PE firms are no strangers to Regulation S-P. For more than two decades, the SEC’s privacy rule has governed how firms protect consumer financial information through written safeguards, disposal policies and opt-out rights. Kaitlin Betancourt, a partner at Goodwin, notes that many private fund advisers and RIAs underestimate the legal and investigative dimensions of cyber incidents. “We assist firms in building incident-response programs and drafting effective response plans – but the plan alone only gets you so far. The real purpose is to organize the firm so it knows how to react in the moment: who is on the response team? Who gets called first? What decisions need to be made immediately?” Best practice, she adds, is to conduct response efforts under legal privilege. She recommends firms engage cybersecurity counsel right away when something happens so they can help direct the response and determine which specialists need to be brought in. Few internal IT departments are equipped to handle forensic investigations since it’s a very specialized function, Betancourt says.
Read the Private Funds CFO article for more.