--- title: "Cyber Security for Financial Services | Network London" url: https://www.networklondon.co.uk/cybersecurity/cyber-security-for-financial-services description: "Cyber security for financial services firms: what investors, clients and regulators ask about, and how we help you answer with confidence." publisher: Network London legal_name: Network Support (London) Ltd updated: 2026-10-09 --- # Cyber security for financial services firms who have to prove it Network London looks after IT and cyber security for financial services firms of 20 to 250 people: private equity, hedge funds, asset managers, brokers, insurers and FCA-regulated advisers. This guide sets out who asks a financial services firm about its security, what they expect to see, the controls that answer them and how to choose a provider. Written by Ian Welch, our Technical Director. Ian is the Technical Director at Network London. He holds CEH and CISSP qualifications and is an ISO 27001 lead implementer, with over 25 years’ experience. ## Key takeaways - In financial services, the question is rarely “are we secure?”. It is “can we prove it?” to an investor, a client, an insurer or the FCA. - The people asking want evidence: multi-factor authentication everywhere, managed and encrypted devices, tested backups, access reviews, an incident plan, logging, and a named person accountable for security. - The attacks that actually hit firms of this size are not exotic. They are email account takeover, payment diversion, ransomware through an unpatched device and data leaving through a leaver or an AI tool. - The FCA expects operational resilience and oversight of IT providers. DORA adds documented requirements for firms with EU entities or clients. Neither needs a 200-page policy set. Both need controls that run and evidence that exists. - A provider who runs your IT and owns the security evidence is simpler than a consultancy that writes policies for someone else to implement. ## What cyber security for financial services has to cover A financial services firm is judged on its controls as much as on its returns. Investors run operational due diligence before they commit money. Corporate clients and counterparties send security questionnaires before they sign. Insurers price cyber cover on the answers. The FCA expects firms to show they can keep important business services running through an incident. Each of those groups asks slightly different questions, but they are checking the same handful of things. Cyber security for a firm of 20 to 250 people therefore has two halves. The first is the technical work: the settings, devices, backups and monitoring that stop the common attacks. The second is the evidence: being able to show, on request and in writing, that those things are in place and working. Most firms we meet have done some of the first half. Very few have the second, which is why a questionnaire turns into a two-week scramble. This guide covers both. It is written for the partner, COO or operations head who has been handed the questionnaire, not for a security engineer. ## Are investors, clients or regulators asking about your **security**? - An investor or client has sent a security questionnaire and you are not sure where to start. - A contract or an insurer asks whether you hold Cyber Essentials. - New systems or AI tools are arriving and nobody is leading the security side. ## Who asks about your security, and what they want to see The four groups below ask in different formats, but their questions map onto the same controls. If you can answer the right-hand column, you can answer all four. | Who is asking | How they ask | What satisfies them | | --- | --- | --- | | Investors and allocators | Operational due diligence questionnaire (ODD), often 100 or more questions, repeated at each fundraise or annual review | Written information security policy, named security lead, MFA on everything, device encryption and management, tested backups and recovery times, incident response plan, access reviews, vendor oversight, Cyber Essentials or ISO 27001 | | Clients and counterparties | Vendor security questionnaire before onboarding, sometimes a SIG or CAIQ, sometimes a one-page checklist | The same evidence, plus data handling: where client data is stored, who can reach it, how it is encrypted, how it is deleted | | Cyber insurers | Proposal form at renewal, increasingly with hard requirements rather than questions | MFA on email, remote access and admin accounts; endpoint detection and response; offline or immutable backups; patching within set windows; staff training; a recent penetration test | | The FCA | Operational resilience self-assessment, SYSC requirements, questions after an incident or during a review | Important business services identified, impact tolerances set and tested, IT providers overseen, incidents reported, a plan that has been exercised | Notice what is not on the list: a particular brand of firewall, a security operations centre, or a shelf of certifications. Reviewers want the basics done properly and proven. A firm of 40 people with MFA everywhere, managed devices, tested