Managed IT services for financial advisors start with a map, not a product. Wealth management firms hold some of the most useful information a criminal could want: names, dates of birth, account numbers, tax returns and the signed authority to move money. Most of the risk isn’t in the custodian’s systems. It’s in the copies that collect around your own.
Follow one client’s paperwork
When a new client signs on, their details flow through a short, tidy path: form, CRM, custodian, planning software. Then the copies start.
An emailed form stays in the sent folder. A statement PDF stays in Downloads. A photo of an ID stays on a phone. None of this is careless in the moment, and all of it is exposure. We start by inventorying where client data actually sits, then set up the one place it should live and make the other places hard to use.
What the SEC now expects
In 2024 the SEC adopted amendments to Regulation S-P, which covers customer information held by institutions including registered investment advisers. Its announcement says covered institutions must maintain written policies and procedures for an incident response program designed to detect, respond to and recover from unauthorized access to customer information. It also requires notifying affected individuals as soon as practicable, and no later than 30 days after becoming aware of an incident, with certain limited exceptions. Compliance dates are phased in by firm size. We explain what this asks of the technology. Your compliance counsel decides how it applies to you, and we never certify a firm.
What the IT side of a plan includes
- Detecting. Alerts for unusual sign-ins to email, the CRM and the portal, and someone who sees them.
- Containing. The ability to lock an account or a laptop in minutes.
- Scoping. Logs and records that show what a given account could reach.
- Restoring. Tested backups, so recovery doesn’t depend on guessing.
The software a firm runs
| Category | Holds | Typical risk |
|---|---|---|
| Custodian or brokerage portal | Accounts, positions, transfers | Shared logins in a busy office |
| CRM | Contact details, notes, household data | Everyone sees everything |
| Planning and reporting | Plans, projections, statements | Reports saved to local folders |
| E-signature and forms | Applications, advisory agreements | Completed copies emailed around |
| Email and archive | Client correspondence | Personal phones on the account |
A quarterly access review
Access in an advisory firm drifts. A paraplanner covers for someone and keeps the permission. An assistant leaves and the shared login stays. Once a quarter, put the people who know the firm in a room with a list and go through it.
- List every system that holds client information, including portals.
- List who has access to each, by name.
- Ask one question per line: does this person still need it?
- Remove what isn’t needed the same day, and write down what changed.
- Check the unusual ones. Shared mailboxes, admin accounts and anything set up by a former employee.
Working from home and on the road
Advisors meet clients at kitchen tables and in coffee shops. The practical rules are short: devices encrypted and locked, client documents opened from the firm’s storage and not downloaded to a personal machine, and no client details on public Wi-Fi without a protected connection. Meeting-tool recordings and notes need a home too, so they don’t pile up in personal accounts.
Departures and new hires
Advisors move between firms, and clients sometimes follow them. When someone leaves, their custodian access, CRM access, email and devices need closing the same day, in a fixed order. When someone joins, they get access to their own book, and nothing more.
What we need from you
- Your system list, including portals and who holds each login.
- Your devices, firm-owned and personal.
- Your current written policies, if you have them.
- Your counsel’s contact, so the technical and legal sides can talk.
Monthly care covers access controls, backups and updates. The free IT check ends in a plan and a fixed quote.
A firm’s biggest data risk is rarely the vault. It’s the pile of copies around the vault that nobody has counted.