Investment Advisers & Broker-Dealers

The amended Regulation S-P is the clearest example. Under the SEC's 2024 amendments, covered institutions must maintain written incident response policies and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. They must also oversee service providers, and their policies must require those providers to notify the institution as soon as possible, and no later than 72 hours, after becoming aware of a breach. Compliance was required by December 3, 2025 for larger entities (for example, advisers with $1.5 billion or more in assets under management) and by June 3, 2026 for smaller ones, so both dates have now passed.

Meeting those obligations depends on ordinary technical hygiene: knowing where customer data lives, who can reach it, how quickly an incident would be detected, and which vendors touch it. We help you build that picture, test the response plan and keep the evidence.

Investment businesses are also a field where our team has worked for years: it ran the New York trading and San Francisco venture offices of a major conglomerate and built the infrastructure of an angel investor through twelve years of growth. We know that an adviser's real exposure is often a laptop, a shared mailbox or a vendor portal rather than a server room.

The evidence file is the deliverable. For each control we help you keep a dated record: the policy, the test, the result and the fix. Backups tested by restoring them, access reviews with a sign-off, vendor due-diligence files and an incident response plan that has been rehearsed are what turns a compliance obligation into a quiet examination.

Our article "SEC Regulation S-P Amendments: A Practical Checklist" walks through the notification clocks, the service-provider rules and the evidence an examiner may ask to see. "Vendor and Third-Party Risk for Mid-Size Firms" covers the due-diligence file behind the service-provider rules, and "Penetration Testing Explained for Executives" is the companion piece for the testing step.

Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.

Related work on our track record: a systematic hedge fund's 100G colocation with PTP time and kernel-bypass networking, the long-running New York trading and San Francisco venture offices of a major conglomerate, and the global network separation project that built isolated regions and business units, and an Agent Security Review before a wealth manager rolls out Copilot Studio agents (illustrative).

Many of these firms must be able to show what a message said and when it was sent. Our team builds immutable message archives with provable integrity: a copy of every inbound and outbound email is stored in write-once storage, such as Amazon S3 Object Lock in compliance mode on Amazon Web Services (AWS) with encryption keys in AWS Key Management Service (AWS KMS), or the equivalents on Google Cloud (Bucket Lock and Cloud KMS), Microsoft Azure (immutable storage for Blob Storage and Azure Key Vault) and Oracle Cloud Infrastructure (OCI) (Object Storage retention rules and OCI Vault). A SHA-256 fingerprint of each message, protected with a key in the cloud key service, lets a third party check later that it is unchanged. For an adviser or broker-dealer, regulators may ask for business communications; AWS publishes an assessment of S3 Object Lock for SEC Rule 17a-4, CFTC and FINRA environments, and Microsoft publishes one for Azure immutable storage, but whether either fits a firm's obligations is for its counsel to decide. Counsel and the compliance officer decide what must be retained; this is technical evidence, not legal advice.