FINRA Provides Cybersecurity Checklist to Small Firms

Posted on June 14th, 2016 at 5:26 PM
FINRA Provides Cybersecurity Checklist to Small Firms

From the Desk of Jim Eccleston at Eccleston Law LLC:

On May 23, 2016 FINRA introduced a Cybersecurity Checklist to “assist small firms in establishing a cybersecurity program to identity and assess cybersecurity threats, protect assets from cyber intrusions, detect when their systems and assets have been compromised, plan for the response when a compromise occurs and implement a plan to recover lost, stolen or unavailable assets.” This checklist is primarily derived from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and FINRA’s Report on Cybersecurity Practices.

Cybersecuirty should be taken seriously by financial organizations because it protects investors and firm information from compromise or the loss of data confidentiality, integrity or availability. The general checklist methodology includes questions such as:

1)      Do you store, use or transmit personally identifiable information (PII) (e.g., social security numbers or date of birth) or firm sensitive information (e.g. financial records) electronically?

If your answer is yes to this question then you must: identify and assess risks,        protect information, protect encryption, protect controls, protect information,      detect penetration, detect testing, detect intrusion and have a response plan in   place.

2)      Do you transmit PII or firm sensitive information to a third party, or otherwise allow access to your PII or firm sensitive information by a third party?

If you answer yes to question 2, you must identify and asses risks from third parties.

3)      Do your employees (or independent contractors) maintain devices that access PII or firm sensitive information?

If you answer yes to question 3, you must protect employee devices.

4)      Do you have assets that if lost or made inoperable would impact your firm’s operations (e.g. trading or order management systems)?

If you answer yes to question 4, you must protect system assets.

5)      If your systems, PII or firm sensitive information were made inoperable or stolen, would you need to recover them to conduct business?

If you answer yes to question 5, you must have a system in place for recovery.

FINRA specifically points out that the “use of this checklist does not create a safe harbor with respect to FINRA rules, federal or state securities laws, or other applicable federal or state regulatory requirements” See more>>

The attorneys of Eccleston Law LLC represent investors and advisers nationwide in securities and employment matters. Our attorneys draw on a combined experience of nearly 65 years in delivering the highest quality legal services. If you are in need of legal services, contact us to schedule a one-on-one consultation today.

Related Attorneys: James J. Eccleston

Tags: Eccleston, Eccleston Law, Eccleston Law LLC, James Eccleston

Return to Archive



As a financial advisor with over 20 years of experience, I feel fortunate to call Jim my attorney and friend. He is a fantastic lawyer and trusted advisor. He is skilled in the matters necessary to do the job well. He uses his thoughtful approach and calm demeanor to achieve a positive outcome for the client. If you want to feel confident that nothing will be missed and that you will be represented in a highly professional manner, call Jim Eccleston.

Bill C. and Dan M.


January 21, 2022
CFP Board Establishes New Appeals Commission

The Certified Financial Planner (CFP) Board of Standards has established a new Appeals Commission. As the name suggests, the Appeals Commission possesses the sole authority to adjudicate appeal hearings.

January 20, 2022
Edward Jones Fails To Convince Supreme Court To Review Federal Preemption of Account Fee Suit

Edward Jones & Co. failed to convince the U.S. Supreme Court to analyze how a federal securities law impacts a client dispute pertaining to fee-based accounts.

January 19, 2022
SEC Charges Texas Entities Over Oil and Gas Fraud

The Securities and Exchange Commission (SEC) has charged The Heartland Group Ventures, Heartland Production and Recovery, six other Heartland-affiliated entities, four Heartland-affiliated individuals as well as several oil and gas operators.