MORGAN STANLEY B.V.
8
BUSINESS REVI
EW (CONTINU
ED)
Risk mana
gement (continued)
Cyber
and
information
security risk man
agement
(continued)
Morgan Stanley maintain
a s
ig
nificant amount of personal information on customers, clients,
em
ployees and
certain
counterparties
that
Mor
gan
Stanley
are
required
to
p
rotect
und
er
v
arious
state,
federal
and
international
data protection and privacy
laws.
These
laws
may
be
in
co
n
flict
with
o
ne
another,
or
courts
and
regulators
may
interpret
them
in
ways
that
Morgan Stan
ley had not anticipated o
r that adversely affects its business.
Cybersecurity
risks
for
f
inancial
in
stitutions
hav
e
significantly
increased
in
recent
years
in
par
t
becau
se
o
f
the
proliferation
of
new
technologies,
the
use o
f
the internet,
mobile
telecommunications
and
cloud
technolog
ies
to
conduct
financial
transactions,
and
the
increased
sophisticatio
n
and
activities
o
f
organised
crime, hackers,
terrorists and oth
er external extremist parties, inclu
ding foreign state acto
rs, in some
circumstances as a m
eans to promo
te political ends.
In addition
to the
growing sophistication
of certain
par
ties,
th
e
co
mmoditisation of
cyber tools
which are
able
to
be
wea
ponised
by
less
sop
histicated
actor
s
has
led
to
an
increase
in
th
e
exploitation
o
f
technolog
ical
vulnerab
ilities. Further,
foreign state actors
hav
e become more
soph
isticated over time,
increasing the risk
o
f
such
an
attack.
Any
of
these
p
arties
may
also
attem
pt
to
f
r
audulently
induce
employ
ees,
customers,
clients,
vendors or o
ther third parties or users of
Morgan Stanley systems.
Cybersecurity
risks
may
also
derive
from
human
error,
fraud
or
malice
on
the
part
of
employ
ees
or
third
parties, includ
ing third party
pro
viders, or may
result from
accidental techno
logical failure. These risks may
be
heightened
by
the
COVID
-19
pandemic,
which
has
caused
the
majority
of
employees
to
wo
rk
remotely
and access Mor
gan Stanley secure
networks through
their home networks.
There is
no
gu
arantee
th
at
the
m
easures
Morgan Stanley
takes
will provide a
bso
lute
secu
rity
or recoverability
given
the
techniques
used
in
cy
ber
-attacks
are
complex
and
frequen
tly
change,
and
m
ay
no
t
b
e
able
to
be
anticipated.
Like
other
financial
serv
ices
firms,
Mor
gan
Stanley,
its
third
party
providers,
and
its
clients
continu
e
to
be
the
subject
of
unauthorised
access
attacks,
mi
shandling
or
m
isuse
of
informatio
n,
computer
viruses
o
r
malware, and
cyber-
attacks.
Such
events could
cau
se interruptions
or
malfuncti
ons
in Morgan
Stanley’s,
its clients’,
employees’,
partners’, vendors’,
counterparties’ or
third
parties’ operations,
as
well
as the
unauthorised
release,
gath
ering,
monitoring, misuse, loss
or destruction of
confidential,
pro
prietary and
other information
of
Mo
rgan Stanley,
its employees, its customers or
of other third parties. Any
o
f t
h
ese events could result
in reputational damage
with
Morg
an
Stan
ley’s
clients
and
the
market,
client
dissatisfaction,
ad
ditional
costs
to
Morg
an
Stanley
to
maintain and upd
ate its operational and security systems and infrastructure, regulatory investigations,
litigation
o
r
enforcemen
t,
or
regulato
ry
fines
or
penalties,
any
of
which
could
adversely
affect
Morgan
Stanley’s business, fin
ancial condition
or results of operations
Given Morgan Stanley’s global footprint and the
hig
h volume of transactions processed, the
large number of
clients, partners, vendors
an
d counterparties
with
which
it does business,
and the increasing
sophistication of
cyber
attacks,
information or
security
breach
could occu
r and p
ersist for
an exten
ded period
of time
withou
t
detection.
Morgan
Stan
ley
expects
that
an
y
investigatio
n
of
a
cyb
er attack
would
be
inherently
unpredictable
an
d
that
it
would
tak
e
time
bef
ore
the
completion
of
any
in
vestigation
a
nd
before
there
is
availability
of
full
and
reliable
information
.
Dur
ing
such
time
Morgan
Stanley
would
not
necessarily
know
th
e
extent
of
the
harm
or
how
best
to
rem
ediate
it,
and
certain
errors
or
actions
could
be
repeated
or
compounded
before
they
are
discovered
and remediated, all
or
any of which
would further increase the costs
an
d consequences of a cyber
attack.