Following other regulators, the National Futures Association
(NFA)
recently amended its cybersecurity guidance to, among other
things, impose a new cybersecurity incident reporting requirement
on members.
Cybersecurity Incident Reporting. According to
the amended guidance, members will be required to report to NFA any
cybersecurity incident related to the member's commodity
interest business that resulted in (i) any loss of customer or
counterparty funds, (ii) any loss of a member's own capital, or
(iii) the member making a notification to customers or
counterparties under state or federal law (notably this part of the
guidance does not include notification under foreign law, like the
European Commission's General Data Protection Regulation
(GDPR)). Although the amended guidance does not define
cybersecurity incident, it provides the following nonexhaustive
list of examples: data loss, unauthorized access, malicious code,
denial of service, ransomware attack and
