News

NFA Provides Cybersecurity Guidance

December 4, 2015

The Commodity Futures Trading Commission (the “CFTC”) recently approved an Interpretive Notice by the National Futures Association (“NFA”) entitled NFA Compliance Rules 2-9, 2-36 and 2-49: Information Systems Security Programs (the “Interpretive Notice”). [1]   The Interpretive Notice will become effective on March 1, 2016 and applies to all NFA membership categories (“Members”), including commodity pool operators (“CPOs”) and commodity trading advisors (“CTAs”).   

• Security and Risk Analysis: Members should:

• maintain an inventory of (i) critical information technology hardware with network connectivity, data transmission or data storage capability and (ii) critical software with applicable versions; 
• (i) identify the significant internal and external threats and vulnerabilities to at-risk data that is collected, maintained and disseminated; (ii) assess the threats to and the vulnerability of their electronic infrastructure; (iii) assess the threats posed through any applicable third-party service providers or software; and (iv) know the devices connected to their network and network structure; and
• estimate the severity of the potential threats, perform a vulnerability analysis, and decide how to manage the risks of these threats.

• Safeguards Against Identified Risks and Vulnerabilities: Members should:

• document and describe the safeguards deployed in light of identified and prioritized threats and vulnerabilities; and

• document and implement reasonable procedures to detect potential threats. 

• Response and Recovery Plan: Members should: 

• create an incident response plan to provide a framework to manage detected security events or incidents, analyze their potential impact and take appropriate measures to contain and mitigate their threat; and

• adopt and implement procedures to restore compromised systems and data, communicate with appropriate stakeholders and regulatory authorities and incorporate lessons learned into the ISSP.

• Employee Training: ISSPs should contain a description of the Member’s ongoing education and training relating to information security. 

• Third-Party Service Providers: ISSPs should address risks posed by, and perform due diligence on, critical third-party service providers.  Members should refrain from using third-parties with lesser security standards.

Finn Dixon & Herling LLP is a law firm with extensive experience providing corporate, transactional, investment management, securities, tax, executive compensation, bankruptcy and litigation counsel. Our clients include large and small corporations, venture capital and private equity firms, financial institutions, hedge funds and other investment funds, investment advisers, broker-dealers, public and private businesses, executives, management teams and entrepreneurs.

Copyright © 2015 Finn Dixon & Herling LLP. All Rights Reserved. These materials may not be reproduced or disseminated in any form without the express permission of Finn Dixon & Herling LLP. These materials are intended to inform our clients and friends about developments in the law. They are not intended to constitute a legal opinion or advice or to address any client’s legal problems or specific situations. The format of these materials, and the complex nature of the subject matter, required the making of general statements that summarize an extremely complex body of law and that may be incomplete in some respects. Accordingly, the reader is cautioned against using any of this material in specific situations without obtaining the advice of competent counsel. In light of the foregoing, and the general nature of these materials, these materials should not be regarded, or relied upon, as legal advice.