Finra Releases Cybersecurity Practices Report

The 46-page report is based off of a targeted examination, also known as a sweep, of an assortment of firms that looked into the types of threats firms face, the parts of firms' systems that might be susceptible to an attack, and how they're handling cybersecurity threats.

The results from the sweep mirrored that of a 2011 Finra survey where firms considered their top three cybersecurity threats: hackers, insiders compromising data and operational risks (power failures, earthquakes, etc.)

The report is broken down into eight sections, each of which includes a "Principles and Effective Practices" portion that summarizes what firms should implement to best protect themselves against cybersecurity. The sections are:

·Governance and risk management for cybersecurity
·Cybersecurity risk assessment
·Technical controls
·Incident response planning
·Vendor management
·Staff training
·Cyber intelligence and information sharing
·Cyber insurance

The report falls in line with Finra's 2015 Regulatory and Examinations Priority letter released earlier this year. The letter identified cybersecurity as one of five key areas of focus for the coming year.

"Broker-dealers face a variety of rapidly evolving cybersecurity threats, which require a well-designed and adaptable cybersecurity program," said Susan Axelrod, executive vice president for regulatory operations at Finra. "Finra is keenly focused on cybersecurity, and firms must make responding to these threats a high priority. This report builds on the insights from our recent cybersecurity sweep and highlights a series of principles and effective practices that firms can adapt to their particular circumstances."