Your clients trust you with their private financial data, and you probably feel a responsibility to protect that data. But what you may not know is that securities regulators hold\u00a0advisors<\/i>\u00a0accountable – not their technology vendors \u2013 when client data is compromised. That can amount to fines and settlements with the Securities Exchange Commission, regardless of any harm or loss of information.<\/p>\n
Don’t let flimsy security policies cost you. Here are six important questions to ask your tech vendors to make sure the technology used by both you and your clients meets the highest standards.<\/p>\n
Online threats are constantly evolving. Your tech vendor should fully understand the security landscape and take steps to\u00a0continually\u00a0evaluate and strengthen their infrastructure. Ask your tech vendor if they conduct annual audits, penetration tests and how often they monitor their production network for intrusion.<\/p>\n
Encryption is a way to ensure only authorized parties can decode and read sensitive information online.\u00a0Various levels of encryption exist, meaning some do a better job of safeguarding data than others.\u00a0Your vendor should take a well-rounded approach and encrypt data both at rest and in transit. Make sure you also understand their key management policy (KMP), which is a set of rules a business has to protect information.<\/p>\n
This question has less to do\u00a0with\u00a0which method is preferred, and more to do with accountability. If a tech vendor manages their own servers and storage infrastructure, you’re dealing directly with the people responsible for protecting your client data. But if the vendor outsources these components, your vetting process should extend to those third parties.<\/p>\n
Data breach attempts happen more often than you think. Fortunately, organizations have gotten good at detecting and stopping the staggering amount of online threats that face the global market. The best tech vendors monitor their infrastructure for intrusions 24 hours a day, seven days per week.<\/p>\n
SOC 2 is a type of compliance standard that measures how information is protected online. Businesses seek to become SOC 2 compliant after a\u00a0thorough audit of security, availability, process integrity, privacy, and confidentiality by a certified third party. Before partnering with a tech vendor, be sure all aspects of their service are SOC 2 compliant.<\/p>\n
Your tech vendor should prove, beyond a shadow of a doubt, that protecting your data is a top priority. That means their security policies should run deep within their culture. Find out whether they perform security training for all new employees, if employees need to take annual security assessments, whether background checks are necessary for employees, and if they have an incident response team.<\/p>\n