Due Diligence: FINRA Guidance on Supervising Vendor Cybersecurity

FINRA found that a large number of member firms had shortcomings. These included: insufficient vendor controls, access management, change management supervision, system testing and data loss prevention. In some cases this caused violations of FINRA and SEC rules. Firms are advised to evaluate their supervisory controls for the vendor relationship lifecycle to ensure compliance with SEC requirements to protect the security and confidentiality of customer information.