Go Back Up

triangle-exclamation-sharp-solid-full Security incident? Get immediate help

hands-holding-dollar
$6.29M Average cost of a breach in the financial sector, second highest of the 17 industries IBM studied. IBM

Average cost of a breach in the financial sector, second highest of the 17 industries IBM studied. IBM

copy-link
48% Share of breaches that involved a third party, up from 30% the year before. Verizon

Share of breaches that involved a third party, up from 30% the year before. Verizon

user-work-laptop-wifi
62% Share of breaches that involved the human element, such as phishing, errors, or misused access. Verizon

Share of breaches that involved the human element, such as phishing, errors, or misused access. Verizon

vciso-ownership-03

The exam file

What Examiners Ask to See

Every financial regulator eventually asks for the same core evidence. Compass builds and maintains each item, then keeps it current between exams.

  • Written Information Security Program. The board-reviewed WISP that ties every control to the rules you answer to.
  • Annual risk assessment. Findings ranked by risk, with owners and remediation dates.
  • MFA coverage. Proof that every system touching customer data requires it, with exceptions tracked.
  • Incident response plan. Escalation steps built around each regulator's notification clock, tested on a schedule.
  • Service provider files. Due diligence, contract terms, and monitoring records for every vendor with access to sensitive data.
  • Testing results. Penetration test and vulnerability scan reports, plus the remediation trail.
  • Annual board report. A written summary of program status, risks, and decisions for the board or senior officers.

01 THE CHALLENGE

Financial Services Compliance: One Industry, Many Rulebooks

No single financial services compliance framework exists. Each regulator asks different questions, expects different documentation, and enforces different timelines.

Your obligations depend on the services you deliver, the sensitivity of the data you hold, and the federal and state authorities that supervise your firm. A wealth manager with a New York office, a broker-dealer affiliate, and a client payment portal can answer to four rulebooks at once.

Technology runs through every one of those rulebooks. Compass treats each requirement as a specific control with a specific owner, then builds the evidence once so it answers every regulator that asks.
90% of financial services leaders say compliance has become more complex

of financial services leaders say compliance has become more complex

Over the last three years, according to the PwC Global Compliance Survey 2025, the most recent edition. 82% of all respondents plan to invest more in technology for compliance.

02 Incident notification

The Clock Starts Before You Know the Full Story.

Every regulator sets its own deadline for reporting an incident. Your firm may run on two or three clocks at once, so detection, escalation, and documentation have to work at 2 a.m. on a holiday.
Notification Deadline Regulation / Organization What Triggers the Deadline CompassMSP Coordinated Incident Response
24 Hours NYDFS Part 500 A covered entity makes an extortion payment. DFS must receive notice within 24 hours, followed by a written explanation within 30 days. Escalation and payment documentation Compliance & Risk
36 Hours OCC, FDIC & Federal Reserve A bank determines that a qualifying computer-security notification incident has occurred. It must notify its primary federal regulator. Incident triage, escalation and records Core Defense
72 Hours NCUA / Credit Unions A federally insured credit union reasonably believes it has experienced a reportable cyber incident. NCUA must receive notice. Rapid investigation and incident records Core Defense
72 Hours NYDFS Part 500 A covered entity determines that a reportable cybersecurity incident has occurred, including qualifying incidents involving third-party providers. Incident response and evidence coordination Complete Security
72 Hours* NAIC Insurance Data Security Model Law An insurer or other covered licensee determines that a qualifying cybersecurity event has occurred. State-adopted requirements control. State-specific reporting and evidence Compliance & Risk
72 Hours SEC Regulation S-P / Service Providers A service provider becomes aware of a security breach involving a customer information system it maintains. Covered firms must have procedures requiring timely provider notice. Vendor escalation and notification planning vCISO Advisory
4 Business Days SEC Form 8-K / Public Companies A public company determines that a cybersecurity incident is material. It generally must file an Item 1.05 disclosure within four business days. Technical findings and leadership reporting vCISO Advisory
30 Days SEC Regulation S-P / Customer Notice A covered firm becomes aware that unauthorized access to or use of customer information occurred or is reasonably likely. Qualifying incidents require affected-individual notice, subject to limited exceptions. Data-impact assessment and notice support Compliance & Risk
30 Days FTC Safeguards Rule A covered institution discovers unauthorized acquisition of unencrypted customer information involving at least 500 consumers. It must notify the FTC. Data-scope review and reporting support Compliance & Risk

Deadline context: These are representative regulatory windows, not a universal notification schedule. Each clock begins at the event or determination specified in the applicable rule, and reporting depends on the regulated entity, incident facts, and relevant exceptions. * The 72-hour NAIC figure describes the model law; the state-enacted version controls for an insurer or agency. Confirm obligations and escalation ownership in the incident response plan.

