Both the SEC and FINRA have indicated that they will put heavy emphasis on cyber security enforcement throughout 2018. While FINRA is explicit — among other things, it publishes a cyber security checklist and a detailed report on best practices — the SEC’s guidance is far more general. This causes some confusion among affected companies regarding how to develop controls and internal policies in line with SEC and FINRA cyber security standards.
Owing to different data environments, risks, and vulnerabilities, the precise details of SEC/FINRA cyber security compliance will vary at every enterprise, but there are a few general best practices that all organizations should adhere to:
Use an Integrated Risk Management Approach to Policymaking
FINRA mentions in its Report on Cybersecurity Practices that “A sound governance framework with strong leadership is essential,” and the SEC focuses on “governance and risk assessment” during its cyber security audits. Organizations should develop their cyber security policies using an integrated risk management approach. IRM eliminates silos and fosters a top-down, data-centric, and risk management-based culture throughout the organization.
Have Clear, Consistent Security Policies
In its latest risk alert, the SEC reported that nearly all of the firms it audited had written cyber security policies. However, most of them had issues, such as contradictory and/or vague policies and policies that were not being uniformly enforced. Security policies and protocols must be clear, consistent, and make sense in light of the organization’s data environment and individual vulnerabilities and risks.
Conduct Regular Risk Assessments
FINRA considers risk assessments to be “foundational tools” in firms’ cyber security arsenals. Because the threat environment is continually changing, organizations must perform risk assessments on a regular basis to ensure that their technical controls and cyber security policies and procedures are up to date.
Conduct Regular Employee Security Training
An organization’s biggest security vulnerability is its own people; most of the time, hackers break into systems not through brute force attacks but social engineering schemes such as phishing emails. For this reason, both the SEC and FINRA emphasize the importance of well-trained employees to preventing cyber attacks. Cyber security awareness training should be conducted on a regular and ongoing basis.
Make Sure Your Business Associates Are Secure
Over 60% of enterprise data breaches are traced back to third-party vendors of larger organizations, and neither the SEC nor FINRA allow companies to pass the buck if one of their business associates is breached. FINRA’s report specifically instructs organizations to “manage cybersecurity risk exposures” by “exercising strong due diligence across the lifecycle of their vendor relationships,” and the SEC looks at “vendor management” during security audits.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.