Cybersecurity basics for a two-person RIA: ten controls worth having this year
A solo or two-person RIA can cover most everyday security risk with ten controls: multi-factor sign-in on every account that offers it, a password manager, encrypted and updated devices, separate admin accounts, a quarterly access review, checks on vendors that hold client data, secure document sharing instead of email attachments, a callback rule for money movements, backups you have tested, and a short written plan for what to do if something goes wrong. Write each control down and note when you last checked it.
Most security problems at small firms don't start with sophisticated attacks. They start with a reused password, a phishing email that looked like the custodian, a laptop left in a taxi, or a former assistant who still has access. Ten plain controls cover most of that.
What are the ten controls?
| # | Control | What it stops |
|---|---|---|
| 1 | Multi-factor sign-in on email, custodian, CRM and practice software | Stolen passwords being enough to get in |
| 2 | A password manager, with unique passwords everywhere | One leaked password opening everything |
| 3 | Encrypted, updated laptops and phones with a screen lock | A lost device becoming a data breach |
| 4 | Separate admin accounts from everyday accounts | Malware gaining full control from one click |
| 5 | A quarterly access review | Former staff and old vendors keeping access |
| 6 | Checks on vendors that hold client data | Weak links you don't know about |
| 7 | Secure document sharing instead of email attachments | Statements and IDs sitting in inboxes |
| 8 | A callback rule before moving money | Fraudulent instructions from compromised email |
| 9 | Backups, tested by actually restoring something | Losing records you're required to keep |
| 10 | A one-page incident plan | Panic and delay when something goes wrong |
What goes in the one-page incident plan?
- Who to call first: your IT help, your custodian, your compliance consultant, your insurer.
- First steps: change passwords, disconnect the affected device, preserve evidence.
- How to decide whether clients or regulators need to be told, and who decides.
- Where to record what happened: your incidents log.
A worked example
Take a hypothetical two-person RIA that reviews its controls each January. This year it finds two gaps: multi-factor sign-in was off on the shared email inbox, and a former part-time assistant still had a login to the CRM. Both are fixed that day and noted. The owner restores one client folder from backup to prove it works, and updates the incident plan with the insurer's new phone number. The whole review takes about two hours and goes in the compliance file.
What are the common gaps?
- Multi-factor sign-in on most accounts, but not email.
- Backups that nobody has ever tried to restore.
- Vendors holding client data that nobody has asked about.
- No written plan, so the first incident becomes the plan.
When is this overkill?
It isn't. Each control takes an afternoon at most, and together they cover the incidents small firms most often face.
How Advorra fits
Advorra keeps each firm's data separate from every other firm's at the database level, encrypted in transit and at rest, and hosted in the US, and records incidents in its complaints and incidents log. Your own controls, like the ones above, still matter for everything around it. See the product page, or read about access reviews and Regulation S-P.
One thing to do this week: check multi-factor sign-in is on for your email. If it's on, check your custodian login next.
A practical checklist, not legal, compliance or IT advice.
Questions advisors ask
Do small RIAs need written cybersecurity policies?
Regulators expect advisers to protect client information, and SEC-registered advisers have specific obligations under Regulation S-P. State rules vary. Your compliance consultant can tell you what your written policies need to cover.
What's the single most useful control?
Multi-factor sign-in on email and on every system that holds client data. A stolen password alone then isn't enough.
Do we need an IT provider?
Not necessarily. Many small firms manage these controls themselves, or use a provider for devices and backups.
How often should controls be checked?
Quarterly for access and devices, yearly for vendors and the written plan.
Is this legal or compliance advice?
No. It is a practical checklist.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch