Security testing for financial firms that hold client money and data
NYDFS Part 500 applies regardless of size, and SEC Regulation S-P requires written safeguards for customer records. We test the controls that keep client money and data safe and keep you in compliance.
What we test for firms
We focus on the systems that hold client money and data and the controls regulators expect. Every engagement pairs with our web application penetration test approach and our cloud security assessment where they apply.
What is at stake
In the firm's language and the principal's language, these are the exposures a gap creates
Missed certification or an SEC exam finding
NYDFS Part 500 applies regardless of size to every organization under a NYDFS license, registration, charter, or authorization, including small broker-dealers, independent RIAs, insurance agencies, and mortgage companies. The Second Amendment was fully effective November 1, 2025. The amended rule requires an annual certification of compliance, with dual-signature certification creating personal accountability for the CEO and CISO.
Email account compromise and wire-fraud exposure
As of November 1, 2025, any individual accessing any information system of a NYDFS-covered entity must use MFA, with only a written, CISO-approved compensating control as an exception. A hijacked mailbox without MFA is both a compliance failure and a wire-fraud vector.
Custodians and clients asking for security evidence
Under SEC Regulation S-P Rule 30(a), every SEC-registered investment adviser must adopt written policies and procedures with administrative, technical, and physical safeguards for customer records. SEC settlements have turned on missing risk assessments, missing firewalls, unencrypted PII, missing incident response plans, and failure to enforce MFA on cloud email accounts.
Engagement and pricing
Assessments start at $5,000 and include a free 30-minute consultation. We scope the work to your systems, your custodial platforms, and the regulatory framework that applies to your firm.
Based in Long Island and serving firms across the region. See our Long Island security services page, compare options on our pricing page, or contact us to schedule a call.
Protect client money and data, and stay in compliance
Book a free 30-minute call. We will walk through your MFA, wire-verification, and encryption controls and tell you where a gap would be found.