Managed IT + Security
This is Managed IT with a security program built in, for firms whose clients, regulators, or investors ask how they protect data. Most financial advisors and fintechs we work with choose it. It starts at $175 per user per month, with a $3,000 monthly minimum.
What's included
- Everything in Managed IT (the Essentials plan)
- Endpoint detection and response on every laptop, watched around the clock by a security operations center
- Alerts on suspicious sign-ins to Microsoft 365 or Google Workspace
- Email filtering for phishing and impersonation
- Phishing simulations and short security training for staff
- Written security policies: acceptable use, access control, incident response, vendor management, and the others auditors ask for
- A hardening review every quarter, with a record of what changed
- An annual risk assessment
- Answers to customer security questionnaires, up to two per quarter
Not included
- Onsite work, which is billed hourly and available in the New York City area.
- Penetration testing. We can scope one and manage the vendor.
- SOC 2 and ISO 27001 projects, which are priced separately.
- Questionnaires beyond two per quarter, which are quoted individually.
The first 30 days
- Week 1: inventory of accounts, devices, and apps. Admin access brought under control.
- Week 2: endpoint protection and sign-in monitoring deployed. Multi-factor authentication enforced.
- Week 3: email filtering turned on. Backups checked with a test restore.
- Week 4: written findings, a ranked list of fixes, and draft policies for your review.
How long it takes
Onboarding takes three to six weeks. Security tools are in place within the first two.
What changes the price
- Number of people and devices
- Regulatory exposure: SEC or FINRA oversight, payments, banks as customers
- How many SaaS tools and cloud accounts you run
- How much cleanup your environment needs before we can run it
- Which frameworks and how much of the business are in scope
- Deadlines, such as a customer who needs a SOC 2 report this quarter
Recent work
An AI data readiness and migration platform for financial services
We ran their IT and secured it. Their customers are financial institutions, so their security had to hold up to outside review.
Questions
- Does this get us SOC 2?
- Not by itself, but it puts most of the technical controls in place. A SOC 2 project on top of it is shorter, because the remaining work is documentation, evidence, and the audit.
- We are a registered investment adviser. Does this help with Regulation S-P?
- Yes. The amended rule requires a written incident response program, oversight of your service providers, and notice to affected clients within 30 days of certain breaches. The policies, monitoring, and vendor reviews in this plan cover the parts most firms are missing.
- Is there a contract?
- Twelve months at list price, or month to month at list price plus 10% with 60 days notice.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.