Challenge
Institutional investors were sending long security questionnaires, and the firm lacked a documented programme, consistent policies or a clear view of where client data lived.
Approach
A virtual CISO built a risk-ranked roadmap, we documented policies and controls to ISO/IEC 27001 and SOC 2 principles, hardened email with DMARC and anti-impersonation protection, and classified client and portfolio data.
Outcome
Typical outcomes: faster, consistent answers to questionnaires, a board-ready security report each quarter, and reduced exposure to payment-diversion email fraud.
This is an anonymised, representative scenario based on the type of work we do in this sector. It does not describe a specific client or guarantee a specific result.