FINRA Provides Cybersecurity Checklist to Small Firms

Posted on June 14th, 2016 at 5:26 PM
FINRA Provides Cybersecurity Checklist to Small Firms

From the Desk of Jim Eccleston at Eccleston Law LLC:

On May 23, 2016 FINRA introduced a Cybersecurity Checklist to “assist small firms in establishing a cybersecurity program to identity and assess cybersecurity threats, protect assets from cyber intrusions, detect when their systems and assets have been compromised, plan for the response when a compromise occurs and implement a plan to recover lost, stolen or unavailable assets.” This checklist is primarily derived from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and FINRA’s Report on Cybersecurity Practices.

Cybersecuirty should be taken seriously by financial organizations because it protects investors and firm information from compromise or the loss of data confidentiality, integrity or availability. The general checklist methodology includes questions such as:

1)      Do you store, use or transmit personally identifiable information (PII) (e.g., social security numbers or date of birth) or firm sensitive information (e.g. financial records) electronically?

If your answer is yes to this question then you must: identify and assess risks,        protect information, protect encryption, protect controls, protect information,      detect penetration, detect testing, detect intrusion and have a response plan in   place.

2)      Do you transmit PII or firm sensitive information to a third party, or otherwise allow access to your PII or firm sensitive information by a third party?

If you answer yes to question 2, you must identify and asses risks from third parties.

3)      Do your employees (or independent contractors) maintain devices that access PII or firm sensitive information?

If you answer yes to question 3, you must protect employee devices.

4)      Do you have assets that if lost or made inoperable would impact your firm’s operations (e.g. trading or order management systems)?

If you answer yes to question 4, you must protect system assets.

5)      If your systems, PII or firm sensitive information were made inoperable or stolen, would you need to recover them to conduct business?

If you answer yes to question 5, you must have a system in place for recovery.

FINRA specifically points out that the “use of this checklist does not create a safe harbor with respect to FINRA rules, federal or state securities laws, or other applicable federal or state regulatory requirements” See more>>

The attorneys of Eccleston Law LLC represent investors and advisers nationwide in securities and employment matters. Our attorneys draw on a combined experience of nearly 65 years in delivering the highest quality legal services. If you are in need of legal services, contact us to schedule a one-on-one consultation today.

Related Attorneys: James J. Eccleston

Tags: Eccleston, Eccleston Law, Eccleston Law LLC, James Eccleston

Return to Archive



If you are being bothered by the Regulators, call Eccleston Law, you won't regret it.

Rick R.


August 16, 2022
SEC Warns Financial Advisory Firms Regarding Conflicts of Interest Tied to Compensation

The Securities and Exchange Commission (SEC) has sent a warning to financial advisory firms that they must go above and beyond solely disclosing conflicts of interest related to employee pay programs in order to avoid regulatory scrutiny. 

August 15, 2022
FINRA Proposal Would Permit Private Homes to Serve as Non-Branch Offices

The Financial Industry Regulatory Authority (FINRA) has filed proposed changes to FINRA Rule 3110 with the Securities and Exchange Commission (SEC).

August 12, 2022
SEC Charges J.P. Morgan, UBS, and TradeStation for Deficiencies Pertaining to the Prevention of Customer Identify Theft

The Securities and Exchange Commission (SEC) has charged J.P. Morgan Securities, UBS Financial Services, and TradeStation Securities over deficiencies in their programs designed to prevent client identify theft, which violates the SEC’s Identity Theft Red Flags Rule, or Regulation S-ID.