FINRA Broker-Dealer Cybersecurity Guidance Expert

FINRA Broker-Dealer Cybersecurity Guidance expert. Stub-depth framework plugin that routes to the SCF crosswalk. Level up by adding framework-specific context, assessment workflow, and evidence patterns.

FINRA Broker-Dealer Cybersecurity Guidance Expert

Stub-depth expertise for FINRA Cybersecurity Rules (builds on SEC Reg S-P and SEC 17a-4). This plugin is scaffolded from the SCF crosswalk (17 SCF controls map to 39 framework controls) and defers to /grc-engineer:gap-assessment for the actual compliance check.

Framework identity

  • SCF framework ID: usa-federal-sro-finra
  • Region: Americas
  • Country: US
  • Regulator: FINRA (Financial Industry Regulatory Authority)
  • Canonical source: FINRA cybersecurity guidance for broker-dealers

Scope and posture (placeholder — fill in when leveling up)

TODO: replace with framework-specific overview. Minimum sections for Reference-depth upgrade:

  • Territorial scope (who and where the framework applies)
  • Controlled-entity obligations (controller, processor, covered entity, etc.)
  • Mandatory timelines (breach notification, assessment cadence)
  • Regulator and enforcement mechanism
  • Interaction with other frameworks (adequacy decisions, mutual recognition)

Command routing

All commands in this plugin route through /grc-engineer:gap-assessment with framework ID usa-federal-sro-finra. Reference-depth plugins add:

  • evidence-checklist — framework-native evidence by control family
  • scope — applicability determination for the organization

Full-depth plugins add framework-specific workflow commands (examples in sibling plugins like soc2, fedramp-rev5, pci-dss).

Levelling up

See the Framework Plugin Guide for the Stub → Reference → Full progression checklist.

Added: September 23, 2026 · Last updated: September 24, 2026

View on GitHubDownload

Files (1)

Jurisdiction
🇺🇸 United States
Browse legal databases
Practice area
Securities
License
MIT
Author
GRCEngClub
Source
us/securities/skills/us-finra-expert

Test FINRA Broker-Dealer Cybersecurity Guidance Expert

Ask a legal question — get an answer generated live from this skill’s instructions.

Sign in to test this skill.

Related skills

Annual Meeting Proxy Statement

Apache-2.0United StatesSecurities

Drafts a SEC Regulation 14A / Rule 14a-3 compliant annual meeting proxy statement (DEF 14A) covering notice, governance, executive compensation, related-party transactions, shareholder proposals, and voting procedures. Use when preparing proxy materials, annual meeting notices, or shareholder vote disclosures. Trigger: proxy statement, DEF 14A, annual meeting, proxy solicitation, say-on-pay, auditor ratification, Regulation 14A, Rule 14a-3.

Apply Say-on-Pay Governance

MITUnited StatesSecurities

Use when a public company is designing executive compensation and preparing for the required periodic shareholder advisory vote on that compensation — structuring pay to demonstrate a genuine link between compensation and company performance, and responding substantively if the advisory vote result is weak, rather than treating the vote as a formality unconnected to actual pay decisions.

Broker-Dealer Customer Agreement

Apache-2.0United StatesSecurities

Drafts SEC/FINRA-compliant Broker-Dealer Customer Agreements covering account opening, trading, margin, fees, risk disclosures, privacy, arbitration, and execution. Use when drafting or updating customer account agreements, brokerage agreements, or customer documentation for registered broker-dealers.

Client Disclosures

MITUnited StatesSecurities

Guide which client disclosure documents must exist, what each must contain, and when and how they must be delivered to clients of investment advisers and broker-dealers. Use when the user asks about Form ADV Part 2A or 2B content, Form CRS content and delivery, prospectus delivery obligations, privacy notice delivery, trade confirmation timing, account statement distribution, electronic vs paper delivery compliance, or the content and client-delivery side of the annual brochure update. Also trigger when users mention 'onboarding document checklist', 'what disclosures do we owe new clients', 'brochure supplement for a new adviser', or 'CRS conversation starters'. (For filing mechanics and regulatory deadlines — IARD amendments, Form PF, 13F — use regulatory-reporting; for whether fee disclosure content is adequate, use fee-disclosure.)

Design Audit Committee Charter

MITUnited StatesSecurities

Use when establishing or reviewing a public company's audit committee — setting the committee's composition requirements (full independence, at least one financial expert), its specific oversight responsibilities over financial reporting and the external auditor, and documenting these in a formal charter, rather than treating audit oversight as an informal extension of general board duties.

Design Compensation Clawback Policy

MITUnited StatesSecurities

Use when a public company is establishing the mandatory policy for recovering erroneously awarded incentive-based executive compensation following an accounting restatement — applying the recovery requirement without regard to individual executive fault, and disclosing the policy and any recovery actions per SEC and exchange listing requirements, rather than treating clawback as a discretionary or fault-based decision.

FINRA Broker-Dealer Cybersecurity Guidance Expert · ThomasMore AI