Cybersecurity Effective Practices
August 2026
This framework of 12 cybersecurity principles and effective practices is designed to help FINRA member firms strengthen their cybersecurity programs. The effective practices are informed by member firms’ regulatory obligations, industry risk principles and practices FINRA has observed through member firm oversight.
Each practice presented is scalable to firms of all sizes and adaptable based on a firm’s risk profile, business model and technology complexity. Implementing these practices can help mitigate the risks of unauthorized access to firm systems and customer information and firm system disruptions caused by threat actors or system failures.
This framework does not create new legal or regulatory requirements, or new interpretations of existing requirements, nor does it relieve members of any existing legal or regulatory obligations. Members may consider the information in this framework in developing new, or modifying existing, practices that are reasonably designed to achieve compliance with relevant regulatory obligations based on their size and business model.