backups and a one-page incident plan that has been rehearsed will pass most due diligence. A firm with an expensive monitoring contract and three partners exempt from MFA will not. ## The threats financial services firms actually face Headlines are about nation states and market infrastructure. The incidents that reach firms of 20 to 250 people are more ordinary and more expensive. ### Email account takeover and payment diversion Someone in finance or operations is phished, or a password is reused from a breached site. The attacker reads mailboxes for weeks, learns who approves payments and how, then sends a convincing instruction to change bank details on a capital call, a redemption or a supplier invoice. This is the most common serious loss we see in financial services, and the defences are not complicated: multi-factor authentication with no exceptions, blocking legacy sign-in methods, alerts on new mailbox forwarding rules, and a payment verification step that does not rely on email. ### Ransomware through a device nobody managed An old laptop at a partner's home, a server that was never patched after the upgrade, a remote desktop port left open for a contractor. Ransomware in a small firm almost always starts at an unmanaged edge. The answer is an inventory you trust, every device enrolled, encrypted and patched, and backups that are tested and cannot be reached from the network they protect. ### Data leaving with people and with AI tools A departing analyst forwards a deal pipeline to a personal address. A team pastes a client's financials into a public AI tool to summarise them. Neither is an attack, and both are breaches a reviewer will ask about. Leavers need to lose access on the day. AI use needs a short policy, approved tools and settings that keep company data inside company systems. ### Suppliers and platforms you rely on Fund administrators, portfolio systems, CRM, research platforms and your IT provider all hold or reach your data. Reviewers increasingly ask how you assess them. You need a list, a view of what each one can reach, and a record that you checked their security. DORA makes this explicit for firms in its scope; investors ask for it everywhere. ## Want help answering **security questions** with confidence? - Work with a team that gets to know your firm, your people and how you work. - Start with a clear view of where you stand and what we would recommend. - Network London holds Cyber Essentials Plus, and support is there 24/7. ## The controls, in the order to put them in This is the order we use with a new financial services client. Each step closes the most likely loss first and produces evidence a reviewer will ask for. 1. **Multi-factor authentication on every account, no exceptions.** Email, files, remote access, admin accounts, the portfolio system. Legacy sign-in methods blocked so MFA cannot be bypassed. Partners and shared mailboxes handled properly rather than exempted. 2. **Every device known, managed and encrypted.** An inventory, enrolment in device management, disk encryption, automatic updates, endpoint detection and response. Personal devices either managed or kept off company data. 3. **Email that cannot be spoofed.** SPF, DKIM and DMARC set and enforced for your domain, anti-phishing and safe links switched on, and a rule that a change of bank details is verified by phone on a known number. 4. **Conditional access.** Company data only from managed devices and expected countries. Risky sign-ins challenged or blocked. Admin accounts separate from day-to-day accounts. 5. **Backups that are tested.** Mail, files and systems backed up separately from the production environment, with restore tests on a schedule and the results recorded. Reviewers ask for recovery times; you need to have measured them. 6. **Access reviews and leavers.** Who can reach what, reviewed quarterly and after every role change. Leavers removed on the day. The review itself recorded, because it is the first thing due diligence checks. 7. **Logging and alerts.** The audit log switched on and retained, with alerts for the signs of account takeover: new forwarding rules, impossible travel, mass downloads. 8. **Policies written for your firm.** Information security, access control, acceptable use, AI use, incident response, business continuity and supplier management. Short enough to be read, specific enough to be true. 9. **An incident plan you have rehearsed.** Who decides, who calls the insurer, who tells the FCA and when, how you keep trading. Run it as a table-top exercise once a year and keep the notes. 10. **Independent proof.