The document outlines Kroll's cyber security services, focusing on SEC cybersecurity guidance and best practices for managing cyber risk. Key areas of emphasis include risk assessments, incident response planning, and compliance with SEC regulations, alongside insights into the evolving cyber threat landscape. It highlights the importance of maintaining robust cybersecurity policies, employee training, and preparation against data breaches for organizations of all sizes.

1. Proprietary and Confidential — External Use Only
1 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
SEC OCIE
Cybersecurity Focus Areas,
Guidance, and Best Practices
Gregory Michaels Terry Mason
Managing Director, Cyber Risk Director, Cyber Risk
November 2018

2. Proprietary and Confidential — External Use Only
2 Kroll Cyber Security & Breach Notification 
1
2
3
4
5
Kroll Overview
Agenda
SEC Cybersecurity Guidance
SEC Enforcement
Cyber Threat Landscape
Cybersecurity Best Practices

3. Proprietary and Confidential — External Use Only
3 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
Kroll Cyber Security & Breach Notification 
Kroll Overview
1

4. Proprietary and Confidential — External Use Only
4 Kroll Cyber Security & Breach Notification 
Extensive cyber expertise worldwide
 Kroll works on more than 1000 cyber
events every year for clients ranging from
Fortune 100 to small and medium-sized
organizations.
 Experts with extensive technical and
executive expertise in Information Technology,
Cybersecurity, Risk Management, Penetration
Testing, Physical Security, Compliance, and
Software Development.
 Experts with unique experience from former
law enforcement, e.g. FBI, DOJ, U.K.
Intelligence, Europol, SEC, U.S. Secret
Service, among others.
 Kroll experts hold more than 30 types of
industry certifications, including CIPP/US,
CISSP, CRISC, CISA, CISM, GCIH, OSCP,
GWAPT, GAWN, GPEN, GCED, CBCP,
MCSE, QSA, AWS-CSAA, CEH.
Duff & Phelps / Kroll has offices
in 28 countries

5. Proprietary and Confidential — External Use Only
5 Kroll Cyber Security & Breach Notification 
Prepare Detect Respond Restore
• Cyber Risk
Assessments (NIST, SEC,
HIPAA, NY-DFS, GDPR, etc.)
• Cyber Policy Review &
Design
• Interim CISO & Data
Protection Officer for
GDPR
• Incident Response
Planning
• Penetration Testing
• Social Engineering
Exercises
• Vulnerability Scanning
• Third Party Cyber
Reviews and Due
Diligence
• QSA/PCI Services
• Training & Awareness
• Malware and Advanced
Persistent Threat
Detection
• PCI Forensic Investigator
(PFI)
• CyberDetectER ®
• Endpoint powered by Red
Canary
• DarkWeb
• SurfaceWeb
• BINWatch
• Computer Forensics
• Incident Response
Management
• Data Collection &
Preservation
• PCI Forensic Investigator
(PFI)
• Data Recovery & Forensic
Analysis
• O365 Witness Tool
• Cyber Litigation Support
• B2B Breach Response
• Notification Letters
• Call Center Services
• Credit Monitoring
(Kroll Branded)
• Identity Theft Restoration
(Kroll Branded)
• Identity Monitoring
(Kroll Branded)
• B2B2C: Consumer ID
Theft Protection Services
Kroll Cyber Security
End-to-End Services

6. Proprietary and Confidential — External Use Only
6 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
Kroll Cyber Security & Breach Notification 
SEC Cybersecurity Guidance
2

7. Proprietary and Confidential — External Use Only
7 Kroll Cyber Security & Breach Notification 
SEC OCIE – Cyber Focus Areas
The SEC Office of Compliance Inspections and Examinations (OCIE) issues risk
alerts on cybersecurity to keep registered broker-dealers, investment advisers, and
investment companies up to date regarding SEC focus areas for cyber.
OCIE examinations have focused on firms’ written policies and procedures
regarding cybersecurity, including validating and testing that such policies and
procedures were implemented and followed.
Examinations have helped the SEC to develop a catalog of good practices.
Maintenance of an inventory of data, information, and vendors
Policies and procedures should include a complete inventory of data and information,
along with classifications of the risks, vulnerabilities, data, business consequences,
and information regarding each service provider and vendor, if applicable.
Security Risk Assessments
 Matching policies with security controls and processes
 Assessing risk: people, process, technology
 Remediation

