FINRA Provides Cybersecurity Checklist to Small Firms

Posted on June 14th, 2016 at 5:26 PM
FINRA Provides Cybersecurity Checklist to Small Firms

From the Desk of Jim Eccleston at Eccleston Law LLC:

On May 23, 2016 FINRA introduced a Cybersecurity Checklist to “assist small firms in establishing a cybersecurity program to identity and assess cybersecurity threats, protect assets from cyber intrusions, detect when their systems and assets have been compromised, plan for the response when a compromise occurs and implement a plan to recover lost, stolen or unavailable assets.” This checklist is primarily derived from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and FINRA’s Report on Cybersecurity Practices.

Cybersecuirty should be taken seriously by financial organizations because it protects investors and firm information from compromise or the loss of data confidentiality, integrity or availability. The general checklist methodology includes questions such as:

1)      Do you store, use or transmit personally identifiable information (PII) (e.g., social security numbers or date of birth) or firm sensitive information (e.g. financial records) electronically?

If your answer is yes to this question then you must: identify and assess risks,        protect information, protect encryption, protect controls, protect information,      detect penetration, detect testing, detect intrusion and have a response plan in   place.

2)      Do you transmit PII or firm sensitive information to a third party, or otherwise allow access to your PII or firm sensitive information by a third party?

If you answer yes to question 2, you must identify and asses risks from third parties.

3)      Do your employees (or independent contractors) maintain devices that access PII or firm sensitive information?

If you answer yes to question 3, you must protect employee devices.

4)      Do you have assets that if lost or made inoperable would impact your firm’s operations (e.g. trading or order management systems)?

If you answer yes to question 4, you must protect system assets.

5)      If your systems, PII or firm sensitive information were made inoperable or stolen, would you need to recover them to conduct business?

If you answer yes to question 5, you must have a system in place for recovery.

FINRA specifically points out that the “use of this checklist does not create a safe harbor with respect to FINRA rules, federal or state securities laws, or other applicable federal or state regulatory requirements” See more>>

The attorneys of Eccleston Law LLC represent investors and advisers nationwide in securities and employment matters. Our attorneys draw on a combined experience of nearly 65 years in delivering the highest quality legal services. If you are in need of legal services, contact us to schedule a one-on-one consultation today.

Related Attorneys: James J. Eccleston

Tags: Eccleston, Eccleston Law, Eccleston Law LLC, James Eccleston

Return to Archive



The work that you and your team have performed on my behalf is exemplary.



September 21, 2023
SEC Charges Private Equity Firm Over Fee Disclosure Failures to Affiliate

The Securities and Exchange Commission (SEC) has charged Prime Group Holdings LLC, a private equity firm specializing in alternative real estate asset investments, with
inadequate disclosure of millions of dollars in real estate brokerage fees paid to a brokerage firm owned by its CEO.

September 20, 2023
SEC Orders Legendary Capital Founder and REIT Advisors to Pay Nearly $5 Million

Corey Maple, co-founder of non-traded REIT sponsor Legendary Capital, has agreed to a $100,000 civil penalty to settle charges brought by the Securities and Exchange Commission (SEC).

September 19, 2023
Reg BI Violations Lead to FINRA's Fine on Another Broker-Dealer

The Financial Industry Regulatory Authority (FINRA) has fined and censured broker-dealer Network 1 Financial Securities and its chief compliance officer for violating Regulation Best Interest (Reg BI).