** [Cyber Essentials Plus](https://www.networklondon.co.uk/cybersecurity/cyber-essentials-cost) as the baseline, a [penetration test](https://www.networklondon.co.uk/cybersecurity/penetration-testing) at least once a year (quarterly is better), and [ISO 27001](https://www.networklondon.co.uk/cybersecurity/iso-27001-consultant) if your investors or clients specify it. ## What the FCA and DORA expect of your IT The FCA's operational resilience rules ask firms to identify their important business services, set a tolerance for how long each could be disrupted, and show they can stay within that tolerance through a severe but plausible scenario, including a cyber incident. The SYSC rules add the general duty to have adequate systems and controls and to oversee outsourced providers. In practice, for a firm of this size, that means a short map of which systems each important service depends on, a tested plan for losing them, and a record of how you oversee the IT provider that runs them. DORA, the EU's Digital Operational Resilience Act, applies to EU financial entities and reaches UK firms that have EU entities, EU-regulated funds or clients who pass its requirements down the chain. It requires documented ICT risk management, incident reporting, resilience testing and, in particular, written arrangements with ICT providers covering due diligence, audit rights, data location and an exit plan. If an investor or client has sent you a DORA questionnaire, that last point is usually what they are checking. We are an IT and security provider, not a compliance consultancy. We provide the documentation for our part, including the contract terms, data locations and exit arrangements a reviewer asks for, and we build the technical evidence the rest of your submission relies on. We work alongside your compliance adviser rather than in place of them. ## Private equity, hedge funds and asset managers: where the emphasis differs **Private equity firms** face investor due diligence at every fundraise and hold sensitive information about portfolio companies and deals. Policies, access control and a clean answer to “who can see the data room” matter most. Read more on our page on [IT support for private equity firms](https://www.networklondon.co.uk/solutions/it-support-for-private-equity). **Hedge funds and asset managers** cannot afford downtime during trading hours and are judged by allocators on operational resilience. Tested recovery, priority support for the people who move money and oversight of trading platform vendors come first. See [IT support for hedge funds and asset managers](https://www.networklondon.co.uk/solutions/it-support-for-hedge-funds). **Brokers, advisers and insurers** handle client money or personal financial data at volume, so payment verification, email security and data handling policies carry the most weight, alongside the FCA's consumer-facing expectations. Our [IT support for financial services](https://www.networklondon.co.uk/solutions/it-support-for-financial-services) page covers the wider picture. ## A checklist you can run this week - Pull the list of accounts without MFA from your Microsoft 365 or Google admin centre. The number should be zero. - Count the devices that can reach company email. Compare it with the number your IT provider manages. - Ask when a backup was last restored, not last taken, and ask to see the record. - Check who has admin rights in your main systems and whether any of them left the firm. - Find your incident response plan. If it takes more than five minutes, you do not have one. - Send your last investor or client questionnaire to your IT provider and ask them to answer it. The reply tells you most of what you need to know. ## How to choose a cyber security provider for a financial services firm Ask every provider the same questions and compare the answers. - **Who will be accountable for our security, by name?** Reviewers like a name. So should you. - **Have you answered an investor due diligence questionnaire before?** Ask to see an anonymised one. - **What do you hold yourselves?** A provider asking you to get Cyber Essentials Plus should hold it. - **How do we get our data and documentation back if we leave?** This is the exit plan question, and it is also a DORA requirement. - **Who answers the phone at 7am on a closing day?** Security providers who do not also run your IT cannot answer this. - **What is in the contract?** Response commitments, data locations and audit rights should be written down, not promised. ## How we help financial services firms Network London looks after IT and cyber security for financial services firms of 20 to 250 people, from near London Bridge, with clients across the world. When an investor, client or regulator asks about your security, we help you answer with evidence. We start with your firm: your people, how you work, the systems you rely on and where the risks are. Then we give you a clear view of what we would recommend and in what order. An investment firm was having an AI platform built by another company. We reviewed the detail and spotted two issues: their data would be stored in Singapore when it needed to stay in the UK, and they would not fully own what they were paying for. They went back to the table knowing what needed to change. We then limited the new app's access to the two SharePoint sites it needed. A [private equity firm of 30 people](https://www.networklondon.co.uk/case-studies#private-equity) asked us to shape their IT and cyber security policy; we now look after it day to day. Network London holds **Cyber Essentials Plus**. Our security work is led by Ian Welch, our Technical Director, a certified