Five IT Gaps We Find in Phoenix Area Financial Advisory Firms

We work with a lot of financial advisory firms across Scottsdale, Mesa, Chandler, and Glendale. Most of them look buttoned-up from the outside. Professionally designed offices, polished client materials, well-run operations. The IT infrastructure, more often than not, hasn’t kept pace. The SEC’s Regulation S-P amendments are now fully in effect, including for smaller firms, as of the June 3, 2026 compliance deadline. If your program hasn’t caught up yet, the gap between appearance and reality is carrying real compliance and operational risk right now, not down the road. Here are the five issues we find most often.

• 1 Email Without Multi-Factor Authentication
  Email Security

  The most common entry point for credential theft isn’t a sophisticated attack — it’s a phishing email that captures a password because there’s no second factor to stop it. In a significant number of the advisory firms we assess, Microsoft 365 or Google Workspace is deployed without multi-factor authentication enforced at the tenant level. Individual users may have it turned on, but tenant-level enforcement isn’t in place, meaning a single employee who skips setup is an open door.

  What we typically find: MFA optional rather than enforced, legacy authentication protocols still enabled, and no Conditional Access policies (for Microsoft environments) restricting sign-ins from unusual locations or devices.

  Why it matters for SEC compliance: The SEC’s Regulation S-P amendments require firms to have documented policies around access controls and authentication. A breach originating from a compromised email account without MFA is exactly the kind of incident examiners will ask about.

• 2 No Complete Device Inventory
  Asset Management

  Ask most small advisory firms to produce a current list of every device that can access client data (laptops, desktops, tablets, phones) and you’ll get a long pause. Many have some version of a list, but it’s out of date, lives in a spreadsheet someone last touched two years ago, and doesn’t include personal devices employees use to check email.

  What we typically find: No mobile device management (MDM) solution, personal devices accessing firm email and cloud storage without endpoint controls, and departed employees whose devices were never formally deprovisioned.

  Why it matters: You can’t protect what you haven’t counted. An unmanaged personal laptop running outdated software and connecting to client data is a liability, both operationally and under Regulation S-P, which requires firms to safeguard customer information across all systems that access or store it.

• 3 Remote Access Running on RDP
  Remote Access

  Remote Desktop Protocol (RDP) running on port 3389 with direct internet exposure is one of the most targeted attack surfaces in existence. It’s also one of the most common configurations we find in small advisory firms that set up remote access during the pandemic and never revisited the architecture.

  What we typically find: RDP exposed directly to the internet, weak or reused passwords on remote access accounts, no VPN requirement before RDP access is granted, and no logging of remote sessions.

  Why it matters: RDP brute-force attacks and credential stuffing targeting port 3389 are a primary delivery mechanism for ransomware. A firm with client financial data and no adequate backup strategy is in a very difficult position if ransomware executes successfully.

  The fix: At minimum, RDP should sit behind a VPN with MFA. Better options include modern zero-trust remote access tools that don’t expose RDP to the public internet at all.

• 4 Printers and Copiers Storing Client Documents
  Print Security

  Modern multifunction printers and copiers have internal hard drives that store images of every document scanned, printed, copied, or faxed. Most firms have no idea this is happening. A copier that scanned account statements, tax documents, and client agreements for five years has accumulated a significant archive of sensitive data. When the lease ends and the device goes back, that data often goes with it.

  What we typically find: No documented process for hard drive wiping at end of lease, default admin credentials unchanged on the device’s network interface, and printer firmware that hasn’t been updated since installation.

  Why it matters: Print infrastructure is a blind spot in most firms’ security thinking. It sits on the network, holds sensitive data, and is rarely included in security audits. That’s exactly why it’s worth paying attention to.

• 5 No Current WISP or Incident Response Plan
  Compliance & Planning

  The SEC’s 2024 amendments to Regulation S-P require registered investment advisers to maintain a written incident response program (commonly called a WISP, or Written Information Security Plan) and documented procedures for handling data breaches. In Phoenix metro, most small advisory firms either don’t have one, have one that was written years ago and never updated, or have one that lists vendors and contacts that no longer exist.

  What examiners look for: A WISP that’s current, tailored to the firm’s actual systems, and includes a realistic incident response plan with named contacts, escalation steps, and a clear notification process. A generic template downloaded from the internet doesn’t meet that bar.

  Under Reg S-P, if a breach occurs, firms must notify affected customers within 30 days of becoming aware of it. That means your team needs to know in advance, not during the incident, who contacts whom, what qualifies as a reportable breach, and what the customer notification process looks like. Smaller advisory firms became subject to these requirements as of the compliance deadline on June 3, 2026. If your WISP hasn’t been reviewed against the current rule yet, that review is overdue, not upcoming.