FINRA does not publish a single cybersecurity rule the way the SEC publishes Reg S-P. Instead, the expectations live across the supervision rule, the books-and-records rule, and a growing body of regulatory notices — most recently Notice 22-29 on cybersecurity practices. For a broker-dealer, that distributed framework creates a practical problem: there is no checklist to work through. The controls have to be built across your IT stack, your supervision program, and your records retention practice simultaneously.
Below is the working map we use when we onboard a new broker-dealer and audit the existing program. It treats FINRA cybersecurity as the intersection of three operational streams rather than a standalone compliance project.
Rule 3110: Supervision Is Cybersecurity
FINRA Rule 3110 requires every member firm to establish a supervisory system for the activities of its associated persons. Nothing in that sentence mentions cybersecurity — and yet supervision has become one of the most heavily examined cybersecurity obligations in the FINRA rulebook. The connection runs through electronic communications. Every email, Teams message, Bloomberg chat, compliant SMS, and approved social post by a registered rep falls inside the supervision perimeter. The technology that captures and reviews those communications is therefore a cybersecurity control in addition to a supervisory one.
Three technical capabilities tend to separate compliant firms from deficient ones. First, complete channel coverage — every approved communication mechanism is captured into a single archive with unified search. Firms fail here when they have WhatsApp or iMessage in active use by reps without capture, or when a recent platform migration left a gap in historical data. Second, a supervisory review workflow that is actually used. Alerts route to named principals, each flag has a disposition with a rationale, and the full review trail is audit-ready. Third, the controls that prevent off-channel communications in the first place — mobile device management policies, application allowlists on company devices, and a documented written policy with signed attestations from every rep.
The off-channel enforcement wave that started in 2021 has produced more than $2 billion in fines across the industry. The violations in those settlements were not complex hacks. They were firm-approved devices with unapproved apps, or personal phones used for business communications with no capture in place. The fix is operational, not strategic, but it requires commitment at the leadership level.
Rule 4511 and SEC 17a-4: The Records Layer
Rule 4511 ties FINRA member firms back into the SEC's 17a-4 recordkeeping framework. Under 17a-4(f), certain electronic records must be preserved in a non-rewriteable, non-erasable format — the WORM standard. Communications fall into that bucket, which means your archive has to satisfy a specific set of technical attestations beyond just "data is stored somewhere."
Modern cloud archives can satisfy WORM through object-lock or immutability features, but the control only holds up if the full set of requirements is in place: the records are indexed and searchable, retention is enforced by the system rather than by policy alone, there is a third-party downloader letter on file identifying a party who can produce records if the archive vendor becomes unavailable, and a serialized audit trail proves that the recording process itself has not been tampered with. A large portion of the deficiency letters we see in this area come from firms that have cloud storage but have never completed the attestation paperwork.
Retention schedules need to match the rule-prescribed periods by record class. Communications generally sit at three years with the first two accessible, but other record types — customer account records, order tickets, trial balances — run longer. A firm with a single blanket retention policy is almost certainly over-retaining some records (expensive) and under-retaining others (illegal). The remediation is a classified retention schedule driven by record metadata, not by storage location.
Regulatory Notice 22-29 and the Cyber Hygiene Baseline
Notice 22-29 is FINRA's most comprehensive cybersecurity guidance to date. It is not a rule, but examiners reference it routinely, and the practices it describes have effectively become the minimum bar for what a reasonable firm does. The notice covers identity and access management, endpoint protection, incident response, branch office security, vendor management, and customer authentication.
The specific controls the notice calls out overlap substantially with the cyber-insurance questionnaire most firms are already filling out annually: multi-factor authentication on every remote access path and every privileged account, endpoint detection and response with monitored response, email security with impersonation and business email compromise protections, offline or immutable backups tested within the past twelve months, a formal incident response plan exercised at least annually, privileged access management separate from day-to-day administrative accounts, and comprehensive logging with at least a year of retention.
Branch offices get particular attention. FINRA has observed recurring deficiencies at branch level — unmanaged devices, inconsistent patching, shared accounts, and weak local controls — and the notice emphasizes that a firm's cybersecurity program has to reach every branch and every registered rep, not just the main office. For firms with a geographically distributed presence, this often translates into a centralized MDM deployment, standardized endpoint baseline, and a remote support infrastructure that can reach every device regardless of location.
Customer Authentication and the Social Engineering Threat
One of the most operationally important sections of Notice 22-29 covers customer authentication. FINRA has tracked a sharp rise in fraudulent account takeover attempts executed through social engineering — an attacker calls the firm impersonating a customer, provides enough personal information to seem credible, and requests a wire, an address change, or a beneficiary update. The notice calls on firms to implement layered authentication for sensitive customer requests, including callback verification to numbers of record, step-up authentication inside the client portal, and staff training to recognize the common social engineering patterns.
The technical piece here is client portal security. Phishing-resistant MFA, session logging, anomaly detection on login behavior, step-up challenges for wire instructions and beneficiary changes, and out-of-band confirmation for high-risk actions all reduce the set of scenarios where a compromised credential leads to a loss event. The operational piece is staff training and written procedure — what a rep does when a caller provides the right information but something about the request feels wrong.
The Annual Compliance Review Ties It Together
FINRA Rule 3120 requires an annual report on the firm's supervisory controls. Rule 206(4)-7 requires a similar annual review of policies and procedures for advisers. In both cases, cybersecurity belongs in the annual review. That means your CCO should be seeing evidence from your supervision system, your archive, your endpoint platform, your identity provider, and your MSP — in a format that can be synthesized into the annual report and defended in an exam.
The firms that treat cybersecurity as a collection of technical controls tend to struggle with this synthesis. The firms that treat it as a supervision discipline, where every control produces evidence that flows into the compliance program, tend to pass exams cleanly. The distinction is organizational as much as technical.
Where Techvera Fits In
Our financial services practice runs the full stack a broker-dealer needs to satisfy the FINRA cybersecurity framework — supervision tooling, WORM-compliant archiving, managed detection and response, identity and endpoint management, and the annual reporting evidence packages. We have sat next to CCOs during routine FINRA examinations and post-incident cause exams, and we produce deliverables in the format examiners expect.
If your firm is preparing for an examination or assessing gaps against Notice 22-29, a structured review typically runs three to four weeks and produces a prioritized remediation roadmap. Schedule a consultation to discuss the current state of your program.
About the Author
Team Techvera
Techvera Team
Articles written collaboratively by the Techvera team, combining expertise across cybersecurity, managed services, and digital transformation.