Stolen logins. Spoofed wires. An examiner who asks for proof.
An adviser is attacked through its inbox: a phished password, a quiet sign-in, a client's “urgent” transfer request that isn't from the client. Alden runs the controls that stop it on every identity and device, 24/7 — and produces the evidence your examiner, your carrier and an acquirer ask for, under one monthly agreement.
The rule now asks for things a policy alone cannot answer.
Since the amended rule took effect, every adviser needs a written incident response program, 30-day notice to affected clients, and a 72-hour notification clause with service providers. Your examiner will ask for the program, the contracts, and proof that the controls behind them actually run.
The written program
Incident response, service-provider oversight and the safeguards policies — written to match the tenant as it is configured, not as someone hoped it was.
The contracts
A vendor register showing which service providers have signed the 72-hour notice clause, and which are still outstanding.
The proof the controls run
Dated exports from Entra, Intune, Purview and the detection platform, attested, filed the day they are produced.
If the honest answer is “mostly,” the assessment shows exactly which parts are missing: $995 to start, three weeks, report yours either way.
Tools collect data. A program tells you what it means.
Every adviser has software. Few have someone reading it every day and writing down what happened. That is the difference between a stack and a program.
Every month, in plain English, you learn:
- ✓Which sign-ins and devices meet policy, and which fell out of line.
- ✓What was patched, what is overdue, and what we did about it.
- ✓Who finished training, and who clicked the test phish.
- ✓What changed in your environment, and who approved it.
- ✓Whether last quarter's backup actually restored.
- ✓How your controls map to Reg S-P, Reg S-ID, your policies and Florida law.
We flip the model.
Most firms buy IT support and add security when the insurer or the examiner asks. Controls drift between renewals, evidence is assembled in a scramble, and the firm is only as secure as its last questionnaire. Alden runs a fixed cycle on your environment, every quarter, and writes down what it finds.
Assess
Tenant, devices, vendors and the written program scored against the rule and the carrier application.
Harden
Conditional access, device compliance, data loss prevention, backup, detection and response — configured to the baseline.
Watch
24/7 managed detection on every identity and device. Drift corrected. Alerts read by a person.
Prove
Dated, attested exports filed into the binder; monthly report to you; quarterly review with your CCO.
Every quarter, on your environment. Every result written down and kept.
Built for one kind of firm, by the person who will run yours.
Illustrative. Your score is built from your own controls, and every line links to the evidence behind it.
Built for the technical half of Reg S-P
We draft the incident response program, track which vendors have signed the 72-hour clause, and keep the proof current — so the program, the contracts and the tenant say the same thing at the exam.
Sized for a $350M to $1.5B firm
Your firm runs on Microsoft 365, a custodian, a CRM and a portfolio platform. We secure the identities and devices that touch client data and leave your custodian and your CCO's program exactly where they are.
One evidence pack, three audiences
The SEC document request, the cyber renewal application and an acquirer's due-diligence questionnaire ask overlapping questions. The same dated binder answers all three, exported straight from the consoles rather than retyped.
Alongside your CCO, not instead of them
We own seven security documents. Code of Ethics, Marketing Rule, custody, Form ADV and the annual review stay with your CCO or consultant, and we work beside them rather than over them.
We are a service provider too. Here is our file.
Reg S-P expects you to review the vendors who touch client data — including us. Our security program, incident response plan, continuity plan and vendor inventory are written, current and ready to send, so your oversight of Alden takes an afternoon, not a quarter.
Start with a conversation, not a contract.
Twenty minutes to confirm fit — assets, headcount and Microsoft 365. If it fits, you start with a $995 assessment that counts toward onboarding, and its report is yours whether or not you continue.
How we describe our work
Alden's assessments are point-in-time observations against named standards: Regulation S-P, Regulation S-ID and your cyber insurer's application as written. We build and operate controls and produce the evidence behind them. We do not audit or certify your firm, and we do not provide legal advice. Your firm reviews and signs its own attestations. Regulators and insurance carriers make their own determinations; our work supports insurability and exam readiness, it does not guarantee either. Our controls reduce the likelihood and impact of the attacks described; no control prevents all of them.