{'fraction_non_alphanumeric': 0.025762980578676178, 'fraction_numerical': 0.0, 'mean_word_length': 5.607329842931938, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Cybersecurity and Financial Firms : Bracing for the Regulatory Onslaught

A cyber-crisis can strike a financial firm at any time. The loss of intellectual property and sensitive customer information, disruption of services, and headlines reporting the attack not only shake the confidence of any of a firm’s multiple constituencies— especially investors, shareholders, employees, partners and customers—but now more than ever, a cyber-crisis can also trigger the interest (and possibly the wrath) of the Office of Compliance, Inspections and Examinations (OCIE) of the Securities and Exchange Commission (SEC) and, for registered broker-dealers, the Financial Industry Regulatory Authority (FINRA) as well. Nowadays, when financial firms experience any form of data breach—from the loss or theft of laptops, backup tapes, or hard drives containing sensitive client or customer data, to the compromises of, or intrusions into, a firm’s servers, networks and other systems— financial regulators are going to come knocking (or even pounding) on the door. Regulators such as OCIE and FINRA will also want to know more than just what a firm is doing to detect the origin, nature and extent of the cyber-related incident and what sort of remediation the firm is undertaking; their examiners will also want to understand what sort of cybersecurity preparedness firms undertake to protect their networks and systems together with what plans, policies and procedures firms have established to thwart cyber-intrusions and attacks. A regulatory cyber-storm is clearly brewing and its onslaught will have a dramatic impact upon how financial firms build, manage and protect their information and trading systems, causing many to redouble their efforts toward enhancing their technological capabilities. Some financial firms may even have to invent a new type of information technology (IT) security department that includes the wherewithal and platforms to enable quick and nimble response to cyber-threats, and the ability to report in real-time a firm’s technologyrelated regulatory compliance, including producing cybersecurity infrastructure, planning and tactics as well as reporting instantaneously the frontline particulars of any actual cyber-incident response. Even more importantly, SEC and FINRA examination staff will seek to understand a firm’s cybersecurity methodologies (i.e. how firms combine both traditional investigative techniques with computer forensics and cyber-crime response to ascertain facts and conclusions