FCG 5.2 Themes

1The guidance in FCG 2.2.1G on governance in relation to financial crime also applies to data security.

Firms should be alert to the financial crime risks associated with holding customer data and have written data security policies and procedures which are proportionate, accurate, up to date and relevant to the day-to-day work of staff.

Self-assessment questions:

1. • How is responsibility for data security apportioned?

2. • Has the firm ever lost customer data? If so, what remedial actions did it take? Did it contact customers? Did it review its systems?

3. • How does the firm monitor that suppliers of outsourced services treat customer data appropriately?

4. • Are data security standards set in outsourcing agreements, with suppliers’ performance subject to monitoring?

   Examples of good practice		Examples of poor practice
   •	There is a clear figurehead championing the issue of data security.	•	The firm does not contact customers after their data is lost or compromised.
   •	Work, including by internal audit and compliance, is coordinated across the firm, with compliance, audit, HR, security and IT all playing a role.	•	Data security is treated as an IT or privacy issue, without also recognising the financial crime risk.
   •	A firm’s plans to respond to data loss incidents are clear and include notifying customers affected by data loss and offering advice to those customers about protective measures.	•	A ‘blame culture’ discourages staff from reporting data losses.
   •	A firm monitors accounts following a data loss to spot unusual transactions.	•	The firm is unsure how its third parties, such as suppliers, protect customer data.
   •	The firm looks at outsourcers’ data security practices before doing business, and monitors compliance.

1We expect firms to put in place systems and controls to minimise the risk that their operation and information assets might be exploited by thieves and fraudsters. Internal procedures such as IT controls and physical security measures should be designed to protect against unauthorised access to customer data.

Firms should note that we support the Information Commissioner’s position that it is not appropriate for customer data to be taken off-site on laptops or other portable devices which are not encrypted.

Self-assessment questions:

1. • Is your firm’s customer data taken off-site, whether by staff (sales people, those working from home) or third parties (suppliers, consultants, IT contractors etc)?

2. • If so, what levels of security exist? (For example, does the firm require automatic encryption of laptops that leave the premises, or measures to ensure no sensitive data is taken off-site? If customer data is transferred electronically, does the firm use secure internet links?)

3. • How does the firm keep track of its digital assets?

4. • How does it dispose of documents, computers, and imaging equipment such as photocopiers that retain records of copies? Are accredited suppliers used to, for example, destroy documents and hard disks? How does the firm satisfy itself that data is disposed of competently?

5. • How are access to the premises and sensitive areas of the business controlled?

6. • When are staff access rights reviewed? (It is good practice to review them at least on recruitment, when staff change roles, and when they leave the firm.)

7. • Is there enhanced vetting of staff with access to lots of data?

8. • How are staff made aware of data security risks?

Examples of good practice		Examples of poor practice
•	Access to sensitive areas (call centres, server rooms, filing rooms) is restricted.	•	Staff and third party suppliers can access data they do not need for their role.
•	The firm has individual user accounts for all systems containing customer data.	•	Files are not locked away.
•	The firm conducts risk-based, proactive monitoring to ensure employees’ access to customer data is for a genuine business reason.	•	Password standards are not robust and individuals share passwords.
•	IT equipment is disposed of responsibly, e.g. by using a contractor accredited by the British Security Industry Association.	•	The firm fails to monitor superusers or other staff with access to large amounts of customer data.
•	Customer data in electronic form (e.g. on USB sticks, CDs, hard disks etc) is always encrypted when taken off-site.	•	Computers are disposed of or transferred to new users without data being wiped.
•	The firm understands what checks are done by employment agencies it uses.	•	Staff working remotely do not dispose of customer data securely.
		•	Staff handling large volumes of data also have access to internet email.
		•	Managers assume staff understand data security risks and provide no training.
		•	Unencrypted electronic data is distributed by post or courier.