WHO WE SUPPORT

Compliance Support for Every Type of Financial Organization

Pick your firm type to see the rules you answer to, the notification clock you run on, and where Compass focuses first.

One Program. Different Rulebooks.

Know What Applies. Know What Comes Next.

There is no single compliance checklist for financial services. Many firms answer to multiple regulators and face overlapping obligations. CompassMSP helps turn that complexity into a practical security and evidence program.

Map Your Requirements

Identify the rules, regulator expectations, and reporting triggers that apply to your firm.

Close Control Gaps

Prioritize identity, data protection, response, vendor risk, and resilience.

Keep the Evidence Ready

Maintain the policies, test records, and reports leadership and examiners need.

Select a firm type to see representative requirements and notification windows. Applicability depends on each organization's regulatory status and incident facts.

Depository Institutions

Banks and Credit Unions

Examiners expect documented oversight, operational resilience, and evidence that security controls work across your institution and critical vendors.

Your Rulebook

Your Notification Clock

36h / 72h

Covered banks generally notify their primary federal regulator within 36 hours after determining a qualifying notification incident occurred. Federally insured credit unions report qualifying cyber incidents to NCUA within 72 hours after reasonably believing one occurred.

Where Compass Starts

Board-approved information security program, business continuity testing, vendor oversight files, and examiner-ready access and activity logs.

Investment and Advisory Firms

Wealth Managers, RIAs, and Broker-Dealers

Protecting customer information requires a documented response program, strong provider oversight, and proof that access to sensitive records is controlled.

Your Rulebook

Your Notification Clock

30 days / 72h

For covered Regulation S-P incidents, notify affected customers as soon as practicable and generally within 30 days. Covered institutions must have procedures designed to ensure qualifying service-provider breaches are reported to them within 72 hours.

Where Compass Starts

Written incident response program, service-provider notification expectations, periodic access reviews, and a tested business continuity plan.

Professional Services

Accounting and Tax Firms

Taxpayer and client financial data moves through portals, email, workstations, and third-party platforms. Each touchpoint needs appropriate safeguards.

Your Rulebook

Your Notification Clock

30 days

Under the FTC Safeguards Rule, covered institutions report a qualifying event involving unauthorized acquisition of unencrypted information of at least 500 consumers within 30 days of discovery. State and other notice obligations may also apply.

Where Compass Starts

WISP, MFA for client portals and email, endpoint detection, encryption, and documented retention and disposal procedures.

Sponsors and Portfolio Operations

Private Equity Firms

Transaction materials, investor information, and portfolio-company exposure create security questions at the fund, firm, and operating-company levels.

Your Rulebook

  • SEC Regulation S-P for covered registered advisers
  • Investor due diligence questionnaires
  • Portfolio-company cybersecurity diligence
  • Applicable public-company disclosure obligations

Your Notification Clock

Varies by status

Covered advisers may face Regulation S-P's 30-day affected-customer notice requirement. Other deadlines depend on fund structure, affected entities, and applicable law. Investor diligence follows separate timelines.

Where Compass Starts

Deal data protection, firm-level security governance, and repeatable cybersecurity diligence that informs investment and portfolio decisions.

Alternative Investments

Hedge Funds and Investment Firms

Trading systems, privileged accounts, and investor data demand tight access controls and well-defined escalation across internal and external teams.

Your Rulebook

  • SEC Regulation S-P and S-ID, where applicable
  • NFA and CFTC requirements, where applicable
  • FINRA rules for broker-dealer affiliates
  • Investor cybersecurity due diligence

Your Notification Clock

30 days / 72h

For institutions covered by amended Regulation S-P, qualifying customer notices generally have a 30-day outside limit, and provider oversight procedures address notification to the firm within 72 hours of qualifying breaches.

Where Compass Starts

Role-based access for trading and investor systems, privileged access controls, meaningful security logging, and data loss prevention.

Lending Operations

Mortgage Lenders and Brokers

Loan files contain financial records, identity documents, and third-party data that need protection from application through servicing and retention.

Your Rulebook

Your Notification Clock

30 days / 72h

Covered firms report qualifying FTC Safeguards Rule events within 30 days of discovery. NYDFS-covered entities generally report qualifying cybersecurity incidents within 72 hours of determining that an incident occurred.

Where Compass Starts

Encrypted document intake, access controls throughout the loan file, searchable audit logs, and vendor oversight.

