Examination Priorities: Regulators Focus on Cybersecurity and Technology Governance in 2020

Year after year, we have seen FINRA’s focus and reliance on technology in its examination process continue to grow. It isn’t only increasingly using algorithms and computer technology to guide its staff. In its 2020 Risk Monitoring and Exam Priorities Letter, FINRA made it clear, given member firms’ increased reliance on technology, that firms should expect to see it focusing on change and problem management practices and other technology governance issues. Similarly, the SEC recently announced that its Office of Compliance Inspections and Examination (“OCIE”) will continue to prioritize information security in each of its five examination programs during 2020.

As the industry relies more and more on technology systems, examiners’ questions are focusing on such things as proper configuration of network storage devices, information security governance programs, and retail trading information security. In the past 12 months we have seen cybersecurity and technology governance questions predominate information requests. Many of these questions can leave even the most technologically savvy firms scratching their heads. The difficulty of answering these detailed requests can be mitigated with an understanding of the questions member firms are being asked, and an internal risk assessment. The assessment should determine what systems your firm is using, how they are being used, who has control over those systems and what information is being stored in each system.

Safeguarding customer information and firm business records

FINRA tells us that the primary federal securities laws governing a firm’s cybersecurity program is SEC Rule 30 of Regulation S-P, which requires written policies and procedures to address the safeguarding of customer information and firm business records. It is a member firm’s responsibility to understand and follow Rule 30 and all other cybersecurity statutes, including those implemented at the Self-Regulatory Organization (SRO) level. Broker-dealers and investment advisors alike should establish a point person for their technology and cybersecurity program that can manage extended deadlines with complex requirements.

Point person aside, the responsibility to maintain compliance with SEC Rule 30 and SEC Rule 17a-4 trickles down to every employee of the broker-dealer and the investment advisor. Every employee in a firm that has an email address may be subject to phishing email attacks, regardless of their role or authority. Employees that handle a firm’s monetary systems must be aware that ransomware attacks, identity theft, and fraudulent third-party wire requests have been on the rise. In keeping with FINRA and SEC Rules, a firm’s principals are responsible for implementing such policies together with cybersecurity training programs that can reasonably prevent their employees from falling prey to such breaches.

Risk assessments and cybersecurity at scale

FINRA member firms, as well as registered investment advisors, must establish effective cybersecurity programs that utilize risk-based management in their processes. Effective programs use regular risk assessments with scheduled follow-ups, and vulnerability and penetration testing coupled with role-specific training programs and exercises. FINRA published a tool for small firm members to use to conduct a cybersecurity risk assessment. The tool can easily be used by investment advisors as a guide when conducting their own cybersecurity risk assessment.

FINRA member firms (as well as investment advisors) with branch offices and/or independent rep platforms should also implement these tools as part of their “branch office” inspection programs. Broker-dealers and investment advisors with sophisticated cybersecurity programs have successfully implemented system usage behavior analytics and data loss prevention tools, along with security information and event management mechanisms. FINRA, and to a certain extent the SEC, does acknowledge that the level of cybersecurity efforts can be tailored to the size and scope of each member firm. They also acknowledge that some of the more sophisticated cybersecurity methods cannot be required of all firms. However, the rules apply to small firms as well as large firms. As such, all broker-dealers and investment advisors should strive to implement a program that exceeds at least the minimum requirements in order to avoid unnecessary regulatory attention.