Cybersecurity for financial advisors and insurance agencies
Your clients trust you with their accounts, policies and Social Security numbers, and regulators expect a written plan that proves you protect them. I set up the protection with you, write the plan, train your staff, and serve as your Security Officer, so you can focus on your clients.
The rules you face
FTC Safeguards Rule: covers financial planners, state-registered advisors, mortgage brokers, lenders and tax preparers. It requires a written security plan, a named person in charge of it, a risk assessment, staff training, and vendor oversight.
SEC Regulation S-P: if you’re SEC-registered, the 2024 amendments apply to firms of every size as of June 3, 2026. You need a written incident response program, customer notice within 30 days of a breach, and oversight of your service providers.
State insurance data security laws: a growing number of states have adopted the NAIC Insurance Data Security Model Law. Small agencies are often exempt from the full program, but not from investigating and reporting a breach.
State breach laws: every state requires you to notify people when their personal information is exposed.
Learn more: FTC Safeguards Rule (GLBA) · Which rules apply to you?
What you get
A written security plan: built from your inventory, and ready for an exam or audit.
A named Security Officer: I take that role by contract, track what's due, and keep the paperwork current. You keep every decision.
Vendor management: a simple process for you to check and keep watch on the security of every vendor that handles your clients’ data.
Monitored protection: 24/7 protection on your devices and email, set up with you.
Staff training: everyone who touches client data completes it, with records kept.
An incident response plan: who to call, and the notice deadlines for your regulator and your clients.
A yearly review: we update your plan, devices, vendors and access together.
Want to see the full process? See How It Works.
What clients say
-
“Todd ‘owns’ the cybersecurity space - commanding knowledge, practical recommendations, and the ability to help execute appropriate strategies to counteract bad actors. He's my ‘go-to’ guy for cybersecurity questions and would gladly refer my clients and contacts to him.”
Bill O’Donnell, Certified Financial Fiduciary, Heartland Financial Solutions, LLC
-
“Todd is very passionate in helping small business owners-solopreneurs, bookkeepers, CPA's in providing a much needed service. Protecting people with cyber security....with many years background in military along with his business experience and now his own business-he is the consummate professional. Would definitely highly recommend.”
Kristina Smith, Bankers Life & Casualty Co
Common questions
I'm a one-person agency. Does any of this apply to me?
Usually, yes. Even when a size exemption skips the full program, breach reporting and your state's notification law still apply, and your carriers may ask for proof of security.
My broker-dealer or carrier handles security. Isn't that enough?
They secure their systems. How you collect client information before it gets to them is on you: the spreadsheet on your laptop, the emailed statement, the scanned application.
What happens if I have a data breach?
You notify affected clients under your state's law, plus your regulator: the FTC, the SEC, or your state insurance department. Your Incident Response plan spells out each step and deadline.