Investment firm licensees must take appropriate steps to ensure the security of any information handled or held on behalf of their clients.