Cyber Risk Analyst: 2026-09-25

1. SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI

   SEC, 2026-09-22. Read, 2 min.

   The SEC censured OTC Link LLC and ordered a $575,000 civil penalty, finding that from August 2016 to March 2025 the firm failed to establish and maintain written Regulation SCI policies and procedures for system security, access control, and application vulnerability management, testing, and remediation. The order finds that examination staff flagged the missing or draft policies in several examinations, and the firm settled without admitting the findings.

   Why it matters for this role: Unremediated regulatory findings now carry a price you can cite: a $575,000 penalty and a censure for policies examiners had flagged more than once.

2. Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

   CISA, 2026-09-23. Read, 6 min.

   The FBI and CISA published a fact sheet for critical infrastructure operators that use third-party ICS integrators, citing an FBI analysis of a 2025 intrusion at a US industrial automation company in which foreign actors created archives of about 800 files, including customer SCADA information, for presumed exfiltration. The agencies recommend applying least privilege to integrator access and writing cybersecurity requirements, such as data storage locations, remote access, and patch management, into contracts and service agreements.

   Why it matters for this role: Weigh integrator remote access in your third-party ICS risk using the FBI's account of a 2025 intrusion at a US industrial automation company, where about 800 files including customer SCADA information were staged for presumed exfiltration.

Cyber Risk Analyst