Carriers and Agencies

Insurance Carriers and Agencies

Insurance organizations manage policyholder information and an extensive provider network while answering to state-specific cybersecurity requirements.

Your Rulebook

Your Notification Clock

State-specific

NAIC Model #668 calls for notice within 72 hours of determining that a qualifying event occurred. State enactments may set different triggers or deadlines, so the controlling state rule matters.

Where Compass Starts

Risk-based security program, asset inventory, recurring control testing, and organized evidence for leadership attestations and regulator review.

Not Sure Which Rules Apply to Your Firm?

Many firms fall into more than one category. CompassMSP can help identify overlapping requirements and where to focus first.

Get an Exam Readiness Review

03 GRC services for financial firms

Different Regulators. Same Technology Demands.

Financial organizations answer to different regulators, but the same technology requirements keep surfacing. Compass finds where those requirements overlap and builds one set of controls that satisfies every framework that applies to you.
Framework What Regulators Require Evidence You Hand Examiners How Compass Builds It Controls Into Practice
GLBA & FTC Safeguards Rule
Covered accounting and tax firms, nonbank lenders, and other financial institutions under FTC jurisdiction.
  • A Qualified Individual to oversee the information security program.
  • Documented risk assessment, access controls, MFA, and encryption.
  • Continuous monitoring or annual penetration testing and vulnerability assessments at least every six months.
  • Incident response procedures and required FTC notification for qualifying events.
  • Written Information Security Program (WISP) and risk assessment.
  • Access and encryption records.
  • Penetration testing, scans, and remediation records.
  • Annual written report to the board and incident response documentation.
 MFA and conditional access, encryption and retention controls, 24/7 threat monitoring, coordinated testing, and tracked remediation. Compliance & Risk
FFIEC Guidance & Federal Banking Rules
Banks, federally insured credit unions, and other supervised depository institutions.
  • Risk-based security program under applicable GLBA Interagency Guidelines.
  • Business continuity planning, testing, and recovery preparedness.
  • Third-party due diligence and ongoing oversight.
  • Qualifying incident notice within 36 hours for covered banks or 72 hours for federally insured credit unions, under their respective rules.
  • Board-approved security program and risk assessment.
  • Business continuity and recovery test results.
  • Third-party risk assessments and monitoring files.
  • Security logs, testing reports, and incident notification procedures.
 NIST CSF 2.0 control mapping, tested backup and recovery, vendor oversight, centralized logging, and continuous threat monitoring. NIST Framework Services
SEC Regulation S-P, S-ID & FINRA
Covered registered advisers, broker-dealers, investment companies, transfer agents, and FINRA members.
  • Written safeguards and incident response policies under amended Regulation S-P.
  • Affected-customer notice within the applicable 30-day window for qualifying incidents.
  • Oversight procedures designed for service-provider notice within 72 hours of qualifying breaches.
  • Identity theft red-flags and business continuity programs where applicable.
  • Incident response program and response records.
  • User and privileged access reviews.
  • Service-provider assessments and oversight records.
  • Applicable red-flags program and FINRA Rule 4370 business continuity plan.
 Identity lifecycle management, role-based access, data loss prevention, service-provider oversight, and incident escalation planning. vCISO Advisory
NYDFS Part 500
New York-regulated financial services entities subject to the cybersecurity regulation.
  • CISO-led security program, periodic risk assessment, and asset inventory.
  • Required MFA, security testing, and third-party risk controls, subject to scope and exceptions.
  • NYDFS notification within 72 hours after determining a reportable incident occurred.
  • Initial notice within 24 hours of an extortion payment and annual compliance submission.
  • Security policies, risk assessment, and asset inventory.
  • Access, testing, training, and vendor records.
  • Incident and extortion-payment reporting procedures.
  • April 15 annual certification or acknowledgment of noncompliance, as applicable.
 vCISO oversight, MFA and exception tracking, asset ownership, testing schedules, remediation tracking, and regulatory response workflows. vCISO Advisory
State Insurance Data Security Laws
Insurance licensees subject to state requirements based on NAIC Model Law #668. State versions vary.
  • Risk-based information security and cybersecurity event response programs.
  • Protection of nonpublic information and third-party service-provider oversight.
  • Investigation, documentation, and qualifying event reporting to the relevant insurance commissioner.
  • State-specific requirements and reporting deadlines rather than one universal model-law clock.
  • Information security and incident response programs.
  • Risk assessments and inventories.
  • Provider due diligence and assessments.
  • Incident investigation and notification records.
 Risk-based controls, sensitive-data inventories, provider oversight, continuous monitoring, and organized incident evidence. Compliance & Risk
SOC 2 Trust Services Criteria
Independent assurance for clients, partners, and investors. SOC 2 is an attestation, not a regulation.
  • Define the audited system and the applicable AICPA Trust Services Criteria.
  • Design and operate controls supporting stated service commitments and system requirements.
  • Provide sufficient evidence for an independent CPA firm's examination.
  • System description, policies, and control inventory.
  • Access and change management records.
  • Monitoring, testing, and incident documentation.
  • Remediation and management assertion support.
 Readiness and scoping, control implementation, scheduled evidence collection, gap remediation, and coordination with the independent auditor. Compliance & Risk
PCI DSS v4.0.1
Organizations handling cardholder data or systems that can affect its security. PCI DSS is an industry standard.
  • Scope the cardholder data environment and implement applicable access, logging, and protection controls.
  • Complete required scans and tests, including quarterly Approved Scanning Vendor external scans where applicable.
  • Meet applicable v4.0.1 requirements, including provisions effective March 31, 2025.
  • Network and cardholder data flow diagrams.
  • Access, configuration, and segmentation records.
  • Scan and testing reports with remediation evidence.
  • Applicable assessment and attestation documentation.
 Environment scoping, network segmentation, applicable security controls, testing coordination, and reusable audit evidence. Compliance & Risk
SEC Cybersecurity Disclosure Rules
SEC reporting companies, including applicable public portfolio and holding companies.
  • Form 8-K Item 1.05 generally within four business days after determining an incident is material.
  • Annual disclosure of cybersecurity risk management, strategy, and governance.
  • Materiality decisions without unreasonable delay, subject to limited permitted disclosure delays.
  • Incident escalation and materiality decision procedures.
  • Incident timelines and preserved technical evidence.
  • Board and committee cybersecurity reporting.
  • Security governance and risk management descriptions.
 Technical incident escalation to decision-makers, governance documentation, recurring board reporting, and evidence to support disclosures. vCISO Advisory

