For capital-market and other regulated firms
Audit-ready IT for regulated firms
When the examiner asks for your IT records, they are ready. We look after the computers, email and backups your firm runs on, and keep the evidence your compliance officer will be asked for.
Built for brokers, fund and asset managers, registrars, trustees and insurance brokers.
Examiner evidence pack
Made-up sample
| Record | Status |
|---|---|
| Board-approved IT policySigned March 2026. Next review March 2027. | Ready |
| Equipment registerEvery laptop and server, with its owner. | Ready |
| Two-step sign-in reportThree staff still to switch on. | Due soon |
| Security test findingsAll findings from the last test closed. | Ready |
| Backup restore testDue this month. Last test passed. | Due soon |
| Continuity and recovery planNeeds the new office added. | Fix now |
When the examiner asks, every record is in one folder with a date and an owner.
What the pack covers
One team looks after the IT a regulated firm can’t afford to lose. You choose the parts you need.
Managed IT
We look after your laptops, servers, network and Microsoft 365 or Google Workspace on a monthly plan. That covers security updates and monitoring with automated alerts. Your staff can reach our helpdesk in business hours.
Email security
Most fraud on investment accounts starts with a fake email that looks like yours. We set up the settings that prove your email is really from you (SPF, DKIM and DMARC), filter out phishing and add a second sign-in step to every mailbox.
Access control
Every person has their own login and sees only the trading, registry and accounting systems their job needs. When someone leaves, their access ends that day.
Backups you have tested
We keep encrypted copies of your mail, files and key databases off-site. We test restoring them on a schedule and record the results.
See all 6
Regulator-facing reporting support
We keep the records an examiner or auditor asks for up to date. That means your list of equipment, access reviews, update and backup logs, and incident records. When a request comes, answering it takes a day.
NDPA work, with a licensed DPCO
We do the technical set-up, preparation and security work. A licensed Data Protection Compliance Organisation (DPCO) partner carries out the audit and files it. We do not certify, audit or guarantee compliance ourselves.
The report management gets every month
Monthly IT report
Made-up sample, page 1 of 3
| Area | Status | This month |
|---|---|---|
| Laptops checked | Done | 22 of 24 checked. 2 sent for repair under warranty. |
| Two-step sign-in | In progress | 34 of 40 staff. 6 to finish this month. |
| Security test findings | In progress | 8 of 9 closed. 1 waits on the software vendor. |
| Backups | Done | Cloud backup ran every night. One restore tested. |
| Leavers | Done | 2 staff left. Access removed the same day. |
Pages 2 and 3: requests handled, purchases advised, and what we recommend next.
Proof from IT we already run
- Twelve years of IT for a regulated Lagos capital-market groupRead the case
69items on one coded equipment register, in 10 categories
Equipment register, by category - Email, files, backup and a full IT department for a marketing agencyRead the case
33mailboxes moved off old hosting in one weekend
- Old web hostingUntil 2022
- Microsoft 365Sep 2022, one weekend
- Zoho MailSep 2024, all checked
Where our part ends
In a regulated firm, everyone needs to know who does what.
Included
- Running and securing your IT, email and backups
- Keeping the technical evidence your compliance team needs
- Preparing your systems and records for an NDPA audit
- Working with your compliance officer, auditors and DPCO partner
Not included
- Legal or regulatory advice, which stays with your counsel and compliance officer
- Filing NDPA audit returns, which a licensed DPCO does
- Certifying or guaranteeing compliance with any regulation
- Changes to trading or registry platforms owned by their vendors
Regulatory expectations for capital-market cyber security are still settling. We build to your regulator’s published expectations and update the pack as final rules are issued.
How we start
Free Digital Asset Audit
We check who holds your domain, email and hosting and how your mail is protected. You get a 2-page note.
Scoping call
We go through how many staff you have, your systems and vendors, and what your compliance officer is asked for each year.
Your fixed price
You get a fixed price before we start. It shows what we do, what your staff do, and what your vendors and the DPCO partner handle.
Onboarding
We take over the accounts and records we will hold for you, list them, and fix the urgent gaps first.
Related work and reading
Client names and full write-ups live in Our Work.
- A Lagos capital-market group: twelve years of IT oversight
69 items on a coded equipment register, 32 of 40 staff on two-step sign-in, more than ten security tests closed with the auditors, a monthly IT report, and six used laptops caught on delivery.
- A licensed stockbroker, rebuilt
An SEC-licensed broker/dealer moved off WordPress with every disclosure, account-opening form and dividend record intact.
- An insurance broker, rebuilt
An insurance broker moved off WordPress with every product page and the client’s wording kept exactly as approved.
- Our Work
Case studies for the firms and public bodies we build and support systems for.
- Free Digital Asset Audit
A 2-page note on who controls your domain, email and hosting, and what to fix first.
Questions capital-market firms ask
Will this make us compliant with SEC rules?
No provider can promise that. We build your IT controls to your regulator’s published expectations and keep the technical evidence current. Your compliance officer and counsel decide whether the firm meets its obligations. The SEC’s cyber security standards were issued as an exposure draft in 2022. We are watching for the final text and will update the pack when it is issued.
Do you carry out NDPA audits?
No. Under the NDPA, audits are filed by a licensed Data Protection Compliance Organisation. We do the technical implementation, preparation and security work, and a licensed DPCO partner audits and files. You can also use a DPCO you already work with.
Can you work alongside our trading or registry software vendor?
Yes. We look after the devices, network, accounts and email around those platforms and work with the vendor. Changes inside their software stay with them.
What does the pack cost?
It depends on how many staff you have, your systems and how much evidence you need kept. After one call we send you the price and a list of what it covers.
Start with what you can see today
Book a call, or ask for the free Digital Asset Audit first. Either way, you get a clear next step and no sales pitch.
Monday to Friday, 9am to 6pm. We reply within one business day.