Last month, the Financial Industry Regulatory Authority (FINRA) released its annual Regulatory and Examination Priorities Letter (the “2017 Priorities Letter”) which highlights the areas that FINRA plans to focus on in its 2017 examination of registered broker-dealers.

It should come as no surprise that cybersecurity is listed as one of the operational threats that FINRA intends to focus on in 2017. The 2017 Priorities Letter recognizes that “[c]ybersecurity threats remain one of the most significant risks many firms face.” As part of its examination, FINRA will assess a broker-dealer’s programs to mitigate cybersecurity risks, taking into consideration each broker-dealer’s business model, size and risk profile. More specifically, broker-dealers should be prepared for FINRA to (i) review the broker-dealer’s methods for preventing data loss, (ii) assess the controls the broker-dealer uses to monitor and protect its data, and (iii) review how the broker-dealer manages their vendor relationships.  Also, because FINRA understands that “[t]he nature of the insider threat itself is rapidly changing as the workforce evolves to include more employees who are mobile, trusted external partnerships and vendors, internal and external contractors, as well as offshore resources,” FINRA intends to examine a broker-dealer’s controls to protect sensitive information from insider threats.

Additionally, FINRA intends on focusing on two areas in which FINRA has noted repeated shortcomings in controls among the broker-dealers that it regulates: (1) poor cybersecurity controls at branch offices (for example, poor controls related to the use of passwords, encryption of data, use of portable storage devices, implementation of patches and virus protection, and the physical security of assets and data), and (2) failure to preserve certain records in a non-rewriteable, non-erasable format, commonly known as write once read many (WORM) format pursuant to Securities Exchange Act (SEA) Rule 17a-4(f).

The full text of FINRA’s 2017 Regulatory and Examination Priorities Letter can be found here.