A client, bank, custodian, or insurer may ask your firm to prove that its cybersecurity is real. They want evidence, not a promise.
You do not need every certification on the market. You do need current, accurate records that match how your firm actually works. Those records are much easier to produce when your IT partner helps you collect them before anyone asks.
What is cybersecurity due diligence?
Cybersecurity due diligence is the review a client, partner, insurer, or investor runs to decide whether your firm can safely handle sensitive information.
It can happen before a contract is signed, during an RFP, at cyber insurance renewal, or as part of a partner's yearly vendor review. The reviewer is looking for proof that security is managed on purpose rather than informally.
Telling them "our IT company handles it" is usually not enough. They want to see what is in place and how you know it works.
Why Brevard financial firms are asked more often
Financial firms hold names, account numbers, and tax records. Larger partners treat that data as a risk to their own business, so they check every firm that touches it.
The rules behind these requests also keep growing. The FTC Safeguards Rule, for instance, expects covered firms to run a written risk assessment, use multi-factor authentication, and keep an incident response plan. It also expects firms to oversee their service providers. You can read the full list in the FTC's Safeguards Rule guidance.
Which rules apply to you depends on what type of firm you are. Investment advisers and broker-dealers fall under SEC rules, and many lenders and tax preparers fall under the FTC. Your compliance lead or attorney should confirm which ones apply.
What documents will a client or partner ask to see?
The exact list depends on the relationship, but these come up again and again.
A Written Information Security Program (WISP)
A WISP is a written description of how your firm protects information. It names who is responsible, what safeguards are expected, and how sensitive data is handled. Reviewers treat it as a sign that security is a business responsibility.
An incident response plan
This plan shows how your firm would detect, contain, and report a security incident. A reviewer wants to know who makes decisions and how affected clients would be told.
The SEC's amended Regulation S-P now requires covered firms to adopt an incident response program and notify affected people as soon as practicable, and no later than 30 days after learning of unauthorized access. The same rule expects oversight of service providers.
A business continuity and recovery plan
Clients want confidence that you can keep working after an attack or outage. A plan on paper is not enough. They also want evidence that you have tested recovery. Our post on the real cost of IT downtime in Brevard County shows why this matters.
Risk assessments and security policies
A risk assessment shows that you regularly look for weaknesses and rank what to fix first. Policies then explain day-to-day rules for passwords, devices, remote work, and vendors. See why every business needs an annual IT risk assessment.
Training records and cyber insurance
Reviewers often ask whether employees get security training and whether completion is recorded. Some also ask for proof of cyber insurance. Insurers are getting stricter about what they require. Our post on why cyber insurance requirements are becoming harder to meet explains what to expect.
What security controls will they want you to prove?
A policy says what you intend to do. Due diligence goes further and asks whether the protection is actually running.
The table below shows common controls, the evidence a reviewer may accept, and who usually produces it.
| Control | Evidence you can show | Who usually provides it |
|---|---|---|
| Multi-factor authentication (MFA) | A report showing MFA is on for email, remote access, and key apps | Your IT or security partner |
| Device inventory | A current list of laptops, phones, and servers with who uses each | Your IT partner |
| Backups | Dated records that a backup was restored successfully | Your IT partner |
| Incident response | The written plan and the date of the last review or drill | Your firm with IT input |
| Vendor access | A list of vendors that touch client data and what they can reach | Your firm with IT input |
| Security training | Completion records for each employee | Your IT partner or training platform |
You do not need to hand over technical settings. A clear report or screenshot that shows the control is on and maintained is usually enough.
Why tested backups matter more than backup software
Many firms say they have backups. Fewer can show that they were restored from one. A dated restore test is some of the strongest evidence you can offer, because it proves the backup works.
How to handle a cybersecurity questionnaire
Larger clients, banks, and custodians often send a questionnaire instead of asking for documents one by one. It may be a short checklist or a long review.
Typical questions cover:
- Who is responsible for cybersecurity
- Whether multi-factor authentication is required
- How backups and recovery are handled
- How incidents are reported and managed
- How vendors are reviewed
- Whether employees receive training
- Whether independent testing is done
Governance questions often go to your compliance lead. Technical answers should be checked by your IT provider before you send them.
Never guess on a security questionnaire
If you cannot verify a control, do not answer "yes." Reviewers may ask for proof later, and a mismatch causes more worry than an honest gap.
An accurate answer with a short explanation and a fix date is usually more credible than an overstated one. The FTC Safeguards Rule also expects firms to notify the agency when a breach involves the unencrypted information of at least 500 consumers, so accurate records matter after an incident, too.
Do financial firms need SOC 2?
Not necessarily. Larger organizations may ask for a SOC 2 report because it speeds up their review. That does not mean every advisory practice, accounting firm, or lender has to hold one.
A smaller firm can often offer other evidence instead, such as:
- An independent cybersecurity assessment
- A current risk assessment
- A documented security program
- A testing summary or attestation letter
- Proof that key software vendors hold their own certifications
If SOC 2 is a contract requirement, you will need to address it directly. Do not assume a substitute will be accepted. Teck Shield's financial services IT page outlines our SOC 2 readiness support, including evidence collection, for firms heading that way.
Your vendors are part of the review
A firm can have strong internal habits and still carry risk through the vendors that store or access its data. That is why a vendor cybersecurity review often follows the firm review.
A reviewer may ask how you evaluate providers such as:
- Managed IT and cybersecurity providers
- Cloud and file-sharing services
- Accounting and financial platforms
- Customer relationship management tools
- Document-signing tools
At a minimum, know which vendors handle sensitive data, who at each vendor can reach it, and what security proof each one offers. A current vendor list makes these questions easy.
Be careful what security information you share
Due diligence does not mean giving every prospect your internal security files. A full penetration test report can list weak points and system names that you would not want passed around.
Safer options include:
- An executive summary
- An attestation letter from the firm that ran the test
- A redacted policy or policy summary
- Confirmation that testing happened and serious findings were fixed
For more sensitive records, use a confidentiality agreement and a controlled way to share files.
What if a client asks for something you do not have?
Do not invent an answer or describe a planned control as finished. Instead, respond to the concern behind the request:
- Ask what the client is trying to verify.
- Explain what your firm has in place today.
- Offer reasonable alternative evidence.
- Document any remaining gap.
- Share a remediation plan and target date.
Here are three common requests and a practical response to each:
| If the client asks for | A practical response |
|---|---|
| A SOC 2 report | Share your independent assessment and security documents, plus assurance from critical vendors |
| A full penetration test report | Offer an executive summary or attestation that confirms scope and fix status |
| A control you do not have yet | Disclose the gap and share a dated plan to close it |
What should a Brevard financial firm keep ready?
Build a simple, access-controlled due-diligence folder before the next request arrives. Include:
- Your current WISP or security policies
- The incident response plan
- The business continuity and recovery plan
- The latest risk assessment
- A recent testing summary or attestation
- Employee training records
- Cyber insurance documents
- The vendor list and vendor security proof
- Backup restore test records
- The name of the person responsible for cybersecurity
Review the folder when systems, vendors, or responsibilities change. A good habit is a quick check each quarter.
A quick check before you send anything
Before you submit a questionnaire or share documents, confirm that:
- The documents are current and match how the firm works today.
- Answers match your real systems and policies.
- Your IT or security provider has verified the technical answers.
- Sensitive details are redacted or summarized where appropriate.
- Gaps are disclosed accurately.
- Someone internal has read the final response for consistency.
