Cybersecurity Compliance Within the Financial Services Industry

The financial industry is a primary target for cybercriminal activity due to the vast amounts of valuable data at stake.  A successful attack can yield massive rewards for hackers.  In fact, 67% of financial institutions reported an increase in cyber-attacks in the past year.  Financial institutions host customer’s personal identifiable information (PII).  Examples include social security data, banking records and client’s private information, making them particularly vulnerable to a data breach.  Correspondingly, the financial services sector is one of the most highly regulated industries in the United States. Various laws and cybersecurity standards ensure critical assets are protected and the risk of cybersecurity incidents is reduced.

Financial Compliance Matters

Maintaining cybersecurity compliance is essential. The impact of a data breach could result in downtime, productivity loss, and potential loss of business.  Additionally, penalties and fines could be imposed. Financial organizations are typically required to comply with multiple standards, regulations, and laws that apply to the entire industry.  By following these standards, securing critical data and information can be achieved.  Meeting financial security compliance requirements provides an organization with many essential benefits, including:

• A better understanding of what cybersecurity tools and practices to use
• Increased security of valuable information, data and systems
• Reduced time for cybersecurity incident response

Some of these international data security standards include:

• Payment Card Industry (PCI) Data Security Standard (DSS). PCI DSS is an international set of standards for organizations that handle credit card information that specifies requirements for processing, storing, and transferring payment card data. The objective of these standards is to reduce instances of credit card fraud and provide protections for cardholder data. PCI DSS compliance requires organizations implement complex security solutions, maintain a secure data network and continuously monitor data across networks.
• International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001 — The ISO/IEC 27001 is an international standard that provides requirements for an information security management system (ISMS).  It is one of many standards included in the ISO/IEC 27000 family of cybersecurity standards. The 27001 standard provides a management framework to ensure integrity and security of all corporate data.
• SWIFT’s Customer Security Program (CSP) — Swift’s CSP prevents, detects and aims to prevent fraudulent activity through a set of mandatory security controls, community-wide information sharing initiatives and enhanced security features.

The following regulations should also be considered:

• Financial Industry Regulatory Authority (FINRA) — FINRA outlines cybersecurity risk management best practices including controls needed to protect customer and company confidential data. Also, this non-profit , under the supervision of the SEC, provides guidelines and sets requirements for US brokerage firms.
• The Bank Secrecy Act (BSA) — US law created to prevent criminals from using financial institutions to hide or launder money. “U.S. regulators have come to expect that financial institutions will take a holistic view of cyber threats and incorporate information about cyber-events and cyber-enabled crimes in Suspicious Activity Reports (SARs) filed pursuant to their Bank Secrecy Act obligations.” Source
• The Sarbanes Oxley Act (SOX) — This US federal law set new or expanded requirements for all US public company boards, management, and public accounting firms. Likewise, several provisions are applicable to privately held organizations.  The Act contains provisions affecting corporate governance, risk management, auditing, and financial reporting.
• The Gramm–Leach–Bliley Act (GLBA) — This Act requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. For instance, companies that offer consumers financial products or services like loans, financial or investment advice, or insurance must comply.
  • In addition to financial industry-specific laws and regulations, another requirement financial institutions should keep in mind is the direction provided from the National Institute of Standards and Technology which provide valuable information for securing sensitive data, ensuring seamless operations, and minimizing risk.
• National Institute of Standards and Technology (NIST) — This US government agency provides recommendations for cybersecurity standards and best practices. Furthermore, the practices are regarding the five key components of cybersecurity infrastructure – identifying, protecting, detecting, responding, and recovering.

Five Best Practices for Maintaining Cybersecurity Compliance in the Financial Sector

Cybersecurity compliance is an ongoing endeavor, especially given cyberthreats are always evolving and changing. Below are five best practices financial organizations can follow to ensure ongoing compliance:

1. Assess Risk and Modify Cybersecurity Plan. Your company’s IT infrastructure will benefit from periodic risk assessments because you will have full visibility into all vulnerabilities present that could compromise your network. Modifications can easily be made to your corporate cybersecurity plan to prioritize the security improvements needed by identifying these risks.
2.  Educate Employees. According to an IBM study, 95% of cybersecurity breaches can be attributed to unintentional human error by employees. Implementing an employee security awareness and training program can teach employees how to leverage cybersecurity best practices and help prevent potential breaches.
3. Manage Third Party Risks. Financial organizations can identify and mitigate vendor compliance risk when they establish a third-party risk management program. Companies should include monitoring the activities of third parties, limiting their access to critical data, and requiring subcontractors to comply with the cybersecurity standards and regulations of your organization.
4. Control Access to Valuable Data. Consider restricting broad access to critical assets by implementing privileged access management (PAM) solutions in addition to enforcing multi-factor authentication (MFA).
5. Build an Incident Response Plan.  In addition to the cybersecurity plan, all financial institutions should have a detailed incident response plan. Besides outlining the timeline and actions that should be taken in case of a cybersecurity incident, it should include how to restore data and communication protocols.

SOL-IS Technology Solutions provides organizations in the financial industry with the technology and tools necessary for ensuring cybersecurity compliance.  Our data protection capabilities help mitigate risk of a cyber incident while meeting the requirements of international standards and legal regulations.