IT Support for Financial Firms That Clients Trust With Everything

More than one rulebook. Depending on your firm, the FTC, the SEC, FINRA or New York’s DFS may have something to say about your security.

Fake wire and transfer requests. Criminals impersonate clients and send urgent requests to move money.

Vendor oversight. Custodians, CRMs, portals and IT providers all handle client data, and the rules expect you to keep an eye on them.

Written everything. Programs, risk assessments, incident response plans and annual reports all need to exist on paper and match reality.

Exam and audit questions. When a regulator or auditor asks how your systems are protected, you want a clear answer.

We keep your systems running. Ongoing care for computers, network and email, with a real person to call.

We put the technical safeguards in place. MFA, encryption, backups, updates and monitoring.

We can serve as your Qualified Individual. For firms under the FTC Safeguards Rule, Technology Visionaries can take on the Qualified Individual role, with a senior person at your firm supervising.

We help you write it down. Documentation of how your systems are set up and protected, to support your written program.

We help your team spot fraud. Training on phishing and a call-back habit for any money movement request.

This section is a plain English overview to help you understand what the rules ask for. It isn’t legal advice. For questions about what applies to your firm, talk with your attorney. Our role is to help you meet these requirements on the technology side and document the work. The responsibility for your program stays with your firm, and we don’t promise or guarantee compliance.

The FTC Safeguards Rule (16 CFR Part 314)

The FTC (Federal Trade Commission) Safeguards Rule comes from the Gramm-Leach-Bliley Act and applies to “financial institutions” under the FTC’s jurisdiction. That definition is broader than it sounds and can include businesses like mortgage brokers, lenders, finance companies and non-bank financial advisors. Firms overseen by other regulators, like the SEC, follow their own versions of these rules, so it’s worth confirming which regulator applies to you.

What it asks for, in plain terms: a Qualified Individual who oversees your security program, a written information security program, a written risk assessment, MFA (multifactor authentication) for anyone accessing customer information, encryption of customer information when stored and when sent over outside networks, staff training, oversight of your service providers, a written incident response plan, and notice to the FTC within 30 days of discovering a “notification event” involving the unencrypted information of at least 500 consumers. The FTC notes that some provisions don’t apply to institutions that keep information on fewer than 5,000 consumers.

The Qualified Individual can be a service provider. If it is, the FTC says the responsibility still stays with your firm, and a senior person at your firm has to supervise them.

SEC Regulation S-P (for SEC-registered firms)

If your firm is an SEC-registered investment adviser or broker-dealer, Regulation S-P is your version of these rules. The SEC amended it in 2024. Among other things, firms now need written incident response procedures, oversight of service providers, and notice to affected customers as soon as practicable and no later than 30 days after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed without authorization. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026.

FINRA

FINRA member firms can find cybersecurity guidance and resources on FINRA’s cybersecurity page.

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

If your firm is licensed or registered by the New York State Department of Financial Services (NYDFS), Part 500 likely applies, even if your office is in New Jersey. Many New Jersey insurance agents and financial firms hold New York licenses. In plain terms, it asks for a written cybersecurity program and policies, a risk assessment, MFA, a plan for responding to incidents, and notice to NYDFS within 72 hours of certain cybersecurity events. Each year, by April 15, covered entities file a certification of compliance or an acknowledgment of noncompliance. As of November 1, 2025, MFA is generally required for all access to information systems. Smaller firms may qualify for a limited exemption under section 500.19, which reduces some requirements but not all of them.

New Jersey’s data breach law (N.J.S.A. 56:8-161 to 56:8-166)

New Jersey’s Identity Theft Prevention Act covers any business that does business in New Jersey, and any public entity, that keeps computerized records with personal information. If there’s a breach of New Jersey residents’ personal information, you have to tell the affected people in the most expedient time possible and without unreasonable delay. Before you tell them, the law says you must report the breach to the New Jersey State Police. The State Police and the NJCCIC (New Jersey Cybersecurity and Communications Integration Cell) provide an online form for that report. If you decide misuse of the information isn’t reasonably possible, the law says to document that decision in writing and keep it for five years.

Wire fraud and business email compromise

This isn’t a regulation, but it’s the risk we hear about most. The FBI calls it business email compromise: a criminal gets into, or imitates, an email account and sends convincing payment instructions. The FBI asks victims to report it right away at ic3.gov (the Internet Crime Complaint Center) and to contact their bank to try to stop the transfer. The simplest protection is a habit: confirm any new or changed payment instructions with a phone call to a number you already have, never one from the email.