Key takeaways
- In financial services, the question is rarely “are we secure?”. It is “can we prove it?” to an investor, a client, an insurer or the FCA.
- The people asking want evidence: multi-factor authentication everywhere, managed and encrypted devices, tested backups, access reviews, an incident plan, logging, and a named person accountable for security.
- The attacks that actually hit firms of this size are not exotic. They are email account takeover, payment diversion, ransomware through an unpatched device and data leaving through a leaver or an AI tool.
- The FCA expects operational resilience and oversight of IT providers. DORA adds documented requirements for firms with EU entities or clients. Neither needs a 200-page policy set. Both need controls that run and evidence that exists.
- A provider who runs your IT and owns the security evidence is simpler than a consultancy that writes policies for someone else to implement.
What cyber security for financial services has to cover
A financial services firm is judged on its controls as much as on its returns. Investors run operational due diligence before they commit money. Corporate clients and counterparties send security questionnaires before they sign. Insurers price cyber cover on the answers. The FCA expects firms to show they can keep important business services running through an incident. Each of those groups asks slightly different questions, but they are checking the same handful of things.
Cyber security for a firm of 20 to 250 people therefore has two halves. The first is the technical work: the settings, devices, backups and monitoring that stop the common attacks. The second is the evidence: being able to show, on request and in writing, that those things are in place and working. Most firms we meet have done some of the first half. Very few have the second, which is why a questionnaire turns into a two-week scramble.
This guide covers both. It is written for the partner, COO or operations head who has been handed the questionnaire, not for a security engineer.
Who asks about your security, and what they want to see
The four groups below ask in different formats, but their questions map onto the same controls. If you can answer the right-hand column, you can answer all four.
| Who is asking | How they ask | What satisfies them |
|---|---|---|
| Investors and allocators | Operational due diligence questionnaire (ODD), often 100 or more questions, repeated at each fundraise or annual review | Written information security policy, named security lead, MFA on everything, device encryption and management, tested backups and recovery times, incident response plan, access reviews, vendor oversight, Cyber Essentials or ISO 27001 |
| Clients and counterparties | Vendor security questionnaire before onboarding, sometimes a SIG or CAIQ, sometimes a one-page checklist | The same evidence, plus data handling: where client data is stored, who can reach it, how it is encrypted, how it is deleted |
| Cyber insurers | Proposal form at renewal, increasingly with hard requirements rather than questions | MFA on email, remote access and admin accounts; endpoint detection and response; offline or immutable backups; patching within set windows; staff training; a recent penetration test |
| The FCA | Operational resilience self-assessment, SYSC requirements, questions after an incident or during a review | Important business services identified, impact tolerances set and tested, IT providers overseen, incidents reported, a plan that has been exercised |
Notice what is not on the list: a particular brand of firewall, a security operations centre, or a shelf of certifications. Reviewers want the basics done properly and proven. A firm of 40 people with MFA everywhere, managed devices, tested backups and a one-page incident plan that has been rehearsed will pass most due diligence. A firm with an expensive monitoring contract and three partners exempt from MFA will not.
The threats financial services firms actually face
Headlines are about nation states and market infrastructure. The incidents that reach firms of 20 to 250 people are more ordinary and more expensive.
Email account takeover and payment diversion
Someone in finance or operations is phished, or a password is reused from a breached site. The attacker reads mailboxes for weeks, learns who approves payments and how, then sends a convincing instruction to change bank details on a capital call, a redemption or a supplier invoice. This is the most common serious loss we see in financial services, and the defences are not complicated: multi-factor authentication with no exceptions, blocking legacy sign-in methods, alerts on new mailbox forwarding rules, and a payment verification step that does not rely on email.
Ransomware through a device nobody managed
An old laptop at a partner's home, a server that was never patched after the upgrade, a remote desktop port left open for a contractor. Ransomware in a small firm almost always starts at an unmanaged edge. The answer is an inventory you trust, every device enrolled, encrypted and patched, and backups that are tested and cannot be reached from the network they protect.
Data leaving with people and with AI tools
A departing analyst forwards a deal pipeline to a personal address. A team pastes a client's financials into a public AI tool to summarise them. Neither is an attack, and both are breaches a reviewer will ask about. Leavers need to lose access on the day. AI use needs a short policy, approved tools and settings that keep company data inside company systems.
Suppliers and platforms you rely on
Fund administrators, portfolio systems, CRM, research platforms and your IT provider all hold or reach your data. Reviewers increasingly ask how you assess them. You need a list, a view of what each one can reach, and a record that you checked their security. DORA makes this explicit for firms in its scope; investors ask for it everywhere.
The controls, in the order to put them in
This is the order we use with a new financial services client. Each step closes the most likely loss first and produces evidence a reviewer will ask for.
- Multi-factor authentication on every account, no exceptions. Email, files, remote access, admin accounts, the portfolio system. Legacy sign-in methods blocked so MFA cannot be bypassed. Partners and shared mailboxes handled properly rather than exempted.
- Every device known, managed and encrypted. An inventory, enrolment in device management, disk encryption, automatic updates, endpoint detection and response. Personal devices either managed or kept off company data.
