As a former FINRA Enforcement lawyer and Regulatory Specialist on FINRA’s Cybersecurity and Information Technology Disposition Group, I can say unambiguously that cybersecurity is top-of-mind with FINRA, the U.S. private sector regulator of the securities industry. Cybersecurity examinations are on the rise in 2016, and the trend is very likely to escalate in 2017.
Step back to February 2015. FINRA issued its Report on Cybersecurity Practices, which shined a regulatory spotlight on cybersecurity. FINRA’s Report provides a framework of principles and practices for firms to countermeasure against cybercriminals who target the securities industry for illicit monetary gain.
Since early 2015, FINRA has placed cybersecurity squarely in its examination cross-hairs. This year, FINRA issued its 2016 Regulatory and Examination Priorities Letter and announced that it would review firms’ approaches to cybersecurity risk management.
What are the "red flags" FINRA examiners are looking at?
So, what’s under the cybersecurity examination microscope? Undoubtedly, governance, risk assessment, technical controls, incident response, vendor management, data loss, and staff training. Examiners will also look deeper for “red flags” of inadequate cybersecurity written policies and procedures, lax cybersecurity with vendors, and weaknesses in safeguarding customer information and assets.
It is imperative that firms conduct and document a cybersecurity risk assessment, before encountering an examination. Otherwise, firms will be in an untenable position trying to explain the rationale of its cybersecurity program or – worse yet – why the firm has no cybersecurity program.
Violations can escalate from informal resolution to formal enforcement actions
Ultimately, violations of FINRA and SEC rules – such as FINRA Rule 3110 (supervision) and Rule 30 of SEC Regulation S-P (safeguarding customer records and information) – can result in disciplinary action. Although a significant number of disciplinary actions are resolved informally – through cautionary action letters – serious and egregious violations often escalate to formal enforcement actions resulting in hefty fines and sanctions.
Recently, FINRA imposed a $225,000 fine against a firm for failing to establish and maintain a supervisory system reasonably designed to safeguard confidential customer information, in violation of FINRA and SEC rules. A firm employee lost an unencrypted laptop containing highly sensitive, personal and confidential information of over 352,000 customers. In sanctioning the firm, FINRA reasoned that the firm’s written supervisory procedures “did not address the technology in use, specifically laptops” and the firm “failed to take appropriate technological precautions to protect customer and highly sensitive information.”
Because cybercrime is a central threat to investor protection, and nearly two years have passed since FINRA’s Report on Cybersecurity Practices, FINRA will undoubtedly raise intensity on cybersecurity compliance, likely resulting in increased disciplinary actions and sanctions for violations of FINRA and SEC rules.
The unanswered question is: Are firms ready?
Resources:
Search Blog
Follow Us
Recent Posts
- Federal Court Strikes Down the DOL’s Increased Salary Thresholds for Executive, Administrative, Professional, And Highly Compensated Employee Overtime Exemptions
- Breaking News: FinCEN Postpones Beneficial Ownership Reporting Deadlines for Companies Impacted by Recent Major Storms
- What You Need to Know About the U.S. Department of Transportation’s Build America TIFIA Loan
- Breaking News: Federal Judge Blocks Nationwide Implementation of the FTC’s New Rule Banning Noncompete Agreements
- September 4th is Almost Here: How Employers Can Prepare for the Upcoming Effective Date of the FTC’s Non-Compete Rule
- Florida’s New Statutory Home Warranty: What Home Builders Need to Know
- Orange County Proposes Temporary Suspension Ordinance on New Development Applications
