FINRA Cybersecurity Guidance

Why does it matter?

FINRA examines every member firm, and its Regulatory Oversight Report names cybersecurity among the topics examiners review each cycle: technology governance, risk assessment, technical controls, access management, incident response, vendor management, data loss prevention, system change management, branch controls and staff training. The guidance tells a firm what FINRA expects to see behind the rules, and the Regulation S-P amendments adopted on May 16, 2024 turned several of those expectations, such as an incident response program and customer notification within 30 days, into binding obligations with compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

Key benefits include:

• One place to read FINRA's expectations

The August 2026 Cybersecurity Effective Practices framework gathers 12 principles, from Governance to Resilience and Recovery, each with practices FINRA says are scalable to firms of all sizes.

• A direct line to the binding rules

Each document ties its practices to Regulation S-P Rule 30(a), Regulation S-ID, FINRA Rules 3110 and 4370 and the Exchange Act recordkeeping rules 17a-3 and 17a-4, so a firm can show which obligation each control serves.

• Threats named each year

The 2026 Regulatory Oversight Report lists the threats FINRA observed, including ransomware and extortion, phishing, smishing and quishing, new account fraud, account takeovers, imposter sites, insider threats and GenAI-enabled fraud.

• Examination findings turned into practices

The 2018 report chose its five topics from the most frequent examination findings, and the Oversight Report pairs each threat with the effective practices FINRA saw at member firms, such as MFA for customer logins and tabletop exercises.

• Incident reporting pathways

FINRA's cybersecurity topic page asks firms to report a disruptive attack or breach to their local FBI field office and their FINRA Risk Monitoring Analyst, and notes that a Suspicious Activity Report may be required under FinCEN guidance.

How does it work?

The February 2015 Report on Cybersecurity Practices is a 46-page document organized into eight areas: governance and risk management for cybersecurity, cybersecurity risk assessment, technical controls, incident response planning, vendor management, staff training, cyber intelligence and information sharing, and cyber insurance. Appendix I summarizes its principles and effective practices and Appendix II maps them to the NIST Cybersecurity Framework. It states that it is not intended to express any legal position and does not create any new legal requirements, and the December 2018 Report on Selected Cybersecurity Practices repeats that disclaimer while adding guidance on branch office controls, phishing, insider threats, penetration testing programs and mobile devices.

The August 2026 Cybersecurity Effective Practices framework replaces neither report but is the current summary. Its 12 principles are Governance; Risk Management; Third-Party Risk Management; Asset Management; Access Control and Identity Management; Data Protection; Security Awareness and Training; Vulnerability and Patch Management; Security Monitoring; Threat Intelligence and Information Sharing; Incident Response and Reporting; and Resilience and Recovery. Its opening section, Select Regulatory Obligations, explains that Regulation S-P Rule 30(a) requires written safeguarding policies with a program to detect, respond to and recover from unauthorized access, procedures to notify affected individuals and oversight of service providers, and that Regulation S-ID requires a written identity theft program for covered accounts.

Firms then work through the rules the guidance points to. FINRA Rule 4370 requires a written business continuity plan that addresses ten elements, including data backup and recovery, mission critical systems, regulatory reporting and customer access to funds and securities, approved and reviewed annually by a senior management member who is a registered principal. FINRA Rule 3110 requires a supervisory system with written supervisory procedures, principal review of correspondence under 3110(b)(4) and internal inspections under 3110(c). The 2026 Regulatory Oversight Report, released on December 9, 2025, is the annual check: it lists the obligations, the threats FINRA observed and the effective practices examiners expect to find.

Key Elements

• Regulation S-P Rule 30 safeguards and incident response

Written administrative, technical and physical safeguards for customer information, an incident response program, customer notice as soon as practicable and no later than 30 days, and service provider oversight with 72-hour breach notice to the firm (SEC release 34-100155, effective August 2, 2024).

• Regulation S-ID identity theft program

A written program to detect, prevent and mitigate identity theft for covered accounts, named in both the 2026 framework and the Oversight Report.

• Rule 4370 business continuity plan

A written plan covering the ten required elements, updated after material changes, reviewed annually and disclosed to customers at account opening, with two emergency contact persons reported to FINRA.

• Rule 3110 supervision

A supervisory system and written supervisory procedures reasonably designed to achieve compliance, including review of electronic correspondence and inspection cycles for branch offices.

• The 12 effective-practice principles (August 2026)

Governance through Resilience and Recovery, each with practices such as a designated cybersecurity lead, MFA, logging appropriate to firm size and tabletop exercises.

• Annual threat and practice update

The Regulatory Oversight Report's cybersecurity section, which in the 2026 edition adds GenAI-enabled fraud and cybercrime-as-a-service to the observed threats and asks firms to evaluate their own and their vendors' GenAI use.

What does it cover?

The guidance applies to FINRA member firms, meaning registered broker-dealers of every size and business model, and reaches their branch offices, associated persons and the third-party vendors that hold firm or customer data. It covers the protection of customer information and firm systems against unauthorized access and disruption, the supervisory and continuity obligations in FINRA Rules 3110 and 4370, and the SEC rules FINRA examines for, Regulation S-P and Regulation S-ID. It does not apply to investment advisers or funds that are not FINRA members, although the same SEC rules reach them through the SEC's own examinations.

What are its objectives?

FINRA's cybersecurity guidance is written to help member firms do five things.

Build a cybersecurity program that is reasonably designed for the firm's size, business model and technology complexity.

Meet the safeguarding, incident response and notification obligations of Regulation S-P and the identity theft obligations of Regulation S-ID.

Supervise cybersecurity controls, including at branch offices and vendors, as part of the Rule 3110 supervisory system.

Prepare for disruption through a Rule 4370 business continuity plan that is tested and reviewed every year.

Keep pace with the threats FINRA observes each year, from account takeovers and imposter sites to GenAI-enabled fraud.

Framework in Context

The guidance sits between the SEC's rules and FINRA's examination program. Regulation S-P and Regulation S-ID are SEC rules; FINRA explains them and examines its members against them, and Regulatory Notices such as 21-18 (account takeovers), 21-42 (Log4Shell) and 22-29 (ransomware) carry interim warnings. The 2015 report mapped its practices to the NIST Cybersecurity Framework, and firms that also fall under the FTC Safeguards Rule, NYDFS 23 NYCRR 500 or the FFIEC IT Handbook reuse the same control evidence. Firms should read the current Regulatory Oversight Report each year, because the threats and practices it names change edition by edition.

Common Framework Mappings

Firms map FINRA's cybersecurity guidance to the frameworks below so that one control set answers FINRA examiners, SEC staff and the auditors who review the same safeguards under other regimes.

Mapped frameworks include:

EU DORA

FFIEC IT Handbook

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

NYDFS 23 NYCRR 500

SOC 2