This year, I started taking meetings I wouldn't have taken two years ago — registered investment advisers, broker-dealers, wealth managers.

Insurance and mortgage are still where Motiva lives. But I kept hearing the same sentence from financial services firms, almost word for word:

"We pay a lot for IT. I still don't know if we're ready if someone from FINRA walks in."

That's the tell.

Not that they don't have an IT provider — they usually have a decent one, on paper. It's that being
covered and being examined are two different problems, and most MSPs are built to solve the first one.

I've seen this pattern for years in insurance under DFS Part 500, and in mortgage under the FTC Safeguards Rule. A firm has real controls in place. What it doesn't have is anything to hand an examiner when asked — a training completion roster, a documented risk assessment, an access review that actually happened and got written down.

Financial services firms have the same gap. The stakes are just higher, because SEC and FINRA exams come more often and go deeper.

A managed services contract keeps your email running and your laptops patched. It doesn't produce evidence. Those are two different jobs, and the firms that get caught out are usually the ones whose provider quietly assumed one job covered the other.

I'm a New York State-approved cybersecurity instructor — not because I collect credentials, but because when I sit down with a firm, I want to tell them exactly what an examiner is going to ask for, not guess at it alongside them.

So here's my honest question, for insurance, mortgage, or financial services firms alike:

If your IT provider disappeared tomorrow, could the next person walk in and find your training records? Your last risk assessment?

Reply and tell me — I'm curious how many firms actually know the answer.

— Walter

SEC & FINRA EXAM READINESSP.S.‍
Think you're covered? Find out if you're exam-ready.
Your IT may be working. Your examiner may still find gaps. Get a free SEC/FINRA Exam Readiness Review and see what your firm can actually prove — from documentation and access reviews to training records and supervision.
Get My Exam Readiness Review →