While SEC has made important progress in strengthening its information security controls, it has not completed actions to correct or mitigate 16 of the previously reported weaknesses.
SEC has not adequately documented access privileges for the EDGAR application, always implemented patches on vulnerable workstations and enterprise database servers, or always sufficiently protected passwords.