Cybersecurity Risk Alert – NFA

The National Futures Association (“NFA”) recently amended the NFA Compliance Rules 2-9, 2-36, and 2-49: Information Systems Security Programs. The amendments address three areas originally covered in the 2016 Interpretive Notice and go into effect on April 1, 2019. The amendments are as follows:

  • Cybersecurity Training
    • Previously, the NFA required employee cybersecurity training upon hire and periodically during employment. With the amendments, training will be required upon hire, at least annually, and more frequently if necessary (e.g. if the employee is the subject of a data breach or has displayed poor cybersecurity practices).
    • Amendments also require Member Firms to describe the topics covered during training in their information security policies.
  • Information Systems Security Program (“ISSP”) Approval
    • The NFA has determined that ISSP approval by an “executive level official” of a Member Firm is not uniformly understood. The language has been amended to require ISSP approval by the Member Firm’s “senior level officer with primary responsibility for information security or other senior official who is a listed principal and has the authority to supervise the Member’s execution of its ISSP.”
  • Notice Requirement
    • Currently, Member Firms are not required to notify the NFA of cybersecurity incidents. The amendments will now require Member Firms to notify the NFA of cybersecurity incident, if the incident results in the following:
      • A loss of customer or counterparty funds or loss of a Member Firm’s capital; or
      • Notification of an incident is reported to customers or counterparties pursuant to state or federal law.

For additional information, please visit: https://www.nfa.futures.org/news/newsNotice.asp?ArticleID=5085