FINRA Provides Cybersecurity Checklist to Small Firms

Posted on June 14th, 2016 at 5:26 PM
FINRA Provides Cybersecurity Checklist to Small Firms

From the Desk of Jim Eccleston at Eccleston Law LLC:

On May 23, 2016 FINRA introduced a Cybersecurity Checklist to “assist small firms in establishing a cybersecurity program to identity and assess cybersecurity threats, protect assets from cyber intrusions, detect when their systems and assets have been compromised, plan for the response when a compromise occurs and implement a plan to recover lost, stolen or unavailable assets.” This checklist is primarily derived from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and FINRA’s Report on Cybersecurity Practices.

Cybersecuirty should be taken seriously by financial organizations because it protects investors and firm information from compromise or the loss of data confidentiality, integrity or availability. The general checklist methodology includes questions such as:

1)      Do you store, use or transmit personally identifiable information (PII) (e.g., social security numbers or date of birth) or firm sensitive information (e.g. financial records) electronically?

If your answer is yes to this question then you must: identify and assess risks,        protect information, protect encryption, protect controls, protect information,      detect penetration, detect testing, detect intrusion and have a response plan in   place.

2)      Do you transmit PII or firm sensitive information to a third party, or otherwise allow access to your PII or firm sensitive information by a third party?

If you answer yes to question 2, you must identify and asses risks from third parties.

3)      Do your employees (or independent contractors) maintain devices that access PII or firm sensitive information?

If you answer yes to question 3, you must protect employee devices.

4)      Do you have assets that if lost or made inoperable would impact your firm’s operations (e.g. trading or order management systems)?

If you answer yes to question 4, you must protect system assets.

5)      If your systems, PII or firm sensitive information were made inoperable or stolen, would you need to recover them to conduct business?

If you answer yes to question 5, you must have a system in place for recovery.

FINRA specifically points out that the “use of this checklist does not create a safe harbor with respect to FINRA rules, federal or state securities laws, or other applicable federal or state regulatory requirements” See more>>

The attorneys of Eccleston Law LLC represent investors and advisers nationwide in securities and employment matters. Our attorneys draw on a combined experience of nearly 65 years in delivering the highest quality legal services. If you are in need of legal services, contact us to schedule a one-on-one consultation today.

Related Attorneys: James J. Eccleston

Tags: Eccleston, Eccleston Law, Eccleston Law LLC, James Eccleston

Return to Archive



Thank you for your professional assistance with this matter. You are very good at what you do.

John T.


January 31, 2023
Former LPL Advisor Receives 8-Year Prison Sentence For Misappropriation of Client Funds

A former LPL financial advisor recently was sentenced to more than eight years in prison, or 100 months, for his role in a scheme that misappropriated $2.8 million from six clients. 

January 30, 2023
Silvergate Shares Skyrocket Amidst FTX Meltdown

Silvergate Capital share prices increased after the company announced its fourth-quarter results, even after FTX’s collapse, which forced Silvergate to fire staff and sell assets.

January 27, 2023
SEC Files Suit Against Gemini and Genesis Over Crypto “Earn” Program

The Securities and Exchange Commission (SEC) has filed suit against two crypto brokerages, Genesis Global Capital and Gemini Trust Co., for breaching federal securities laws.