For small to medium-sized financial services firms, navigating the extensive guidance from the Financial Conduct Authority (FCA) on cyber security can be daunting. These firms often lack substantial in-house cyber security teams but still need to ensure full compliance with all relevant regulations. Business’ often turn to adopting standards and certifications to solve these types of issues, as they demonstrate a commitment to industry best practices and external assessments. One common certification within the UK is Cyber Essentials.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme designed to help organisations protect themselves against common cyber threats. It provides a set of basic technical controls that organisations should implement to safeguard their IT systems. For example, Firewalls; Secure Configuration; Security Updates; User Access Controls; Malware Protection etc. There are two levels of certification:
- Cyber Essentials: This is a self-assessment option that helps organisations protect against a wide variety of the most common cyber-attacks.
- Cyber Essentials Plus: This level includes all the protections of Cyber Essentials but also involves a hands-on technical verification conducted by external experts.
What does FCA regulation expect when it comes to Cyber Security?
The FCA is very focused on ensuring regulated firms meet the highest possible standards, however, they don’t provide a detailed list of specific technical controls. They are more principal-based and focused on governance, policies and procedures. The bulk of this can be found in the FCA’s Systems and Controls (SYSC) requirements: https://www.handbook.fca.org.uk/handbook/SYSC/.
When it comes to cyber security, most of the relevant parts are within the Operational Resilience Section (15A). The FCA expects “A firm should establish and maintain appropriate systems and controls to manage its information security risks” and they refer to standards and a good way of achieving this saying “A firm should ensure the adequacy of the systems and controls used to protect the processing and security of its information, and should have regard to established security standards such as ISO17799 (Information Security Management).”
What doesn’t Cyber Essentials Plus cover?
Cyber Essentials Plus, provides good baseline security, however, the FCA is looking for a much more comprehensive approach, driven from the top down. We have identified the following additional controls:
Governance: Good governance ensures that cyber security is integrated into the organisation’s overall governance framework, promoting a culture of security and resilience. The board should understand their risks and have created roles and responsibilities across the business.
Risk Management: The FCA expects firms to have highly mature risk management systems and processes, which include information security risks. Firms should take a “risk-based" approach to their information security. Typically, this may include using an industry-standard risk methodology.
Operational Resilience: Operational resilience is the ability of firms to prevent, adapt and respond to, recover and learn from operational disruption, with a major focus on cyber security. Firms must be able to demonstrate that they have been through a “mapping exercise” for their important business services, including setting tolerance levels for failure scenarios.
Security Operations Centre (SOC): A SOC is a centralised team that monitors and responds to cyber threats 24/7. Using advanced tools and threat intelligence, the SOC detects, analyses, and mitigates security incidents to protect an organisation’s IT infrastructure and enhance its cybersecurity posture. The FCA would expect any established firm, to have this capability in place, typically using a specialist third-party provider.
Supplier Management: Supply Chain risk, and performance strong on-going oversight of suppliers is critical. The FCA expects that firms conduct this regularly and have appropriate alternatives and contingency in the event that suppliers, which have been deemed critical, fail.
Incident Management: The FCA expect firms to be ready for the inevitable scenario that they will suffer some form of a data breach, and have a well-rehearsed incident management plan to respond and recover in a known time frame. These incidents must also be reported to the FCA immediately when they occur.
Taking the right step forward
Overall, while Cyber Essentials Plus alone may not fully satisfy all FCA compliance requirements, it is a strong step towards meeting the necessary cybersecurity standards and foundation, demonstrating a commitment to protecting sensitive data and systems.
