To protect data assets and deliver the enterprise risk management that modern institutional investment requires, these 10 items should be top-of-mind:

1. Establish appropriate access rights

Access privileges should be clear, standardized, and managed intentionally. Privileges beyond the purview of an employee's function and responsibilities introduce risk. To benefit from collaboration without sacrificing security, you should put careful thought into how access rights will be granted and maintained.

2. Enforce proper authentication protocols

In order to help ensure that people are who they are, and that corporate access is up to date, there should be a strict user authentication process in place. In particular, two-factor authentication, strong passwords and single sign-on (SSO) are effective and best practices. These protocols are a crucial line of defense against malicious actors attempting to access sensitive data and unintentional delays in updating systems to reflect corporate changes.

3. Maintain an audit log

Even with the appropriate access rights and a robust authentication system, the accountability of knowing who did what, and when, is a valuable tool. Accidental changes, purposeful transmissions, and regular operating activities are all captured, thereby reducing moral hazard, enabling better identification, and improving remediation protocols.

4. Keep diligent records with a data retention policy

Whether you're subject to FINRA compliance or not, data storage is cheap and historical information can be very valuable in a variety of common situations. Create a data retention policy and enforce it or risk hefty fines, disciplinary actions, missed insights, and lost value.

5. Have a documented disaster recovery plan

Companies need to equip themselves with a recovery plan in the event of a data breach or critical data loss. To take a proactive stance, automated system availability, network monitoring, incident response protocols, and communication procedures should all be in place – well before they're needed.

6. Leverage redundancy in data centers

Distributed data centers across multiple regions allow firms to remain resilient in the face of system failures, natural disasters, or other worst-case-scenarios. By outsourcing to professionally maintained and distributed data centers, firms can protect their data without having to worry about the logistics, like system maintenance and compliance with location-specific requirements like the EU Data Privacy Directive.

7. Secure physical locations of data centers

As more companies move their data to the cloud, it's allowed us to take advantage of secure data centers rather than on-premise server rooms. The physical access to these data centers should be strictly controlled, with a professional security staff, video surveillance, and intrusion detection systems. Other considerations, like climate control and two-factor authentication for staff, should be accounted for as well.

8. Encrypt data at rest

Encrypting data at rest is a critical aspect of a comprehensive enterprise security strategy. A secure data storage provider should have SOC compliance and meet industry standards with 256-bit (bank grade) encryption.

9. Encrypt data in transit

Data being transmitted across the internet or a local network must also be encrypted at all times. Industry best practices recommend that all data in motion be encrypted via 256 bit (SHA2) TLS certificates and the connection itself should be encrypted via HTTPS, SSL or FTPS. In addition, companies should implement network security controls such as firewalls and endpoint solutions to protect data in motion from malware and exploit kits.

10. Conduct regular reviews of data services and security policies

Data services and security policies aren't meant to be static. They need to be reviewed, updated and modified as your company and its data evolve. A regular review of current procedures should be at the core of any sound information and data security strategy.