FCG 5.2 Themes

The guidance in FCG 2.2.1G on governance in relation to financial crime also applies to data security.

Firms should be alert to the financial crime risks associated with holding customer data and have written data security policies and procedures which are proportionate, accurate, up to date and relevant to the day-to-day work of staff.

Self-assessment questions:

1. • How is responsibility for data security apportioned?
2. • Has the firm ever lost customer data? If so, what remedial actions did it take? Did it contact customers? Did it review its systems?
3. • How does the firm monitor that suppliers of outsourced services treat customer data appropriately?

4. • Are data security standards set in outsourcing agreements, with suppliers’ performance subject to monitoring?

   Examples of good practice		Examples of poor practice
   •	There is a clear figurehead championing the issue of data security.	•	The firm does not contact customers after their data is lost or compromised.
   •	Work, including by internal audit and compliance, is coordinated across the firm, with compliance, audit, HR, security and IT all playing a role.	•	Data security is treated as an IT or privacy issue, without also recognising the financial crime risk.
   •	A firm’s plans to respond to data loss incidents are clear and include notifying customers affected by data loss and offering advice to those customers about protective measures.	•	A ‘blame culture’ discourages staff from reporting data losses.
   •	A firm monitors accounts following a data loss to spot unusual transactions.	•	The firm is unsure how its third parties, such as suppliers, protect customer data.
   •	The firm looks at outsourcers’ data security practices before doing business, and monitors compliance.

We expect firms to put in place systems and controls to minimise the risk that their operation and information assets might be exploited by thieves and fraudsters. Internal procedures such as IT controls and physical security measures should be designed to protect against unauthorised access to customer data.

Firms should note that we support the Information Commissioner’s position that it is not appropriate for customer data to be taken off-site on laptops or other portable devices which are not encrypted.

Self-assessment questions:

1. • Is your firm’s customer data taken off-site, whether by staff (sales people, those working from home) or third parties (suppliers, consultants, IT contractors etc)?
2. • If so, what levels of security exist? (For example, does the firm require automatic encryption of laptops that leave the premises, or measures to ensure no sensitive data is taken off-site? If customer data is transferred electronically, does the firm use secure internet links?)
3. • How does the firm keep track of its digital assets?
4. • How does it dispose of documents, computers, and imaging equipment such as photocopiers that retain records of copies? Are accredited suppliers used to, for example, destroy documents and hard disks? How does the firm satisfy itself that data is disposed of competently?
5. • How are access to the premises and sensitive areas of the business controlled?
6. • When are staff access rights reviewed? (It is good practice to review them at least on recruitment, when staff change roles, and when they leave the firm.)
7. • Is there enhanced vetting of staff with access to lots of data?
8. • How are staff made aware of data security risks?

Self-assessment questions:

1. • Are critical systems and data backed up, and do you test backup recovery processes regularly?
2. • Are you able to restore services in the event of an incident?
3. • Are network and computer security systems, software and applications kept up to date and regularly patched? Do you make sure your computer network and information systems are configured to prevent unauthorised access?
4. • How do you manage user and device credentials? Do you ensure that staff use strong passwords when logging on to hardware and software? Are the default administrator credentials for all devices changed?
5. • Is two-factor authentication used where the confidentiality of the data is most crucial?
6. • How do you protect sensitive data that is stored or in transit? Do you use encryption software to protect your critical information from unauthorised access?