The Commodity Futures Trading Commission has issued an advisory on the best practices for securing financial information, according to Timothy Nagle, Philip Lookadoo and Christopher Fatherly at Reed Smith. They note the move “demonstrates that cybersecurity is a significant issue in the financial industry and that the CFTC wants to be relevant and actively participate in the discussion.”
The recommended best practices include:
- Maintaining a written information security and privacy program.
- Choosing an employee who either reports directly to senior management or the board of directors to be in charge of security and privacy.
- Identifying risks and implementing safeguards to address them, such as the establishment of a breach response process.
- Training staff and supervising third-party service providers, as well as including security-related contract requirements.
- Testing controls like access management, use of encryption and incident detection and response, by an independent party.
- Reevaluating the security program when necessary and providing an annual assessment to the board of directors.
