FINRA Issues 12-Principle Cybersecurity Framework for Member Firms

FINRA issued a 12-principle cybersecurity framework to help member firms strengthen their cybersecurity programs and mitigate risks of unauthorized access and system disruptions.

In the framework document, FINRA outlined scalable and adaptable practices informed by regulatory obligations, industry risk principles, and oversight observations. The guidance covers core security areas including governance, risk management, third-party risk management (see prior coverage), asset management, access control, data protection, security awareness, vulnerability management, security monitoring, threat intelligence, incident response, and resilience.

FINRA stated the framework does not create new legal or regulatory requirements or relieve members of existing obligations. Instead, member firms may use the guidance to develop or modify practices reasonably designed to achieve compliance with relevant regulatory obligations based on their size and business model. The framework highlights specific regulatory obligations firms should consider, including SEC Regulation S-P ("Privacy of Consumer Financial Information and Safeguarding Personal Information"), SEC Regulation S-ID ("Identity Theft Red Flags"), FINRA Rule 3110 ("Supervision"), FINRA Rule 4370 ("Business Continuity Plans and Emergency Contact Information"), and Exchange Act recordkeeping obligations under SEA Rule 17a-3 ("Records to be made by certain exchange members, brokers and dealers") and SEA Rule 17a-4 ("Records to be preserved by certain exchange members, brokers and dealers").