- Email that cannot be spoofed. SPF, DKIM and DMARC set and enforced for your domain, anti-phishing and safe links switched on, and a rule that a change of bank details is verified by phone on a known number.
- Conditional access. Company data only from managed devices and expected countries. Risky sign-ins challenged or blocked. Admin accounts separate from day-to-day accounts.
- Backups that are tested. Mail, files and systems backed up separately from the production environment, with restore tests on a schedule and the results recorded. Reviewers ask for recovery times; you need to have measured them.
- Access reviews and leavers. Who can reach what, reviewed quarterly and after every role change. Leavers removed on the day. The review itself recorded, because it is the first thing due diligence checks.
- Logging and alerts. The audit log switched on and retained, with alerts for the signs of account takeover: new forwarding rules, impossible travel, mass downloads.
- Policies written for your firm. Information security, access control, acceptable use, AI use, incident response, business continuity and supplier management. Short enough to be read, specific enough to be true.
- An incident plan you have rehearsed. Who decides, who calls the insurer, who tells the FCA and when, how you keep trading. Run it as a table-top exercise once a year and keep the notes.
- Independent proof. Cyber Essentials Plus as the baseline, a penetration test at least once a year (quarterly is better), and ISO 27001 if your investors or clients specify it.
What the FCA and DORA expect of your IT
The FCA's operational resilience rules ask firms to identify their important business services, set a tolerance for how long each could be disrupted, and show they can stay within that tolerance through a severe but plausible scenario, including a cyber incident. The SYSC rules add the general duty to have adequate systems and controls and to oversee outsourced providers. In practice, for a firm of this size, that means a short map of which systems each important service depends on, a tested plan for losing them, and a record of how you oversee the IT provider that runs them.
DORA, the EU's Digital Operational Resilience Act, applies to EU financial entities and reaches UK firms that have EU entities, EU-regulated funds or clients who pass its requirements down the chain. It requires documented ICT risk management, incident reporting, resilience testing and, in particular, written arrangements with ICT providers covering due diligence, audit rights, data location and an exit plan. If an investor or client has sent you a DORA questionnaire, that last point is usually what they are checking.
We are an IT and security provider, not a compliance consultancy. We provide the documentation for our part, including the contract terms, data locations and exit arrangements a reviewer asks for, and we build the technical evidence the rest of your submission relies on. We work alongside your compliance adviser rather than in place of them.
Private equity, hedge funds and asset managers: where the emphasis differs
Private equity firms face investor due diligence at every fundraise and hold sensitive information about portfolio companies and deals. Policies, access control and a clean answer to “who can see the data room” matter most. Read more on our page on IT support for private equity firms.
Hedge funds and asset managers cannot afford downtime during trading hours and are judged by allocators on operational resilience. Tested recovery, priority support for the people who move money and oversight of trading platform vendors come first. See IT support for hedge funds and asset managers.
Brokers, advisers and insurers handle client money or personal financial data at volume, so payment verification, email security and data handling policies carry the most weight, alongside the FCA's consumer-facing expectations. Our IT support for financial services page covers the wider picture.
A checklist you can run this week
- Pull the list of accounts without MFA from your Microsoft 365 or Google admin centre. The number should be zero.
- Count the devices that can reach company email. Compare it with the number your IT provider manages.
- Ask when a backup was last restored, not last taken, and ask to see the record.
- Check who has admin rights in your main systems and whether any of them left the firm.
- Find your incident response plan. If it takes more than five minutes, you do not have one.
- Send your last investor or client questionnaire to your IT provider and ask them to answer it. The reply tells you most of what you need to know.
How to choose a cyber security provider for a financial services firm
Ask every provider the same questions and compare the answers.
- Who will be accountable for our security, by name? Reviewers like a name. So should you.
- Have you answered an investor due diligence questionnaire before? Ask to see an anonymised one.
- What do you hold yourselves? A provider asking you to get Cyber Essentials Plus should hold it.
- How do we get our data and documentation back if we leave? This is the exit plan question, and it is also a DORA requirement.
- Who answers the phone at 7am on a closing day? Security providers who do not also run your IT cannot answer this.
- What is in the contract? Response commitments, data locations and audit rights should be written down, not promised.
How we help financial services firms
Network London looks after IT and cyber security for financial services firms of 20 to 250 people, from near London Bridge, with clients across the world. When an investor, client or regulator asks about your security, we help you answer with evidence. We start with your firm: your people, how you work, the systems you rely on and where the risks are. Then we give you a clear view of what we would recommend and in what order.
An investment firm was having an AI platform built by another company. We reviewed the detail and spotted two issues: their data would be stored in Singapore when it needed to stay in the UK, and they would not fully own what they were paying for. They went back to the table knowing what needed to change. We then limited the new app's access to the two SharePoint sites it needed. A private equity firm of 30 people asked us to shape their IT and cyber security policy; we now look after it day to day.
Network London holds Cyber Essentials Plus. Our security work is led by Ian Welch, our Technical Director, a certified ethical hacker, CISSP and ISO 27001 lead implementer with more than 25 years' experience. Support starts from £1,000 a month, and a real person answers the phone, always. Send us a message and Jessica, our Operations Director, will reply personally the same day.