state's record keeping requirements, is outside paragraph (E) (rule 1301:6-3-15.1(E) and (E)(10)).
- Make and keep written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information (rule 1301:6-3-15.1(E)(1)(u)).
- Tailor the policies and procedures to your business model, taking into account the size of the firm, the types of services provided, and the number of locations (rule 1301:6-3-15.1(E)(1)(u)).
- Design the policies and procedures to protect against reasonably anticipated threats or hazards to the security or integrity of client records and information, to safeguard confidential client records and information, and to protect any records and information the release of which could result in harm or inconvenience to a client (rule 1301:6-3-15.1(E)(1)(u)(i)).
- Cover at least five functions in the policies and procedures: identify, protect, detect, respond and recover (rule 1301:6-3-15.1(E)(1)(u)(ii)).
- Review the policies and procedures no less frequently than annually and modify them as needed to ensure the adequacy of the security measures and the effectiveness of their implementation (rule 1301:6-3-15.1(E)(1)(u)(iii)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ohio Division of Securities, which may refuse, suspend or, after notice and hearing, revoke an investment adviser's license if the adviser conducts business in violation of the rules the division prescribes for the protection of investors, clients or prospective clients.
What this law does
Rule 1301:6-3-15.1 of the Ohio Administrative Code requires every investment adviser licensed or required to be licensed under Chapter 1707 of the Revised Code to make and keep the books and records listed in its paragraph (E)(1). Paragraph (E)(1)(u) of rule 1301:6-3-15.1 lists, among those records, written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information.
Those policies and procedures must cover at least five functions: identify, protect, detect, respond and recover. Paragraph (E) of rule 1301:6-3-15.1 does not apply to an investment adviser licensed with the division whose principal place of business is in another state, who is registered as an investment adviser in that state and who complies with that state's record keeping requirements. The rule text now published is effective .
When LexLint raises it
When your app profile says your app is a securities firm.