FCG 5.2 Themes

1The guidance in FCG 2.2.1G on governance in relation to financial crime also applies to data security.

Firms should be alert to the financial crime risks associated with holding customer data and have written data security policies and procedures which are proportionate, accurate, up to date and relevant to the day-to-day work of staff.

Self-assessment questions:

1. • How is responsibility for data security apportioned?

2. • Has the firm ever lost customer data? If so, what remedial actions did it take? Did it contact customers? Did it review its systems?

3. • How does the firm monitor that suppliers of outsourced services treat customer data appropriately?

4. • Are data security standards set in outsourcing agreements, with suppliers’ performance subject to monitoring?

   Examples of good practice		Examples of poor practice
   •	There is a clear figurehead championing the issue of data security.	•	The firm does not contact customers after their data is lost or compromised.
   •	Work, including by internal audit and compliance, is coordinated across the firm, with compliance, audit, HR, security and IT all playing a role.	•	Data security is treated as an IT or privacy issue, without also recognising the financial crime risk.
   •	A firm’s plans to respond to data loss incidents are clear and include notifying customers affected by data loss and offering advice to those customers about protective measures.	•	A ‘blame culture’ discourages staff from reporting data losses.
   •	A firm monitors accounts following a data loss to spot unusual transactions.	•	The firm is unsure how its third parties, such as suppliers, protect customer data.
   •	The firm looks at outsourcers’ data security practices before doing business, and monitors compliance.

1We expect firms to put in place systems and controls to minimise the risk that their operation and information assets might be exploited by thieves and fraudsters. Internal procedures such as IT controls and physical security measures should be designed to protect against unauthorised access to customer data.

Firms should note that we support the Information Commissioner’s position that it is not appropriate for customer data to be taken off-site on laptops or other portable devices which are not encrypted.

Self-assessment questions:

1. • Is your firm’s customer data taken off-site, whether by staff (sales people, those working from home) or third parties (suppliers, consultants, IT contractors etc)?

2. • If so, what levels of security exist? (For example, does the firm require automatic encryption of laptops that leave the premises, or measures to ensure no sensitive data is taken off-site? If customer data is transferred electronically, does the firm use secure internet links?)

3. • How does the firm keep track of its digital assets?

4. • How does it dispose of documents, computers, and imaging equipment such as photocopiers that retain records of copies? Are accredited suppliers used to, for example, destroy documents and hard disks? How does the firm satisfy itself that data is disposed of competently?

5. • How are access to the premises and sensitive areas of the business controlled?

6. • When are staff access rights reviewed? (It is good practice to review them at least on recruitment, when staff change roles, and when they leave the firm.)

7. • Is there enhanced vetting of staff with access to lots of data?

8. • How are staff made aware of data security risks?

Examples of good practice		Examples of poor practice
•	Access to sensitive areas (call centres, server rooms, filing rooms) is restricted.	•	Staff and third party suppliers can access data they do not need for their role.
•	The firm has individual user accounts for all systems containing customer data.	•	Files are not locked away.
•	The firm conducts risk-based, proactive monitoring to ensure employees’ access to customer data is for a genuine business reason.	•	Password standards are not robust and individuals share passwords.
•	IT equipment is disposed of responsibly, e.g. by using a contractor accredited by the British Security Industry Association.	•	The firm fails to monitor superusers or other staff with access to large amounts of customer data.
•	Customer data in electronic form (e.g. on USB sticks, CDs, hard disks etc) is always encrypted when taken off-site.	•	Computers are disposed of or transferred to new users without data being wiped.
•	The firm understands what checks are done by employment agencies it uses.	•	Staff working remotely do not dispose of customer data securely.
		•	Staff handling large volumes of data also have access to internet email.
		•	Managers assume staff understand data security risks and provide no training.
		•	Unencrypted electronic data is distributed by post or courier.

Self-assessment questions:

1. 2• Are critical systems and data backed up, and do you test backup recovery processes regularly?

2. • Are you able to restore services in the event of an incident?

3. • Are network and computer security systems, software and applications kept up to date and regularly patched? Do you make sure your computer network and information systems are configured to prevent unauthorised access?

4. • How do you manage user and device credentials? Do you ensure that staff use strong passwords when logging on to hardware and software? Are the default administrator credentials for all devices changed?

5. • Is two-factor authentication used where the confidentiality of the data is most crucial?

6. • How do you protect sensitive data that is stored or in transit? Do you use encryption software to protect your critical information from unauthorised access?

Examples of good practice		Examples of good practice
2		•	Using weak or easy to guess passwords or creating passwords from familiar details.
2•	The firm carries out regular vulnerability assessments and patching.	•	Poor physical management and/or control of devices.
2•	The firm carries out regular security testing.	•	Not setting out appropriate user privileges on access to resources on the firm’s network, data storages or applications.
2•	An application programming interface (API) allows different software to communicate with each other and has security measures in place.	•	Not encrypting data at storage or between networks.
2		•	Not updating devices, software and operating systems with the latest security patches.
2		•	Not properly vetting third-party systems and vendors.
2		•	Not employing multi-factor authentication for devices, systems and services.
2		•	Insufficient staff training around social engineering and vishing and phishing campaigns.
2•	The firm is able to restore systems following an incident and restorations are done in a timely manner.
2		•	Inadequate controls to revoke access for staff that leave the firm, the role or the department.