Summarized from 16 CFR Part 314, 17 CFR Part 248, 23 NYCRR Part 500, NAIC Model #668 and applicable state laws, FFIEC guidance, AICPA SOC 2 criteria, PCI DSS v4.0.1, and SEC Form 8-K Item 1.05. Reviewed October 2026. Applicability depends on charter, registration, license, size, business model, and incident circumstances.

One Control Set, Mapped to NIST CSF 2.0

CompassMSP maps common controls to the six NIST CSF 2.0 functions, helping financial firms maintain evidence that supports multiple applicable frameworks.

Explore NIST Framework Services
GovernOwnership, policy, and oversight
IdentifyAssets, data, and risk
ProtectAccess, encryption, and training
DetectMonitoring and alerting
RespondContainment and notification
RecoverRestoration and improvement

SCOPE OF ENGAGEMENT

Turn Regulatory Requirements Into IT Controls

Every financial regulation eventually becomes an IT requirement. Compass translates those mandates into practical, auditable controls that protect your firm and meet examiner expectations.

Turn Regulatory Requirements Into a Practical Plan.

The Exam Readiness Review maps the rules that apply to your firm, the controls you already have, and the gaps to close fast. This is the first step, and it requires no preparation on your side.
Get an Exam Readiness Review

Connected delivery

Your Controls Are Only as Strong as Your IT

Compliance controls work only when someone maintains them. Compass carries that responsibility into daily IT operations, so strategy and execution stay with one team as your environment, your regulators, and your risks change.

04 THE PROCESS

Exam Readiness on Repeat

Compliance never stops moving. Regulations shift, firms grow, and threats change, so exam readiness has to stay current all year. Compass keeps the controls and the evidence current, so your team can answer examiners, auditors, and investors with confidence.

  1. STEP 01

    Assess

    Review your IT and security environment against the rules that apply to your firm, then rank the gaps that create the most risk.
    You get: Gap report ranked by risk

  2. STEP 02

    Remediate

    Implement or strengthen the technical controls that close those gaps, starting with identity, encryption, and monitoring.
    You get: Remediation plan with owners and dates

  3. STEP 03

    Document

    Build the policies, evidence, and audit trail examiners and auditors expect to see.
    You get: WISP, policies, and evidence library

  4. STEP 04

    Monitor

    Watch the environment around the clock, track changes, and reassess risk as your firm and the rules change.
    You get: Monitoring reports and risk register updates

  5. STEP 05

    Prepare

    Walk into exams, audits, and investor due diligence with organized documentation and someone who knows the file.
    You get: Exam binder and response support
north-star
robot-sharp-solid-full
67% of users access AI services through non-corporate accounts on corporate devices. Verizon

of users access AI services through non-corporate accounts on corporate devices. Verizon

Secure AI governance

Put Guardrails on AI

Microsoft Copilot, ChatGPT, Claude, and other AI tools already sit inside financial workflows. The question for a regulated firm is whether customer, investor, or taxpayer data reaches a model no one approved, with no audit trail to prove otherwise.

