Cybersecurity and compliance, built to be examined.
For financial institutions and the firms that serve them. Every finding cites its source.
Financial institutions, and the firms they rely on
Regulators examine financial institutions on their security programs, and those institutions must oversee the vendors that handle their customers' information. We work on both sides of that relationship.
Banks, credit unions, lenders, servicers and other regulated financial firms
Banks and credit unions, mortgage lenders and servicers, consumer finance companies, investment advisers, insurance agencies, payment and fintech firms, and other regulated financial businesses: chartered or licensed, examined by federal and state regulators, and reviewed by investors, warehouse lenders and institutional clients.
- Federal and state security obligations, with the rule behind each
- Examination, certification and board reporting on schedule
- Oversight of your own vendors, tiered and documented
Law firms, technology providers and other vendors
Financial institutions review the firms that handle their customers' data with the rigor their own regulators apply to them, and corporate, insurance and healthcare clients review their outside counsel the same way. Law firms in every practice area, title and settlement agents, technology and data providers, and field-services firms answer those reviews, and their place on the panel depends on the answers.
- Client questionnaires answered from a maintained file
- A security program sized to the firm and its duties
- Records ready for a client's risk team
It usually begins with a deadline
Most first conversations start with one of three situations.
An examination, audit or annual certification is approaching, and the records behind it are thin.
Someone will have to sign. They should have the evidence in hand when they do.
A regulator, investor, warehouse lender or institutional client has sent a security questionnaire with a short deadline.
These often run to a hundred questions or more, ask for policies by name, and decide whether a relationship continues.
The firm's obligations have grown faster than its staff.
A full-time chief information security officer costs more than $250,000 a year. Most firms of your size need the function without the salary.
Each conclusion can be traced to its source
Examiners and client risk teams want to see how an answer was reached. We keep the rule, the finding, the fix and the record together, so anyone reviewing the work can follow it from beginning to end.
The requirement
We start from the text itself: the federal rules that reach your firm, such as the Safeguards Rule (16 CFR 314), the data-security laws of the states where you operate, and the terms your regulators, investors and clients impose.
What applies to you
We determine which of those requirements reach your firm, based on how it actually operates.
The remedy
Each gap is closed with a policy, a control or a change to how vendors are managed, and linked to the finding it resolves.
The evidence
Each change leaves a dated record of what was done, by whom and when.
A small practice with a narrow focus
Led by a principal
A principal of the firm leads your engagement, attends your meetings, signs the findings and takes your calls. You will not be passed to a junior team.
Financial services, known well
We work with financial institutions and the firms that serve them. The rules, the examiners' expectations and the questionnaires that pass between them are familiar ground.
Records that hold up
Each finding cites the rule behind it, and each fix is documented. The file can go to an examiner, an auditor or a client's risk team without further preparation.
Responsibility for the result
We use good software where it helps. The deadlines, the evidence and the condition of your program remain our responsibility.
Documents written for the people who will check them
Each one is specific to your firm, dated and versioned, and ready to hand to an examiner, an auditor or a client's risk team.
Applicability and risk assessment
The requirements your firm is subject to under federal law, state law and client contracts, each with its source and your current position against it.
Risk register
Each open gap written as a risk with a recommended remedy, ready for your team to rate and assign.
Policy set
Policies written around your firm's operations and approved by your leadership.
Executive and board reporting
A clear account of where the firm stands, written for partners, directors and owners.
SOC 2 and NIST CSF 2.0 readiness
A measured view of how far you are from an audit, with an index of the evidence you already hold.
Compliance calendar
Certifications, reviews and vendor reassessments on a dated schedule. When a rule changes, we tell you what it means for your firm.
Three phases, each priced before it begins
We first establish exactly what applies to your firm. We then close the gaps and run the program on a fixed calendar.
- Assess. A fixed-fee assessment sets out your obligations and where you fall short, in about two weeks.
- Remediate. We write the policies, put the controls in place and bring your vendors under oversight, most urgent items first.
- Operate. We run the program throughout the year: monitoring, evidence, reporting and renewals.
Assess
Assessment, gap analysis and risk register.
Remediate
Policies, controls and vendor oversight.
Operate
The program, run throughout the year.
A clear answer, reviewed and signed by a principal
You tell us about your firm once, and we do the rest. A principal reviews and signs the result before it reaches you.
- A few hours of your team's time
- Each requirement named alongside its source, so the work can be checked
- Your SOC 2 and NIST CSF 2.0 positions drawn from the same review
Illustrative
What clients ask first
We already have an IT provider. Why would we need you?
Your IT provider keeps your systems running. Deciding what the regulations and your counterparties require, writing the policies an examiner reads first, and checking that your vendors meet the standard is a separate job, and your IT provider is one of the vendors that needs checking. We do that job and work alongside your IT provider throughout.
Would compliance software be enough?
Software is useful for collecting evidence, and we use it where it helps. It cannot decide which requirements apply to your firm, and it will not sit with you in front of an examiner or a client's risk team. Someone has to run the program. That is the role we take on.
How does this compare with hiring a security executive?
An experienced chief information security officer in financial services costs more than $250,000 a year before benefits, and is hard to find. We provide the same accountability through a principal who knows your sector, at a fraction of that cost.
What does an engagement involve?
There are three phases. The assessment takes about two weeks and produces your list of obligations, your gaps and a risk register. Remediation follows, with the most urgent items first. After that we run the program on an annual cycle. The full process is described here.
What does it cost?
The assessment is a fixed fee, quoted before work begins. Remediation is priced from what the assessment finds. The ongoing program is a monthly retainer set by the size and complexity of your firm. We discuss figures on the first call.
Begin with a conversation
Thirty minutes with the principal who would lead your engagement. We will tell you what we would look at first, and whether we are the right firm for the work.