In a letter to OIG in December 2023, David Bottom, the Chief Information Officer of the SEC, expressed his satisfaction with the report’s findings on the enhancements made to the SEC’s information security program. These improvements spanned various areas including risk management, supply chain, security training, and continuous diagnostics and monitoring. Bottom also highlighted the SEC’s Office of Information Technology’s ongoing efforts to enhance the program’s overall maturity, despite the fact that not all metrics are assessed and rated annually.