Compass brings structure to AI adoption before loose permissions and unapproved tools turn into an exam finding. Work starts with an AI Readiness Map to show where risk already exists, then builds the guardrails, governance, and oversight your team needs to use AI and defend that use if a regulator asks.

Start With an AI Readiness Map

WHY COMPASS

Experience Across Regulated Industries


Compass brings deep experience across regulated industries, and that experience shapes how the team assesses risk, interprets regulations, and builds technology environments that hold up in an exam.

40+ years of combined business heritage

of combined business heritage

350+ technology professionals

technology professionals

100% U.S. based security operations center

based security operations center

24/7 detection, investigation, and response

detection, investigation, and response

Customer success story

CPA Firm Preserves Decades of Trust With Audit-Ready Security Controls

After a security breach and inconsistent IT support, a CPA firm knew its reactive setup left too much room for compliance risk. CompassMSP moved the firm to a proactive, security-first model with endpoint protection, 24/7 monitoring, and disaster recovery. Today, the firm operates with the IT controls and audit-ready documentation regulators expect from CPA firms.

Read the Success Story
0 Disruptions during tax season while the firm moved to a security-first model.

Disruptions during tax season while the firm moved to a security-first model.

24/7 Monitoring across endpoints, with protection and recovery managed by one team.

Monitoring across endpoints, with protection and recovery managed by one team.

1 Accountable partner for IT support, security, and disaster recovery.

Accountable partner for IT support, security, and disaster recovery.

Client success

We have The Receipts.

Prepared firms already have the evidence when an examiner calls. Compass builds documentation and controls into the environment from the start, so your team walks into every audit with proof in hand.
Explore Client Success Stories
clipboard-list-check
99% Consistently prepared for vendor audits and regulatory inquiries through a defensible security posture.

Consistently prepared for vendor audits and regulatory inquiries through a defensible security posture.

stopwatch
40% Reduction in compliance preparation time through structured remediation and automated evidence collection.

Reduction in compliance preparation time through structured remediation and automated evidence collection.

star-badge
73% Reduction in audit corrections and gaps through proactive management of the environment.

Reduction in audit corrections and gaps through proactive management of the environment.

FEATURED RESOURCES

What Financial Firms Need to Watch, Ask, and Prove Next

Stay sharp. Stay secure.

Explore practical guidance on exams, provider selection, and continuous monitoring.
Explore Our Resources
What Makes IT Hard for Regulated Businesses to Manage Without Outsourced IT Services?

IT Modernization 7 min read

What Makes IT Hard for Regulated Businesses to Manage Without Outsourced IT Services?

In-house IT works 40 hours a week, but attackers and 72-hour reporting clocks run all 168. See the 24/7 gaps regulated businesses face and how to fix them.
10 IT Due Diligence Questions for Private Equity Firms

IT Modernization 7 min read

10 IT Due Diligence Questions for Private Equity Firms

Discover essential IT due diligence questions for private equity firms to ensure successful acquisitions and avoid costly post-close surprises.
10 Questions Credit Unions Should Ask an MSSP

Financial Services 6 min read

10 Questions Credit Unions Should Ask an MSSP

Learn the 10 questions credit unions should ask when evaluating MSSPs for 24/7 SOC monitoring and vCISO support to protect member data and meet NCUA requirements.
SEC Regulation S-P: What Examiners Ask to See

Compliance & Risk 6 min read

SEC Regulation S-P: What Examiners Ask to See

The SEC named Regulation S-P compliance a 2026 examination priority. Examiners are now reviewing smaller broker-dealers and investment advisers with a specific document request list. Here is what they will ask for and what most small firms have not built.

FAQs

Answers to Financial Services Compliance Questions

Compliance raises important questions for leadership teams. Financial firms evaluating compliance support ask these most often.

What is financial services compliance?

