FINRA Forces Firms Into The Weeds On Security Policies

The Securities and Exchange Commission continues to be active in the area of cybersecurity. A recent Letter of Consent issued by the agency's Financial Industry Regulatory Authority (FINRA) contained some startling new requirements that, if enforced by FINRA, could place a significant burden on financial firms in regard to their privacy and cybersecurity policies. 

FINRA and cybersecurity policies

Since the enactment of SEC Regulation S-P in 2000, the SEC has required every broker, dealer, and investment company to "adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information." FINRA has taken an increasingly aggressive role in protecting the privacy and security of banking customer's personal information. FINRA has passed regulations requiring member firms to maintain systems that ensure customer confidentiality and protect against anticipated threats and unauthorized