Specialist financial technology company Hatstand has issued a White Paper around regulators in the financial services world increasing their focus on cyber security and the need for businesses operating in this sector to view this as part of the overall enterprise risk management of a company.
The White Paper discusses how performing a risk assessment can help a business deliver clarity, not only to the regulators, but also to the key stakeholders of its key assets concerning current status and gaps in controls and processes. A baseline assessment can then be used to evolve a Working Plan designed to mitigate the gaps and demonstrate to the regulators and stakeholders that the business is taking its cyber risk management responsibilities extremely seriously.
Cyber security is, of course, a key concern for our senior political leaders, regulators and industry professionals. However, keeping business and client data secure can be a challenge as it crosses global networks, computing and PDA devices.
Many industry experts predict that it’s not a matter of ‘If’ but ‘When’ a company will experience a cyber security breach. Indeed, it has been reported that the number of cyber security attacks increased by over 50% in 2014 when compared with the statistics recorded for the previous year.
The Security and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) have made cyber security preparedness a top priority for their 2015 member firm examinations. Furthermore, the Commodity Futures Trading Commission (CFTC) is weighing in to the debate as indicated by the recent remarks made by its chairman, Timothy Massad, who said: “Cyber security is the most important single issue facing our markets today in terms of market integrity and financial stability.”
Policies and guidelines
More countries are taking the initiative to educate their ‘net’ citizens and are creating policies and guidelines for firms and individuals to create awareness of such crimes. In Europe, the EU is putting together a Cyber Security Directive that’s planned to apply to all business sectors. Although some of the EU regulations recently passed or currently under consultation have some cyber security elements, nothing has been specifically aimed at the financial services sector.
With cyber security directly affecting clients, data, networks, hardware, software and operations, the need to protect them from theft, business disruption and destruction is paramount.
Hatstand’s White Paper evaluates why businesses need to have sound governance practices in place and recognise that cyber security is more than just an IT-related issue. It also examines how the threat of a cyber attack should be viewed as part of the overall enterprise risk management of the firm, with Board oversight and a proper risk framework covering identification, protection, detection, response and recovery.
Firms should be identifying their possible risks, assessing the likelihood of events occurring and preparing their response(s). Once armed with this information, they can then determine their risk tolerance and prioritise their cyber security counter-measures. This is an iterative process that needs to be continuously reviewed and updated as the environment is constantly changing.
*Download a full copy of Hatstand’s White Paper