February, 2016

 On October 23, 2015 the Commodity Futures Trading Commission (“CFTC”)approved National Futures Association’s (“NFA”) interpretive notice regarding cyber-security.  The notice is - Interpretive Notice to NFA Compliance Rules2-9, 2-36, and 2-49 titled Information Systems Security Programs.  The new guidance takes effect on March 1 st,  The Interpretive Notice applies to all NFA members and requires such members to adopt and enforce written cybersecurity policies and procedures. Integritas Financial Consulting2

 Each NFA member subject to the notice must adopt and enforce written cybersecurity policies.  Each NFA member must also implement proactive measures designed to secure customer data and access to electronic systems.  Policies and procedures should be tailored to the specific risks and activities of the member’s business. Integritas Financial Consulting3

Members should adopt and enforce a written information systems security program (“ISSP”) ISSP Must: Contain a Governance Framework Identify Security Risks Manage Security Risks Integritas Financial Consulting4

Members should adopt a risk based approach to the use and protection of IT systems Integritas Financial Consulting5 Security analysis should utilize a risk-based approach to the protection of IT systems Assess and prioritize internal threats Assess and Prioritize external threats Assess Data Vulnerability Assess infrastructure vulnerability Plan for addressing past security incidents Assess third- party vulnerability Plan for managing risks

 Members are expected to implement a number of fundamental safeguards that are appropriate in view of the member’s size, business and resources.  Safeguards should be in place in response to identified risks to client data and the member’s technology infrastructure. Integritas Financial Consulting6

Restrictions on physical accessTechnical access controlsComplex passwordsFirewall and anti-virus protectionApplication white listsTrusted software onlyMethodology for software updates/patchesEncryption at rest and in transitSecure software development lifcyscleWeb filteringSystem for managing mobile devices Integritas Financial Consulting7

Members should create an incident response plan The plan should identify all team members The plan should address and inventory different types of threats The plan should include a methodology for restoring compromised systems and/or data The plan should include escalation procedures The plan should include a methodology for communicating to clients, counter-parties and law enforcement Integritas Financial Consulting8

 Members should provide their employees with information security training: ◦ When on-boarding a new employee, and ◦ Periodically thereafter  Employee training should include: ◦ Social engineering tactics ◦ General technology threats ◦ System compromise and data loss mitigation  The ISSP should be regularly reviewed to assess effectiveness  Members must maintain all records concerning compliance, adoption and implementation of the ISSP Integritas Financial Consulting9

 NFA typically frames issues and their expectations of members as “guidance” as to what a member should do.  Adhering to the Interpretive Notice is one way that a member can fulfill its supervisory obligations under NFA Compliance Rules 2-9, 22-36, and  NFA also recognizes that alternative practices other than described in the Interpretive Notice may fulfill a member’s supervisory obligations.  However, it is likely that NFA will expect compliance with their guidance or members should be prepared to explain why alternative methodologies are sufficient. Integritas Financial Consulting10

 Integritas Financial Consulting can help: ◦ Create an ISSP based on your business and requirements ◦ Review current ISSP’s and provide commentary and gap analysis ◦ Draft policies and procedures ◦ Perform periodic testing to confirm compliance with the Interpretive Notice ◦ Structure and perform training Call us at for a free consultation. Integritas Financial Consulting11