Managed IT and Cybersecurity for Columbus Investment Advisers

Who at our firm can move client money today?

Moving client money is never one system. The instruction arrives by email. The bank detail lives in the CRM. The authority to send it lives in the custodian portal. The authorization gets signed in the e-signature tool, and the account numbers sit in portfolio accounting. That is five user lists and five sets of multifactor settings, and usually only the mailbox is joined to your Microsoft tenant.

So that plain question gets answered by asking around, not by reading a list. The failure that follows is ordinary. Someone leaves, their email is shut off that afternoon, and the custodian login, the CRM seat and the e-signature account keep working, because no one owned them.

The fixes are specific:

• Onboarding and offboarding as a per-person, per-system list, run in reverse on the last day with a date and a name against each line.
• Multifactor authentication on every account that can reach client data or start a transfer, including contractors and an outside bookkeeper. Where a platform cannot enforce it, a written exception with an owner, a compensating control and a review date.
• Split authority: the person who can change standing bank instructions is not the person who releases the wire, and a changed instruction is confirmed by calling a number already on file.
• A review on an interval you can defend, where each system’s user list is exported and read name by name.

That record is the evidence behind whichever written program applies to you, and what a cyber insurance renewal is reaching for. Our Managed IT and cloud IT services handle the account side, and Compliance-as-a-Service and virtual CISO work keep the evidence current.

Our custodian or a software vendor reported a breach. What do we owe, and when?

For an SEC-registered adviser, Regulation S-P requires your incident response program to oversee service providers. It also has to require them to tell you as soon as possible, and no later than 72 hours, after they learn of a breach affecting a customer information system they maintain. That covers the custodian, portfolio accounting and CRM platforms, cloud and email hosting, the document vault, the e-signature tool and outsourced IT.

Your own 30-day clock to notify customers runs from your awareness, so it generally starts when the vendor’s notice arrives, or earlier if you learn another way. The vendor can send notices for you, but the obligation stays with you.

Ohio’s breach law sits on top and is not displaced: notice to affected Ohio residents in the most expedient time possible and within 45 days of discovering the breach or being notified of it. Its financial-institution exemption does not reach an advisory firm on the face of the text. More than one thousand affected Ohio residents adds notice to the nationwide consumer reporting agencies, and an advisory book of a few hundred families and their beneficiaries can pass that. Clients in other states can bring those states’ laws into play too.

An Ohio-registered adviser owes the Ohio notice and may owe more. The FTC Safeguards Rule covers advisers not required to register with the SEC. It requires telling the FTC, as soon as possible and within 30 days, about a breach of unencrypted information involving at least 500 consumers.

None of this works on a 30-day clock without retained logs, endpoint and mailbox telemetry, alerting on mailbox-rule changes, and a record of which vendors touch which data. That is ordinary Managed IT and cybersecurity work, and it is the difference between a determination that holds up and a mailing to your entire book.

Are we regulated by the SEC or by Ohio?

It turns on assets under management, and the two rule sets barely overlap:

• Below $25 million, an adviser is barred from SEC registration and registers with the Ohio Division of Securities.
• Between $25 million and $100 million, an Ohio-based “mid-sized adviser” is required to register with Ohio rather than the SEC.
• From $100 million to $110 million, federal registration is permitted but not required. At $110 million it becomes mandatory.

A handful of carve-outs send an otherwise state-sized adviser to the SEC regardless of assets. They include advisers to registered investment companies, pension consultants, internet advisers and firms that would otherwise register in 15 or more states.

Crossing the line carries a deadline either way. When an annual Form ADV amendment reports a firm is now SEC-eligible, the application is due within 90 days. When it reports the firm is no longer eligible, Form ADV-W to withdraw is due within 180 days of the fiscal year end.

What does Regulation S-P require of an SEC-registered adviser?

All of it, with no grace period left. The 2024 amendments gave larger advisers until December 3, 2025 and smaller ones until June 3, 2026. Both dates have passed. There is no assets or headcount floor, so a two-person RIA owes the same written program as a firm with a compliance department.

The rule asks for a privacy notice when the advisory relationship begins and at least annually, and a written safeguards program reasonably designed to protect customer information. A practice everyone follows but nobody wrote down does not satisfy a written-policy rule. The program has to include an incident response program to assess the scope of an incident, contain it, and notify affected individuals.

Customer notice is due as soon as practicable and within 30 days of becoming aware that unauthorized access has occurred or is reasonably likely. The clock starts on awareness of unauthorized access generally, so the investigation into whether sensitive information was involved has to finish inside the 30 days. “Sensitive” is a test, not a closed list: information whose compromise could create a reasonably likely risk of substantial harm or inconvenience. Where a firm cannot tell which individuals were affected, it notifies everyone whose sensitive information was in the affected system, so thin logging turns a contained incident into a mailing to the whole book.

The rule also requires written disposal policies, reaching retired laptops and drives as much as paper, and records kept for at least five years. It does not require reporting an incident to the SEC itself.

What applies to a state-registered adviser, and what should be in place before an exam?

An Ohio-registered adviser sits outside Regulation S-P’s safeguards and notice rules, and a different stack applies. Ohio requires:

• Written cybersecurity policies covering five functions (identify, protect, detect, respond and recover), reviewed at least annually.
• Written business continuity and succession procedures.
• A privacy policy on engagement and annually after.
• Written compliance policies, reviewed at least annually and administered by a designated supervised person.

The FTC Safeguards Rule adds a written information security program.

Identity theft rules reach both sides, depending on registration: Regulation S-ID for SEC-registered advisers and the FTC’s Red Flags Rule for Ohio-registered ones. Either way they reach a firm that is a creditor, or a financial institution, which for an adviser generally means authority to direct transfers or payments from a client account. A covered firm’s first duty is a periodic written determination of whether it offers covered accounts, owed even if the answer is no. Where the answer is yes, it needs a written Identity Theft Prevention Program approved by its board, a board committee, or a designated senior-management employee where there is no board.

Ohio also offers a shield rather than a duty. Revised Code 1354.02 gives an affirmative defense to certain data breach claims for a firm whose written program reasonably conforms to a named framework, including, for advisers, Title V of the Gramm-Leach-Bliley Act. It is elective, it does not excuse the Ohio breach notice, and it binds no regulator.

Every one of these rests on a written statement that controls exist, and an examiner eventually tests whether it is true. Our $349 Security Analysis at https://outreach.ttscyber.com/analysis is an independent assessment mapped to 38 compliance frameworks. Have the finding in hand before you sign the next annual review.