The FISMA Focus IPD

New guidance from the Commodity Futures Trading Commission outlines the data security practices it expects from firms it oversees and the third parties they contract with. The staff advisory, from the Division of Swap Dealer and Intermediary Oversight, outlines data privacy security safeguards for futures commission merchants, commodity trading advisers, commodity pool operators, introducing brokers, retail foreign exchange dealers, swap dealers, and major swap participants.

Each covered entity should develop, implement and maintain a written information security and privacy program that is appropriate to its size and complexity, and the nature and scope of its activities, the guidance says. Specific requirements for firms include:

• Designating a specific employee with privacy and security management oversight responsibilities who is tasked with developing strategic organizational plans for implementing required controls. This person should be part of, or report directly to, senior management or the board of directors, and designate employees to coordinate, implement, and regularly assess the effectiveness of the data security program.