FINRA Cybersecurity

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-08-25 FINRA published Cybersecurity Effective Practices
2. 2026-06-03 Compliance date of the amended SEC Regulation S-P for smaller entities
3. 2025-12-03 Compliance date of the amended SEC Regulation S-P for larger entities
4. 2024-08-02 SEC amendments to Regulation S-P took effect

1. 2026-08-25
   Cybersecurity Effective Practices (August 2026) Major versionCurrent

   FINRA published a framework of 12 cybersecurity principles and effective practices informed by member firms' regulatory obligations and its oversight observations. source

   More

   • The practices are scalable to firms of all sizes and adaptable to their risk profile, business model and technology.
   • The framework creates no new legal or regulatory requirements or interpretations.

Applies to FINRA member firms through existing FINRA and SEC rules that FINRA reads as cybersecurity obligations.

FINRA rules

FINRA lists Rules 1220(b)(3), 2010, 3110, 3120, 3310, 4370 and 4530 as related to cybersecurity. source

SEC rules

FINRA also lists Regulation S-ID, Regulation S-P, Exchange Act Rule 17a-4(f) and Regulation SCI, and shows the SEC's cybersecurity risk management rule for broker-dealers as pending. source

Supervision

Each member must maintain a supervisory system and written procedures reasonably designed to achieve compliance with securities laws and FINRA rules. source

Business continuity

Each member must keep a written business continuity plan for significant business disruptions and review it every year. source

Regulation S-P

The 2024 Regulation S-P amendments apply to larger entities from 3 December 2025 and to smaller entities from 3 June 2026. source

Incidents

FINRA tells firms hit by a disruptive attack or breach to report it immediately to their local FBI field office and their FINRA Risk Monitoring Analyst. source

FINRA evaluates each firm's cybersecurity risk management by reviewing its controls through member firm oversight.

Control reviews

FINRA reviews controls in governance, risk assessment, technical controls, access, incident response, vendor management, data loss prevention, change management, branches and training. source

Guidance status

The Effective Practices framework creates no new requirements; firms may use it to build practices reasonably designed to comply with existing obligations. source

Exercises

FINRA hosts cyber workshops and tabletop exercises to help member firms strengthen their cyber readiness. source

FINRA disciplines members and associated persons for rule violations, with sanctions from censure and fines to expulsion and bars.

Sanctions

FINRA may censure, fine, suspend, expel or bar a member or associated person, among other sanctions under Rule 8310. source

1. Guidance FINRA Cybersecurity key topic page
2. Guidance Cybersecurity Effective Practices (August 2026)
3. Law text FINRA Rule 3110 – Supervision
4. Law text FINRA Rule 4370 – Business Continuity Plans and Emergency Contact Information
5. Law text SEC Regulation S-P amendments (3 June 2024)

1. SEC Cybersecurity

   The SEC cyber disclosure rules apply to public companies; FINRA's cybersecurity expectations apply to member broker-dealers through supervision and other rules.

2. NYDFS Part 500

   NYDFS Part 500 is a prescriptive cybersecurity regulation for New York-licensed entities; FINRA works through general rules and guidance for broker-dealers.

3. FCRA / FACTA Red Flags

   FCRA and FACTA are the statutes behind identity theft red flags rules such as Regulation S-ID, one of the SEC rules FINRA lists for broker-dealers.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to FINRA Cybersecurity (RSS)