We run your firm's security. You hold the proof.
Your firm is attacked the same way every time: a stolen password, a spoofed email, a wire instruction that looks right. We run the controls that stop it on every identity and device, 24 hours a day — and keep the evidence that proves it, for whoever asks.
- Investment advisersReg S-P · account takeover/
- Title & escrowALTA Pillar 3 · wire fraud/
- CPA & tax firmsIRS WISP · stolen returns/
- FTC Safeguards Rule16 CFR 314/
- Cyber insurancerenewal-ready answers/
- Microsoft 365switched on, watched/
Your firm gets attacked the same three ways. Every time.
Not zero-days. Not nation-states. A stolen password, an email that looks right, a laptop left in a car. Each one has a control that stops it and a record that proves the control was on.
Account takeover
A phished or reused password, then a quiet sign-in from somewhere your people have never been — and a mailbox the attacker can read for weeks.
- ✓Phishing-resistant sign-in on every account
- ✓Legacy sign-in protocols blocked; access conditioned on a managed device
- ✓Admin accounts separated and protected
- ✓24/7 identity monitoring with a person on the other end
- Sign-in and conditional-access exports
- Alert and response log
- Quarterly access review
Email fraud and diverted payments
A forwarding rule nobody noticed, a look-alike domain, a last-minute change to wire or payoff instructions that sounds exactly like the client.
- ✓Outside auto-forwarding off; mailbox rules watched
- ✓SPF, DKIM and DMARC enforced on every domain you send from
- ✓Phishing and impersonation screening on inbound mail
- ✓Call-back verification procedure, trained and tested
- DMARC and mail-flow reports
- Mailbox-rule audit
- Training and phishing-test records
Ransomware and lost devices
A malicious attachment that encrypts the shared drive, or a laptop with client files that never comes back from the airport.
- ✓Every device enrolled, encrypted, patched and remotely wipeable
- ✓Endpoint detection and response, 24/7
- ✓Client files open only on managed devices
- ✓Backups of mail, files and Teams with a quarterly restore test
- Device compliance and patch reports
- Detection coverage report
- Restore-test record
No control prevents every attack. These reduce the likelihood and the impact of the ones that actually hit firms your size — and produce the evidence that they were running when it mattered.
The free self-check walks through each one in about five minutes. You can read it without giving us an email address.
A rule to meet. Someone who will ask for proof.
Firms on Microsoft 365 with client data worth protecting, and an examiner, underwriter, carrier or the IRS who expects to see the controls and the evidence. Pick your industry.
Investment advisers
The technical half of Regulation S-P and S-ID, run every day and evidenced for your CCO, your examiner and your carrier.
Title & escrow
ALTA Best Practices Pillar 3, the FTC Safeguards Rule and the wire-fraud controls that stop a diverted closing, in one program your underwriter can read.
CPA & tax firms
The written information security plan your PTIN renewal asks about, the Safeguards Rule controls behind it, and the records that prove both.
Fractional CCO, compliance consultant, CPA, attorney or insurance broker with a client who needs this? Start on the partners page →
This is what “proof” looks like.
Every tool we run produces a record. We organize those records the way an examiner, an underwriter or an acquirer asks for them, so the answer to “show me” is a document, not a scramble.
Every gap, ranked.
Written for a principal and a board rather than an IT department. Yours to keep whether or not you continue.
What drifted, what we fixed, who approved it.
In plain English, on the first business day of every month, with the evidence behind every line.
One binder, three audiences.
Dated, attested exports straight from the Microsoft consoles. The same binder answers the examiner, the carrier and an acquirer's due-diligence team.
One path. Three stages.
Every firm starts with the assessment, under one agreement that runs straight into onboarding and the monthly program. Stop at the readout and the findings report is still yours.
Security & compliance assessment
A fixed-fee review of your Microsoft 365 tenant, devices, vendors and written program, scored against your rule and your insurer's application. You get a ranked findings report you can hand to a principal, an examiner or a board.
Onboarding & remediation
We close the gaps the assessment found — conditional access, device compliance, data loss prevention, 24/7 detection and response — and write the policies that describe each control exactly as configured.
Managed compliance
Month after month we run the stack, watch the alerts, keep the evidence current and sit beside you through exams, renewals and questionnaires. Priced per user, with no add-ons.
- ✓The controls we configure are the controls your policies describe.
- ✓Every control produces evidence, filed the day it is produced.
- ✓One agreement covers tools, licenses, monitoring, policies and proof.
- ✓One named contact who knows your firm, with a security support line behind them.
Built on Microsoft 365, run by people who read the rule.
Your firm already pays for Microsoft 365 Business Premium. Most of the controls your regulator and insurer expect — identity protection, device management, data loss prevention and backup — are in it and switched off.
We turn them on, standardize them across your tenant, add 24/7 managed detection and response, and write the policies that describe exactly what we configured. Then we watch for drift and put it back. Switched on and watched, these are the controls that stop the three attacks above.
Is Alden the right firm for yours?
We take on one new firm at a time and keep it. That only works if the fit is right on both sides, so we would rather say so early than sell you something smaller.
Alden is a fit if
- ✓Your firm handles client data someone regulates.
- ✓You run on Microsoft 365, with little or no on-premises infrastructure, or are willing to get there.
- ✓An examiner, underwriter, carrier or the IRS asks you for proof, and you want one accountable party for security, policies and evidence.
- ✓You are prepared to meet your cyber insurer's baseline requirements, including the tools and licenses that go with them.
Alden is not a fit if
- ✕The firm runs on Google Workspace. Our controls are built on Microsoft 365.
- ✕You are looking for a cheaper version of this, or a menu to pick from. There is one offer and it is all of it.
- ✕You need general IT support, hardware or help-me-with-my-printer service. That is not what we do.
- ✕You want someone to replace your CCO or compliance consultant. We work beside them, not instead of them.
Twenty minutes confirms it. If it isn't a fit, we'll say so on the call and point you to someone who is.
Plain-English notes for the people who get asked.
Regulation S-P: the 72-hour clock is now your problem.
What the amended rule asks of a small adviser, and which of your vendors have actually signed the notice clause.
ALTA Pillar 3, translated into a Tuesday afternoon.
The six things your underwriter's certification form is really asking, and the export that answers each one.
You checked the WISP box on your PTIN renewal. Now what?
What a written information security plan has to contain, what the IRS expects behind it, and how long it takes to build one properly.