Direct Answer: Financial firms in California must keep a written information security program, protect client data under SEC Regulation S-P, and follow state privacy and breach rules. In practice that means MFA, endpoint protection, backups, and documented policies.
One local financial professional put it about as plainly as anyone could: they try their best to be cyber-safe, but they want to be sure they are doing everything they can to protect client data. That is the exact worry we hear from advisers across Monterey County.
Financial firms hold the kind of data criminals want most. Account numbers, Social Security numbers, statements, tax documents, and wire instructions all sit in one place, usually inside a Microsoft 365 mailbox and a cloud portfolio platform.
And the rules that govern that data are stacked in layers: federal, SEC, and California. This guide walks through what those rules actually ask for, why email is the first place to look, and what a right-sized IT setup costs a 1 to 10 person firm in Salinas, Monterey, or Pacific Grove.
The Three Rulebooks a Central Coast Financial Firm Sits Under
You do not need to memorize regulation numbers. But you do need to know that three separate sets of requirements apply at the same time, and none of them cancel out the others.
- Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule. This is the one that requires a written information security program, a named person responsible for it, a documented risk assessment, multi-factor authentication, encryption of customer data, and a plan for what happens after an incident. The FTC publishes plain-language guidance in what your business needs to know about the Safeguards Rule.
- SEC Regulation S-P. If you are a registered investment adviser or broker-dealer, this governs how you safeguard client records and information. Recent amendments add an incident response program and a duty to notify affected clients after certain data events.
- California privacy law (CCPA/CPRA) and state breach notification rules. California adds a state-level layer on top of the federal ones, including notification duties when personal information is exposed.
The practical takeaway is simple. Regulators do not just ask whether you are secure. They ask you to show the documentation, and that is where most small practices come up short.
Your Cloud Platform Handles Uptime, Not Your Security Program
The most common gap we see in small financial practices is not a missing firewall. It is the assumption that the cloud vendor covers security.
That assumption is right about uptime and server maintenance. It is wrong about almost everything else that gets a firm in trouble.
Picture the actual attack surface of a one-person shop in Carmel or Marina:
- A laptop that goes home every night and connects to a home network
- A phone with the work mailbox and the authenticator app on it
- A browser holding saved logins to the custodian and portfolio platform
- A Microsoft 365 mailbox with years of client PDFs and wire instructions
- A shared folder that gets links sent to clients and CPAs
Your cloud provider does not protect you from a stolen password, a phishing email that lands in your inbox, a compromised laptop, or a document accidentally shared with the wrong person. Those are all yours.
We cover more of the recurring patterns in 5 cybersecurity gaps that keep showing up in small business networks. Financial firms hit the same ones as everyone else, they just have more to lose when it happens.
Email Is Where Financial Firms Actually Get Hit
If you only fix one thing this quarter, fix email. Attacks aimed at advisers usually do not look like attacks. They look like a note from a custodian, a clearing firm, or a client changing wire instructions at the last minute.
Two controls do most of the heavy lifting, and plenty of small firms still do not have both.
Multi-factor authentication (MFA) means a password alone will not open your mailbox. Even if someone buys your password on a criminal forum, they still need the code or the prompt on your phone. Text message codes are better than nothing, but an authenticator app or a hardware key is stronger.
DMARC works on the other direction of the problem. It tells receiving mail servers what to do with messages that claim to come from your domain but did not. Paired with SPF and DKIM, it makes it much harder for someone to email your clients while pretending to be you.
A local user recently reached out asking for DMARC setup specifically, which tells you the awareness is spreading. Getting it right takes a staged rollout:
- Publish SPF and DKIM records so your legitimate mail is signed
- Start DMARC in monitoring mode and review the reports
- Fix any real senders that fail, such as a newsletter tool or e-signature platform
- Move to quarantine, then reject, once the reports come back clean
Skip the staging and you will bounce your own client review reminders. That is why this is worth doing deliberately rather than flipping a switch.
The Baseline Controls a Small Financial Firm Should Have
These six controls cover the bulk of what GLBA, Regulation S-P, and California privacy rules expect from a small practice.
