FINRA Compliance Checklist for Broker-Dealers

FINRA does not publish a single consolidated cybersecurity checklist, but its examination priorities letters, regulatory notices, and published guidance make clear what examiners expect to find. This checklist covers the core areas assessed during FINRA cybersecurity examinations.

Governance and Risk Management

Written cybersecurity policy approved by senior management addressing the firm’s approach to cyber risk
Designated cybersecurity responsible individual (CISO, CCO, or equivalent) accountable for the program
Annual cybersecurity risk assessment identifying threats, vulnerabilities, and the adequacy of existing controls
Board or senior management reporting on cybersecurity risk and program status at least annually
Cybersecurity integrated into Written Supervisory Procedures (WSPs)

Access Controls and Identity Management

Multi-factor authentication (MFA) required for all remote access and privileged account access
Least privilege access — employees access only the systems and data required for their role
Access reviews conducted quarterly — review and revoke access for terminated employees and changed roles
Privileged access management (PAM) for administrative and service accounts
Strong password policies enforced through technical controls, not just policy documents

Endpoint and Network Security

Endpoint Detection and Response (EDR) deployed on all firm devices (laptops, desktops, servers)
Patch management program — critical patches applied within 30 days, urgent patches within 7 days
Encryption of data at rest (full disk encryption on all devices) and in transit (TLS for all connections)
Email security including anti-phishing, anti-malware, and DMARC/SPF/DKIM authentication
Network segmentation separating customer-facing systems from internal administration
Firewall and intrusion detection with regular rule reviews

Vendor and Third-Party Risk

Vendor inventory listing all third-party providers with access to firm systems or customer data
Vendor due diligence conducted before onboarding and reviewed annually
Written contracts with vendors addressing data security, breach notification, and right to audit
Critical vendor risk assessments reviewed at least annually
Vendor access controls limiting third-party access to only required systems with MFA enforced

Business Continuity Planning (Rule 4370)

Written Business Continuity Plan (BCP) covering significant business disruptions
BCP tested annually with results documented
Data backup procedures with offsite or cloud-based backups verified regularly
Mission-critical systems identified with recovery time objectives (RTOs) defined
Customer communication plan for notifying customers during disruptions
BCP emergency contact information provided to FINRA and updated annually

Recordkeeping and Electronic Communications

Email and electronic communications archived per SEC Rule 17a-4 requirements (3 years minimum, 6 years for some records)
Communications surveillance program reviewing electronic communications for regulatory violations
Records stored in WORM (write-once, read-many) format or equivalent tamper-evident storage
Mobile device policy addressing firm-approved apps and personal device use for business communications

Incident Detection and Response

Security Information and Event Management (SIEM) or equivalent monitoring for suspicious activity
Written Incident Response Plan covering detection, containment, investigation, notification, and recovery
Incident response plan tested annually (tabletop exercise or live drill)
Customer notification procedures for breaches involving customer data (per applicable state breach notification laws)
FINRA notification procedures — know when and how to notify FINRA of a cybersecurity incident
Incident documentation maintained for all significant security events

Branch Office Security

Branch office cybersecurity controls consistent with home office standards
Remote and home office security assessments conducted
Branch supervision program including cybersecurity oversight of branch personnel

Examination Readiness

Cybersecurity documentation package maintained and updated continuously — not assembled only when an exam is scheduled
Evidence of control operation (logs, screenshots, reports) available for the prior 12 months
Response to prior examination findings fully implemented and documented
Staff trained on cybersecurity awareness annually with training records maintained

How Espresso Labs Handles This For You

Espresso Labs implements and continuously operates the technical controls on this checklist — EDR, MFA, encryption, patch management, SIEM, vendor oversight, and incident response — and maintains the documentation and evidence needed for FINRA examination. Your team gets examination-ready status year-round without managing the program internally.