Financial services compliance means meeting the laws, regulations, and examination requirements that govern how banks, investment advisers, broker-dealers, insurers, lenders, and accounting firms protect customer information and operate their businesses. From an IT and cybersecurity perspective, that includes written security programs, risk assessments, access controls, encryption, monitoring, incident response, vendor oversight, and documentation that proves those controls work. CompassMSP connects Compliance & Risk Management with daily technology operations to help financial organizations maintain those safeguards and the evidence behind them.

What are governance, risk, and compliance (GRC) services for financial institutions?

Governance, risk, and compliance (GRC) services connect a financial institution's policies, risk decisions, and regulatory obligations through one operating model. Governance establishes ownership and accountability. Risk management identifies and prioritizes technical and operational weaknesses. Compliance verifies that required safeguards exist and function as intended. CompassMSP maps technical controls to applicable regulations and frameworks, including the NIST Cybersecurity Framework, so firms can use consistent controls and evidence to address multiple requirements.

Which cybersecurity regulations apply to financial organizations?

The applicable regulations depend on a firm's activities, licenses, and regulators. Many financial institutions have obligations under the Gramm-Leach-Bliley Act (GLBA), including the FTC Safeguards Rule for covered nonbank institutions. Investment advisers and broker-dealers may have obligations under SEC Regulation S-P and FINRA rules. Banks and credit unions follow requirements from their primary regulators and relevant FFIEC guidance. Insurers follow applicable state insurance cybersecurity laws, while New York-regulated entities may fall under NYDFS Part 500. PCI DSS, SEC public-company disclosure rules, and SOC 2 may introduce additional requirements or assurance expectations. CompassMSP helps financial services organizations identify which requirements apply to their operations.

What does the GLBA Safeguards Rule require?

The FTC Safeguards Rule (16 CFR Part 314) requires covered financial institutions to establish and maintain a written information security program appropriate to their size, complexity, and customer information. Requirements include designating a Qualified Individual, assessing risk, implementing access controls and multi-factor authentication, protecting customer information with encryption, managing service providers, training employees, testing safeguards, and maintaining an incident response plan. Covered institutions generally must use continuous monitoring or conduct annual penetration testing and vulnerability assessments at least every six months. Qualifying breaches involving information on 500 or more consumers require FTC notification within 30 days of discovery. The rule provides limited exemptions from certain program requirements for institutions maintaining information on fewer than 5,000 consumers. CompassMSP supports these obligations through Compliance & Risk Management.

Does the FTC Safeguards Rule apply to accounting and tax firms?

Yes. Tax preparation businesses and many accounting firms fall within the FTC's definition of a financial institution under GLBA. The FTC Safeguards Rule requires covered firms to protect customer information through appropriate administrative, technical, and physical safeguards. The IRS reinforces data protection expectations in Publication 4557, including the need for a Written Information Security Plan (WISP). For accounting and tax firms, practical safeguards include MFA, protected client portals, endpoint security, encryption, documented retention and disposal practices, and procedures for applicable incident reporting. CompassMSP supports these needs with IT and cybersecurity services for accounting and advisory firms.

What do FFIEC examiners expect now that the Cybersecurity Assessment Tool is retired?

The FFIEC retired its Cybersecurity Assessment Tool (CAT) on August 31, 2025, but banks and credit unions still face regulatory expectations for information security, business continuity, third-party risk management, and cybersecurity oversight. The FFIEC sunset announcement points institutions toward alternative resources, including the NIST Cybersecurity Framework 2.0 and government cybersecurity guidance. Financial institutions should maintain current risk assessments, documented controls, tested recovery plans, and evidence that monitoring and remediation work. CompassMSP helps institutions map these activities to NIST CSF 2.0 and prepare documentation examiners can review.

What does NYDFS Part 500 require in 2026?

NYDFS Part 500 requires covered New York financial services and insurance organizations to maintain a risk-based cybersecurity program with designated security leadership, documented risk assessments, access controls, asset inventories, testing, and incident response procedures. Requirements include MFA for information system access, subject to applicable exemptions and permitted compensating controls. Covered entities must report qualifying cybersecurity incidents within 72 hours of determination and extortion payments within 24 hours. By April 15 each year, they must submit either a certification of material compliance or an acknowledgment of noncompliance, signed by the highest-ranking executive and CISO, or the responsible senior officer when no CISO exists. Class A companies face additional requirements. Explore CompassMSP's NYDFS Part 500 guidance.

What does the NAIC Insurance Data Security Model Law require?

The NAIC Insurance Data Security Model Law (#668) establishes a model for state insurance cybersecurity requirements. It addresses written, risk-based information security programs, incident investigations, service-provider oversight, and notification of qualifying cybersecurity events. The model includes a 72-hour regulator notification requirement under specified conditions, but actual obligations depend on each state's enacted version. Some states also require annual compliance certifications. CompassMSP helps insurance carriers and agencies identify applicable state requirements, implement technical safeguards, and maintain documentation for regulatory reviews.