- Raising the Roof: The U.S. Department of Labor Announces Rule Raising Salary Thresholds for Overtime Exemptions
- New Guidelines Anticipated Following HHS’s Health Cybersecurity Concept Paper
- SECURE 2.0 and Protecting Your Designated Beneficiaries
Popular Categories
- Employment and Labor
- Litigation (Labor & Employment)
- Construction
- Department of Labor
- Business of Real Estate
- Landlord-Tenant
- Construction Litigation
- Real Estate Law
- Salary
- Competition
- Cybersecurity
- Intellectual Property
- Appeals
- Construction
- Contracts
- Litigation
- Trusts and Estates
- Public Private Partnership
- Data Security
- Business
- Supreme Court
- Development/Land Use
- Technology
- IP Litigation
- Privacy
- Litigation (Appellate)
- Patents
- Business
- Public Finance
- Regulatory Compliance
- Florida Government Contracts
- Foreclosures
- Trademark
- Contracting
- Health Care
- Financial Institutions
- Compliance
- Estate planning
- International Dispute Resolution
- Florida Public Contracts
- Government Contracting
- Government Contracts
- Property Tax
- Government
- Conveyances
- Lease
- Appellate Blog
- Patent Office
- Insurance
- Wealth planning
- Federal Government Contracting
- Florida Bid Protests
- Public Contracts
- Infringement
- Cyber fraud
- Proposal Writing
- Public Bidding
- GAO
- Bid Protest
- International Arbitration and Litigation
- Americans with Disabilities Act
- Arbitration
- International
- Restrictive Covenants
- Grant Writing
- Copyright
- Promissory Notes
- Title
- Small Business
- Florida Procurement
- Public procurement
- Consumer Privacy
- PTAB
- General Liability
- Technology
- International Arbitration
- Liens and encumbrances
- Liens
- Creditor's Rights
- Bidding
- Attorneys' Fees
- Inter Partes Review
- Consumer Protection
- Power Generation
- Regulation
- Venue
- Contracting
- Government Vendor
- State Government Contracts
- Ad Valorem Assessments
- Florida Administrative Law
- Attorneys' Fees
- Florida Rules of Appellate Procedure
- Bankruptcy
- Florida Public Procurement
- Russia-Related Arbitration
- Mortgages
- FINRA
- Record on Appeal
- Rehearing
- Eviction
- Loan guaranties
- Patents - Assignor Estoppel
- Statute of limitations
- Statute of repose
- Dispute Resolution
- Liens
- Maritime
- Damages
- Briefing
- Request for Proposal
- Patents - Obviousness
- Commercial Brokerage
- Trade Secrets
- Bid Writing
- Florida Bidding Strategies
- Renewal
- Attorneys' Fees
- Florida County Lands
- Florida Economic Incentive Packages
- Jury Instructions
- Stay
- Design Professionals
- Certiorari
- Forum Selection
- email hacking
- Offers of Judgment
- Prevailing Party
- Settlements
- Assignment of Contract
- Assignment of Proceeds
- Designer Liability
- Lis Pendens
- Appellate Jurisdiction - Deadlines
- Banking
- Federal Rules of Appellate Procedure
- Finality
- Fintech
- Marketing/Advertising
- Preservation
- Unlicensed Contracting
- Evidence
- Evidence
- Expert
- Expert Science
- Federal Supply Schedule
- Florida Public Records Law
- Mootness
- Socio-Economic Programs
- Sunshine Law
- Veteran Owned Business
- Homestead
- Partnerships and LLCs
- Standing
Editors
- Of Counsel
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Associate
- Partner
- Partner
- Associate
- Partner
- Partner
- Partner
- Partner
- Senior Associate
- Partner
- Associate
- Partner
- Senior Associate
- Partner
- Associate
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Partner
- Of Counsel
- Senior Associate
- Partner
- Associate
- Partner
- Partner
- Associate
- Partner
- Partner
- Partner
Archives
- November 2024
- October 2024
- September 2024
- August 2024
- June 2024
- May 2024
- February 2024
- November 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- October 2019
- August 2019
- July 2019
- May 2019
- April 2019
- March 2019
- February 2019
- January 2019
- December 2018
- November 2018
- October 2018
- September 2018
- August 2018
- July 2018
- June 2018
- May 2018
- April 2018
- March 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- April 2016
- March 2016