NFA Proposes Cybersecurity Guidance For Derivatives Traders

On August 28, 2015, the National Futures Association (NFA) submitted a proposed interpretative notice (Notice) to the Commodity Futures Trading Commission (CFTC) to require information systems security programs (ISSPs). If the CFTC adopts the NFA's proposals, NFA member firms − including swap dealers, major swap participants, futures commission merchants, commodity trading advisors, commodity pool operators and introducing brokers (collectively, Members) − would have to establish, maintain and follow written ISSPs.

The Notice proposes that ISSPs should be approved by an executive-level official and contain a security and risk analysis, include a description of the safeguards deployed against identified cyber threats and vulnerabilities, indicate the processes used to evaluate the nature of a detected security event, assess the potential impact of a cyber-incident, take appropriate measures to contain and mitigate such an incident, and create an incident response