Complying with SEC, NFA FINRA Cyber Security Standards

 Both the SEC, NFA and FINRA have indicated that they will put heavy emphasis on cyber security enforcement throughout 2018. While FINRA is explicit – among other things, it publishes a cyber security checklist and a detailed report on best practices – the SEC’s guidance is far more general. This causes some confusion among affected companies regarding how to develop controls and internal policies in line with SEC, NFA FINRA cyber security standards.

Owing to different data environments, risks, and vulnerabilities, the precise details of SEC, NFA FINRA cyber security compliance will vary at every enterprise, but there are a few general best practices that all organizations should adhere to:

Use an Integrated Risk Management Approach to Policymaking

FINRA mentions in its Report on Cybersecurity Practices that “A sound governance framework with strong leadership is essential,” and the SEC, NFA focuses on “governance and risk assessment” during its cyber security audits. Organizations should develop their SEC, NFA FINRA cyber security policies using an integrated risk management approach. IRM eliminates silos and fosters a top-down, data-centric, and risk management-based culture throughout the organization.

Have Clear, Consistent Security Policies

In its latest risk alert, the SEC, NFA reported that nearly all of the firms it audited had written cyber security policies. However, most of them had issues, such as contradictory and/or vague policies and policies that were not being uniformly enforced. Security policies and protocols must be clear, consistent, and make sense in light of the organization’s data environment and individual vulnerabilities and risks.

Conduct Regular Risk Assessments

FINRA considers risk assessments to be “foundational tools” in firms’ cyber security arsenals. Because the threat environment is continually changing, organizations must perform risk assessments on a regular basis to ensure that their technical controls and SEC, NFA FINRA cyber security policies and procedures are up to date.

Conduct Regular Employee Security Training

An organization’s biggest security vulnerability is its own people; most of the time, hackers break into systems not through brute force attacks but social engineering schemes such as phishing emails. For this reason, both the SEC, NFA and FINRA emphasize the importance of well-trained employees to preventing cyber attacks. Cyber security awareness training should be conducted on a regular and ongoing basis.

Make Sure Your Business Associates Are Secure

Over 60% of enterprise data breaches are traced back to third-party vendors of larger organizations, and SEC, NFA FINRA cyber security standards do not allow companies to pass the buck if one of their business associates is breached. FINRA’s report specifically instructs organizations to “manage cybersecurity risk exposures” by “exercising strong due diligence across the lifecycle of their vendor relationships,” and the SEC, NFA looks at “vendor management” during security audits.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.