CFTC Chairman Provides Guidance On Cybersecurity

On November 5, 2014, the Chairman of the Commodity Futures Trading Commission, Timothy G. Massad, gave keynote remarks at the Futures Industry Association Expo 2014.

Part of Chairman Massad's remarks focused on the importance and oversight of cybersecurity and business continuity disaster recovery for the financial institutions, exchanges, and markets that the Commission regulates. Specifically, Chairman Massad discussed the fact that the Commission's system safeguards require that the entities the Commission regulates have four important components:

A program of risk analysis and oversight to identify and minimize sources of cyber and operational risk; Automated systems that are reliable, secure, and have adequate scalable capacity; Emergency procedures, backup facilities, and a business continuity disaster recovery plan; and Regular, objective, independent testing to verify that the system safeguards program is sufficient to fulfill its regulatory responsibilities. In addition, Chairman Massad explained that the entities the Commission regulates must have a risk management program that addresses the following key elements: information security, systems development, quality assurance, and governance. Clearinghouses and exchanges must notify the Commission promptly of certain incidents and must have recovery procedures in place. For example, systematically important clearinghouses must be able to resume operations in two hours.

Finally, Chairman Massad provided guidance on the key areas that the Commission is focused on:

Governance - Is the board paying sufficient attention to cybersecurity and taking appropriate steps? Does the board have the expertise and does it devote the time to do so? Is it setting the right tone as to the importance of these issues? The same questions apply, needless to say, to top management. Resources - Are sufficient resources and capabilities being devoted to monitor and control...