<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Broker-Dealers Need Vendor Management Too

author Michael Berman
1 min read
Jan 24, 2017

The Financial Industry Regulatory Authority (FINRA) is putting broker-dealers on notice that vendor management of cybersecurity will be a hot topic in 2017.

In its Regulatory and Examination Priorities Letter highlighting areas FINRA plans to review in 2017 and “brief observations about common weaknesses we have observed while executing our regulatory programs,” the organization addressed operational risks of cybersecurity as one of the biggest risks facing firms.

Elements of cybersecurity that FINRA says it’s likely to review related to vendors include:

Data loss. FINRA wants broker-dealers to understand how their vendor’s handle data, including what data is sensitive, where it travels, and how it is stored. Broker-dealers need to have tools that enable monitoring and protection of their data, which is shared with their vendors.

Vendor management. Vendor relationships and controls are drawing notice. Of particular interest is vendor access to personally identifiable customer or employee data, or sensitive firm information.

Insider threats. FINRA specifically mentions vendors as a potential source of insider threats to sensitive information.

Electronic communication retention. The Securities and Exchange Act requires firms to properly preserve emails and other records, yet there have been times when email review and retention vendors have fallen short of this requirement.

The message is clear: Vendor management controls are not optional, especially when it comes to data and cybersecurity. Broker-dealers need to know which vendors hold critical information and what contract protections are in place to keep that data safe. They must also be sure vendors are aware of regulatory requirements and are obligated to follow them.

FINRA won’t let broker-dealers off the hook if a vendor causes a data breach or other regulatory violation. A strong vendor management program is increasingly a must-have.

 

Related: Vendor Risk Countdown: Top 10 Risks Third-Party Vendors Pose to Your Financial Institution

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Whitepaper - Revelations from the FDIC's OIG Report
Risk & Compliance

Whitepaper - Revelations from the FDIC's OIG Report

Apr 21, 2017 1 min read
Have a Service Level Agreement (SLA) for Every Vendor
Risk & Compliance

Have a Service Level Agreement (SLA) for Every Vendor

Jun 5, 2015 1 min read
Forget Social Media: In 2016, you may be Paying Bills with a Selfie
Risk & Compliance

Forget Social Media: In 2016, you may be Paying Bills with a Selfie

Dec 18, 2015 2 min read