What Your Cloud Vendor Covers vs. What Your Firm Covers
This split surprises a lot of advisers the first time they see it written out. Here is the general division of responsibility for a typical small firm running on a cloud productivity suite.
| Area | Cloud platform usually covers | Your firm is responsible for |
|---|---|---|
| Server uptime and patching | Yes, handled by the vendor | Nothing, aside from license management |
| Account access | Provides MFA as an option | Turning it on and enforcing it for every user |
| Email threats | Basic spam and malware filtering | Phishing training, DMARC setup, wire verification steps |
| Laptops and phones | Not covered | Endpoint protection, encryption, remote wipe |
| Data retention and recovery | Limited retention windows | A separate backup of mailboxes and files |
| Written policies and evidence | Not covered | Your information security program and records |
What Right-Sized Managed IT Looks Like for a 1 to 10 Person Firm
None of this requires enterprise spending. A small RIA in Pacific Grove or a two-partner CPA office off Main Street in Salinas needs a short, defensible list, not a security operations center.
A sensible arrangement for a firm of that size generally includes:
- Endpoint protection and monitoring on every device, including personal phones that touch work email
- MFA enforced across email, the custodian portal, and the portfolio or accounting platform
- A separate backup of Microsoft 365 data so a deleted mailbox or ransomware event does not take your records with it
- Written security policies and a documented risk assessment you can hand to an examiner or an insurance underwriter
- A support number that a real person answers, with clear response expectations
On cost, per-user managed IT pricing in the Monterey Bay market varies a lot depending on how many devices you run, whether you need compliance documentation, and how much cloud infrastructure sits behind you. Small offices here typically budget on a fixed monthly per-user fee rather than hourly billing, which is the whole point of moving off break-fix. We broke down that math in break-fix IT vs. managed IT cost comparison. For an actual number, ask a provider to quote your specific user count and platforms.
The local piece matters more for financial firms than for most businesses. Markets open at 6:30 a.m. Pacific, and a login problem at 6:15 is not a next-business-day ticket. Add in PG&E outages during wildfire season and the occasional Highway 68 and Highway 1 disruptions, and a provider who can drive to your office beats one who cannot. One local review put the value plainly: a plan built around their size and budget, with quick responses and reliable security.
Law offices in the region face a similar compliance and confidentiality mix, and we covered that overlap in what law firms should expect from a managed IT partner.
Frequently Asked Questions About IT and Cybersecurity for Financial Firms
I’m a solo adviser with one laptop. Do these rules really apply to me?
Yes. The GLBA Safeguards Rule and Regulation S-P apply based on the type of information you handle, not your headcount. A one-person firm still needs a written information security program, though it will be far shorter than a large firm’s. The scale of the program flexes with your size and complexity.
Doesn’t Microsoft 365 already back up my email?
Not the way most people assume. Microsoft keeps your service running and holds deleted items for a limited window, but that is retention, not backup. If a mailbox is compromised, a folder is purged, or an account is deleted during a staff change, a separate backup of your 365 data is what gets it back.
What is DMARC in plain English?
It is a rule you publish for your email domain that tells other mail servers how to handle messages pretending to be from you. Without it, someone can spoof your address and email your clients with fake wire instructions. With it set to reject, most of those messages never arrive.
How long does it take to get a small financial office to a defensible baseline?
For a firm under ten people, the technical work is usually a matter of weeks, not months. MFA and endpoint protection go in first, backups and email authentication follow, and the written policy work runs alongside. The staged DMARC rollout is often the longest single piece because you want to watch the reports before tightening the rules.
What happens if client data is exposed?
California has notification requirements, and depending on your registration, Regulation S-P adds its own notice duties. This is exactly why an incident response plan is part of the rules rather than an optional extra. Deciding who calls whom, in what order, is not something you want to figure out on the day it happens.
Want a Clearer Picture of Where Your Firm Stands?
If you are a financial professional in Salinas, Monterey, or anywhere across Monterey County, CA and you are not sure whether your current setup would hold up to an examiner’s questions, a straightforward assessment is a reasonable place to start. Adaptive Information Systems works with small and mid-sized organizations across the region on security, Microsoft 365 support, and documentation. You can reach our team at (831) 644-0300 or at adaptiveis.net whenever you want to talk it through.
