Safeguards-aligned control program
MFA, encryption, access controls, a written incident-response plan, and vendor management — operated end-to-end and mapped to the Safeguards Rule's required elements.
RIAs · wealth · insurance agencies
The regulator's checklist and the carrier's are nearly the same list.
Registered investment advisers, wealth managers, and insurance agencies handle client funds and account access, which puts them under the FTC / GLBA Safeguards Rule. SEC-registered advisers answer to Regulation S-P and Regulation S-ID; state-registered advisers answer to their state's rules and the FTC Safeguards Rule; an underwriter scores both the same way. The good news: the Safeguards control list maps almost one-to-one onto what a cyber underwriter scores.
The exposure
What underwriters and attackers actually look at
Client funds and account access make MFA-on-everything, email security, and funds-transfer verification the priority three. An SEC- or FINRA-examined firm should expect the cyber questionnaire to read like its own compliance file — and answering one well answers the other.
Applicable framework: FTC / GLBA Safeguards Rule.
The program
What we operate for you
The managed security program — 24/7 SOC-monitored detection, identity protection, and security awareness training, operated end-to-end — tuned to financial services & insurance agencies.
Identity threat detection
Managed ITDR on the productivity tenant, watching for the account takeovers that precede client-fund fraud and unauthorized trades.
Funds-transfer verification
Out-of-band verification and dual authorization on client withdrawals and bank-detail changes — the control that stops a social-engineered transfer.
A managed browser for the adviser portals
The custodian portal, the CRM, planning tools, e-signature and email open in the Island Enterprise Browser, and a download to a personal computer can be blocked.
See the managed browserFit
Who this is for
- Solo and two-person advisory firms, state- or SEC-registered
- Registered investment advisers and wealth-management firms
- Independent insurance agencies and brokerages
- Firms preparing for an SEC, FINRA, or state exam
- Advisers who hold client funds or account credentials
Further reading
Go deeper on Financial Services & Insurance Agencies
CISSP-led guides on the threats, compliance, and controls that apply to financial services & insurance agencies — the detail behind the program above.
Cybersecurity for a small investment adviser: Reg S-P, Reg S-ID and state exams
Which cybersecurity rules a solo or two-person advisory firm answers to: Regulation S-P, Regulation S-ID, state rules and the FTC Safeguards Rule.
Read the guideGLBA, the SEC, and Your Small Advisory: Which Cybersecurity Rules Actually Apply
RIAs, insurance agencies, and small advisory firms sit under overlapping cybersecurity rules — the FTC/GLBA Safeguards Rule and, for registered firms.
Read the guideFAQ
Financial Services & Insurance Agencies: common security questions
What cybersecurity rules apply to a financial advisor or RIA?
Investment advisers and many financial firms fall under the SEC's Regulation S-P and the GLBA / FTC Safeguards framework, which require a written information security program, access controls, an incident response program, and customer breach notification within 30 days — the 2024 Reg S-P amendments are in effect for all covered advisers as of June 3, 2026.
These obligations apply regardless of firm size.
What's the biggest cyber risk for a financial firm?
Client-fund wire fraud and account takeover. Attackers impersonate clients or advisers to redirect transfers and target the credentials that reach client accounts. Identity threat detection and out-of-band verification are the controls that matter most.
How much does managed cybersecurity cost for a financial firm?
Managed coverage starts at $25 per person per month (Ridge Core, no minimum), which watches every computer and every email login.
Ridge Plus adds staff training, email protection and a secure browser; Ridge Reserve adds the incident response plan, access reviews and patch reporting.
All three are priced per person, and log collection is Ridge Log, an add-on on any tier. The one-time Cyber Insurance Readiness Sprint is a fixed fee from $1,500 (three tiers up to $3,500).
How fast can you get us compliant and insurance-ready?
The Cyber Insurance Readiness Sprint runs seven business days from kickoff to a signed evidence pack mapped to your carrier's questionnaire. Managed monitoring can begin onboarding in the same week.
Start with the questionnaire
See where you stand before an underwriter does.
The free 2026 Cyber Insurance Readiness Questionnaire scores you against the controls carriers actually ask about. Then the Readiness Sprint turns your environment into the evidence they accept.
Guides for your buying decision
Read the industry guide, compare the service scope and start with your carrier's actual questions.