8. Proprietary and Confidential — External Use Only
8 Kroll Cyber Security & Breach Notification 
SEC OCIE Guidance on Cyber
Maintenance of prescriptive schedules and processes for testing
data integrity and vulnerabilities
 Vulnerability scans of core IT infrastructure
 Patch management policies
Detailed cybersecurity-related instructions. Some
examples:
 Penetration tests
 Security monitoring and system auditing
 Access rights
 Reporting

9. Proprietary and Confidential — External Use Only
9 Kroll Cyber Security & Breach Notification 
SEC OCIE Guidance on Cyber
Established and enforced controls to access data and systems
 Acceptable Use policies
 Restrictions and controls for mobile devices
 Logs of third-party access on firm networks
 Robust procedures for employee terminations
Mandatory employee training
Engaged senior management (e.g., cyber risk committee)
Incident response plan

10. Proprietary and Confidential — External Use Only
10 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
Kroll Cyber Security & Breach Notification 
SEC Enforcement
3

11. Proprietary and Confidential — External Use Only
11 Kroll Cyber Security & Breach Notification 
SEC Cyber Enforcement in 2018
 In FY 2018, the SEC’s Enforcement Division’s Cyber Unit became fully
operational
 First case against a public company for failing to properly inform
investors about a cyber breach
 First action against a firm for violations of the Identity Theft Red Flags
Rule
 In FY 2018, the SEC brought 20 cyber-related standalone cases,
including those involving ICOs and digital assets
 At the end of the fiscal year, the Division had more than 225 cyber-
related investigations ongoing

12. Proprietary and Confidential — External Use Only
12 Kroll Cyber Security & Breach Notification 
SEC Examination Priorities

13. Proprietary and Confidential — External Use Only
13 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
Kroll Cyber Security & Breach Notification 
Cyber Threat Landscape
4

14. Proprietary and Confidential — External Use Only
14 Kroll Cyber Security & Breach Notification 
Threat landscape
Deep web: anything not accessible
through a typical search engine
(e.g., content behind a subscription
wall, academic or governmental
databases, medical records,
financial records, etc.)
Surface web: anything that can be
indexed and accessed through a search
engine (e.g., Google, Yahoo, Bing)
Dark web: Using anonymity tools such
as Tor and I2P, the dark web enables
criminal activity as well as whistleblowing
and uncensored political protests

15. Proprietary and Confidential — External Use Only
15 Kroll Cyber Security & Breach Notification 
2018 Cyber Stats
 56% of 1,379 incidents with specific malware functionality were
ransomware (Verizon Data Breach Investigations Report)
 668 breaches compromised 22,408,258 records between January 1
and July 2, 2018 (Identity Theft Resource Center Report)
 The average total cost of a data breach is $3.86 million (Ponemon
Report)
 Early containment (less than 30 days) saved $1.16 million on average
in 2018 and $94,000 in 2017 (Ponemon Report)

16. Proprietary and Confidential — External Use Only
16 Kroll Cyber Security & Breach Notification 
Proprietary and Confidential — External Use Only
Kroll Cyber Security & Breach Notification 
Cybersecurity Best Practices
5

17. Proprietary and Confidential — External Use Only
17 Kroll Cyber Security & Breach Notification 
Cybersecurity Best Practices
• Training and Awareness – Social Engineering
• Encryption
• Patch Management – System/Network/Application
• Multi-factor Authentication – Remote Access
• Local Admin Rights / Local Administrator Acct
• Mobile Device and Media Controls

18. Proprietary and Confidential — External Use Only
18 Kroll Cyber Security & Breach Notification 
Cybersecurity Best Practices
• Third Party Security Management
• Access Controls – Minimum Necessary
• Access Reviews and Monitoring
• Email Filtering Controls
• Wire Request/Authorization Processes
• Retention and Destruction

19. Proprietary and Confidential — External Use Only
19 Kroll Cyber Security & Breach Notification 
Gregory Michaels
Kroll Cyber Risk
Managing Director
201-978-1546
gregory.michaels@kroll.com
Terry Mason
Kroll Cyber Risk
Director
917-583-1931
terry.mason@kroll.com