What compliance requirements apply to mortgage lenders and brokers?

Nonbank mortgage lenders and brokers may fall under the FTC Safeguards Rule, CFPB oversight, and state licensing and data protection requirements. New York-regulated lenders may also have obligations under NYDFS Part 500. Mortgage files contain sensitive borrower information, including financial records, identity documents, and account details. Examiners and regulators expect appropriate encryption, secure document transfer, role-based access, audit logging, data retention controls, and oversight of vendors that handle borrower information. CompassMSP combines Compliance & Risk Management with managed IT and cybersecurity operations to help lenders maintain these controls throughout the loan lifecycle.

Do the SEC cybersecurity disclosure rules apply to my firm?

The SEC's cybersecurity disclosure requirements apply to covered public-company registrants. Under Form 8-K Item 1.05, a registrant generally must disclose a material cybersecurity incident within four business days after determining that the incident is material, subject to limited permitted delays. Public companies must also address cybersecurity risk management, strategy, and governance in annual disclosures. Private organizations with public portfolio companies or plans to go public should establish escalation and governance procedures that support timely materiality decisions. CompassMSP's vCISO Advisory helps connect technical incident findings with executive risk reporting and oversight.

Does CompassMSP support SOC 2 and PCI DSS?

Yes. CompassMSP supports SOC 2 and PCI DSS readiness by helping organizations define assessment scope, implement technical safeguards, organize control evidence, and address identified gaps. An independent CPA firm performs the SOC 2 examination and issues the report. PCI DSS validation requirements depend on the organization's applicable merchant or service-provider level and assessment method. PCI DSS v4.0.1 is the current standard, with its future-dated requirements becoming effective March 31, 2025. CompassMSP helps financial organizations prepare through Compliance & Risk Management. For payment environments, explore what PCI DSS v4.0.1 requires.

Who provides managed IT services that support FINRA and SEC audit readiness?

CompassMSP provides Managed IT Services, 24/7 threat detection through Core Defense, and strategic security guidance through vCISO Advisory for regulated financial organizations. These services support safeguards relevant to SEC Regulation S-P and FINRA expectations, including access management, incident response, service-provider oversight, business continuity, and documentation. Because CompassMSP connects security with daily IT operations, firms can maintain control evidence that reflects how their systems actually operate.

What should financial firms look for in an IT or security partner for compliance?

Financial organizations should look for a partner that understands their regulatory obligations, maps technical safeguards to applicable requirements, and provides documentation that supports examinations. Evaluate 24/7 monitoring capabilities, incident response procedures, escalation responsibilities, regulatory notification support, and third-party risk management. Ask how the provider coordinates security findings with IT remediation and whether it can explain the evidence behind its reporting. CompassMSP brings together Cybersecurity & Advisory, managed IT, and compliance expertise through one coordinated operating model.

How does a vCISO help financial firms stay exam-ready?

A virtual Chief Information Security Officer (vCISO) provides experienced security leadership without requiring a full-time executive hire. A vCISO can help develop written security programs, lead risk assessments, oversee incident response planning, coordinate vendor reviews, report cybersecurity risks to leadership, and organize evidence for examinations. During an audit or regulatory review, the vCISO helps explain how documented policies align with operational controls. Under NYDFS Part 500, a qualified third-party CISO may fulfill the designated CISO role, although the regulated organization retains responsibility for compliance and oversight. Explore CompassMSP vCISO Advisory.

Why do financial regulators require third-party risk management?

Financial institutions depend on cloud platforms, software vendors, payment processors, and outsourced service providers that may access sensitive data or support critical operations. Those relationships create cybersecurity and operational exposure. The Verizon 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches. Regulators therefore expect appropriate vendor due diligence, contractual safeguards, incident notification arrangements, ongoing monitoring, and documented assessments. SEC Regulation S-P, NYDFS Part 500, the FTC Safeguards Rule, and federal banking guidance all address service-provider oversight. CompassMSP's vCISO Advisory helps connect vendor risk assessments with broader cybersecurity governance.

How can financial institutions adopt AI and stay compliant?