ethical hacker, CISSP and ISO 27001 lead implementer with more than 25 years' experience. Support starts from £1,000 a month, and a real person answers the phone, always. Send us a message and Jessica, our Operations Director, will reply personally the same day. ## Tell us what you need Jessica, our Operations Director, reads every enquiry and replies personally the same day. The first step is a conversation about your business, what's working and where you need help. Prefer to talk? Call [0333 335 5020](tel:+443333355020). A real person answers, always. Thank you. Your message has been received and we'll be in touch shortly. Something went wrong sending that. Please call [0333 335 5020](tel:+443333355020) or email [letstalk@networklondon.co.uk](mailto:letstalk@networklondon.co.uk?subject=Network%20London%20-%20IT%20services%20query). ## Related guides - [IT support for financial services](https://www.networklondon.co.uk/solutions/it-support-for-financial-services): the everyday support and the evidence, from one team. - [Penetration testing](https://www.networklondon.co.uk/cybersecurity/penetration-testing): scoped to what your investors or insurer asked for, with the findings fixed. - [ISO 27001 consultant](https://www.networklondon.co.uk/cybersecurity/iso-27001-consultant): from gap analysis to the audit, led by a lead implementer. - [Cyber Essentials cost and process](https://www.networklondon.co.uk/cybersecurity/cyber-essentials-cost): what the certification costs and how we get you through it. - [Microsoft 365 security](https://www.networklondon.co.uk/cybersecurity/microsoft-365-security): the settings that stop account takeover, switched on and kept on. - [Cyber security for law firms](https://www.networklondon.co.uk/cybersecurity/cyber-security-for-law-firms): the same questions, asked by clients and the SRA. ## Frequently asked questions ### What cyber security does a financial services firm need? Multi-factor authentication on every account, managed and encrypted devices, email that cannot be spoofed, conditional access, tested backups, regular access reviews, logging with alerts, written policies, a rehearsed incident plan and independent proof such as Cyber Essentials Plus and a penetration test at least once a year. That list answers investor due diligence, client questionnaires, insurers and the FCA. ### Do we need ISO 27001 to satisfy investors? Usually not. Most operational due diligence is satisfied by Cyber Essentials Plus, sound policies and evidence that the controls run. Larger allocators and some corporate clients specify ISO 27001. Ask whoever is asking before you commit to the bigger project; we will give you a straight view either way. ### Does DORA apply to a UK firm? Directly, only if you have an EU financial entity. Indirectly, yes, if EU clients, funds or counterparties pass its requirements down to you, which is increasingly common. The practical effect is written arrangements with your IT provider covering due diligence, audit rights, data location and exit. We provide ours as standard. ### What does cyber security cost for a financial services firm? Our managed IT and security support starts from £1,000 a month, and most of the controls above are part of it rather than extras. Cyber Essentials assessment fees, a penetration test and ISO 27001 consultancy are quoted separately and depend on your size and scope. ### Can you help us answer a due diligence questionnaire we have already received? Yes, and it is often the reason a firm first calls us. Send it over. We answer what can be answered today, put right what needs attention first and keep the evidence current so the next one is quicker. ## Next step If investors, clients or the FCA are asking about your security, [send us a message](https://www.networklondon.co.uk/contact-us) or the questionnaire itself. The first step is a conversation about your firm: what is working and where you need help. ## About Network London Network London is an IT support and cyber security company in central London, based at The Leather Market, SE1, next to London Bridge, Tower Bridge and Borough. For 20 years it has looked after IT and security for growing businesses, so their people can get on with their work. A team of 17 supports more than 100 businesses in London and around the world. Network London is a trading name of Network Support (London) Ltd, registered in England and Wales, company number 05991874. Network Support (London) Ltd is owned by Verdani Solutions Group Limited, which also owns the Network London trade mark. ## The Cyber Security Vault: 22+ tools and apps Most of them are free. We'll send you our list of resources you and your team can use to improve your cyber security straight away. No technical knowledge needed. --- Network London, LM04.202, The Leather Market, Weston Street, London SE1 3ER. Telephone 0333 335 5020. letstalk@networklondon.co.uk. Network London is a trading name of Network Support (London) Ltd, registered in England and Wales, company number 05991874. Network Support (London) Ltd is owned by Verdani Solutions Group Limited, which also owns the Network London trade mark.