Financial institutions can adopt AI responsibly by identifying approved tools, defining what information those tools may access, and establishing human oversight of AI-generated recommendations and actions. An effective program includes acceptable-use policies, identity controls, data classification, activity logging, vendor reviews, and testing for unintended disclosure of nonpublic information. FINRA's 2026 Regulatory Oversight Report addresses generative AI risks and supervisory considerations, while NYDFS has published guidance on AI-related cybersecurity risks. CompassMSP's AI Enablement & Automation services help organizations assess readiness, establish governance, and introduce AI within appropriate security controls.

What is the difference between cybersecurity compliance and cybersecurity risk management?

Cybersecurity compliance evaluates whether an organization meets the specific controls and obligations established by applicable laws, regulations, contracts, and frameworks. Cybersecurity risk management looks more broadly at threats, vulnerabilities, business impact, and operational exposure, including risks that regulations may not explicitly address. Compliance establishes a required baseline, while risk management helps leadership prioritize improvements based on potential business consequences. CompassMSP connects both disciplines through Compliance & Risk Management and the NIST Cybersecurity Framework, aligning required controls with ongoing risk reduction.

Which compliance advisory services support both financial services and insurance regulations?

CompassMSP provides ongoing compliance advisory for financial services and insurance firms, focused on the cybersecurity and data protection rules both industries share. That includes GLBA and the FTC Safeguards Rule, NYDFS Part 500, state insurance data security laws based on the NAIC Insurance Data Security Model Law, SEC Regulation S-P, FINRA, FFIEC guidance, SOC 2, and PCI DSS.

These rules overlap heavily. The NAIC model law is based on NYDFS Part 500, and both share core requirements with GLBA and Regulation S-P: a written information security program, risk assessments, MFA, incident response, and vendor oversight. Compass builds one set of controls that supports each rule that applies to your firm, then keeps the evidence current between exams.

Firms that also need legal interpretation, licensing, or regulatory filings typically pair Compass with their outside counsel or a regulatory consultant, while Compass owns the IT controls, security operations, and documentation.

How can a mid-sized financial firm manage multiple overlapping regulations?

Start by mapping which rules apply to your firm, then build one control set that satisfies all of them instead of running a separate program for each regulator. A mid-sized firm can easily answer to three or four rulebooks at once, such as GLBA, NYDFS Part 500, SEC Regulation S-P, and a state insurance data security law, but most of their technical requirements are the same.

A practical approach:

  • Map your obligations. Identify every regulator, rule, and notification deadline based on your charter, registrations, licenses, and locations.
  • Build shared controls once. Implement MFA, encryption, access reviews, monitoring, and vendor oversight a single time, and map each control to every rule it supports. A framework such as NIST CSF 2.0 helps organize this.
  • Keep one evidence library. Maintain one WISP, risk assessment, incident response plan, and set of test results that answer every examiner.
  • Track what’s different. Document rule-specific items separately, such as NYDFS annual certification and each regulator’s notification clock.
  • Reassess on a schedule. Review the map when rules change or your firm adds offices, products, or licenses.

Mid-sized firms, typically 20-1,000 employees, often lack a full in-house compliance and security team. CompassMSP provides that capacity through vCISO guidance, managed security operations, and ongoing documentation support.

 

Should we choose one-time compliance projects or ongoing compliance support?

A one-time project works for a defined need, such as a gap assessment, a policy rewrite, or exam preparation. Ongoing support is the better fit when your firm answers to multiple regulators, faces recurring requirements, or doesn’t have dedicated compliance and security staff.

Most financial and insurance regulations assume continuous activity, not a single effort. NYDFS Part 500 requires annual certification, and the FTC Safeguards Rule requires an annual written report to the board along with continuous monitoring or regular penetration testing and vulnerability scans. Across these rules, risk assessments, vendor reviews, and incident response testing all repeat. A one-time project leaves your firm compliant on the day it ends, but controls drift, staff change, and rules are amended.

Many firms combine the two: a one-time assessment to establish a baseline and remediation plan, followed by ongoing support to keep controls running and evidence current. CompassMSP offers both, starting with an Exam Readiness Review and continuing with year-round monitoring, documentation, and exam preparation.

Turn Compliance Complexity Into a Clear Plan.

Compass builds your compliance strategy around your regulators, your data, and your growth plans. The Exam Readiness Review is the first step, and it requires no preparation on your side.

Ready to secure your future? Here is what happens next:

  • Discovery
    A short call to understand your compliance posture, your regulators, and what is worrying your team.

  • Assessment
    A review of your infrastructure, controls, and documentation against the frameworks that apply to you.

  • Plan
    A prioritized plan to close gaps, strengthen IT controls, and stay exam-ready going forward


Prefer to talk now? Call (833) 444-2677 or email getITdone@compassmsp.com

Get in Touch