Advisor Armor - Information and Cybersecurity Compliance Mock Examination

First Name*

Last Name*

Primary Email*

Company Name*

Are you representing a company? If yes, complete this field with your official company name. If you are not representing a company, then just leave the company field blank.

Cybersecurity Manager

Chief Compliance Officer

Please provide an inventory identifying where and how client NPI is maintained or stored, including a list of all third-party systems that are used to store client NPI.

Provide documentation of any risk assessments related to cybersecurity threats, vulnerabilities, and potential business consequences.

Please provide policies designed to protect client NPI, both at rest and in transit. If different policies and procedures apply to remote offices, or working from home, please ensure these policies and procedures are included.

Please provide any reports or documentation to evidence enforcement of policies and procedures or the effectiveness of such policies and procedures.

Please provide a list of all Vendors with access to the network, systems, or data. Include a brief description of the service the Vendor provides and if an executed contract is in place that addresses the Vendor’s safeguarding practices.

Please provide Information on any actual or suspected breaches of the firm’s data that led to, or may have led to loss, exfiltration, or unauthorized access to client NPI, including for each incident

Below, please check each the cybersecurity management practices currently in place AND that written policies and procedures accurately reflect such.

Regulation S-ID (if applicable) for addressing the risk of client identity theft

Training on cybersecurity and safeguarding of client NPI for Supervised Persons

Penetration testing and vulnerability scans

System and software patch management

Verification of the authenticity of a client request to transfer funds

Data loss prevention, including, monitoring of removable storage devices, and personal devices used by Supervised Persons for business purposes

Monitoring exfiltration and unauthorized distribution of client NPI outside of the Adviser through email, physical media, hard copy, web-based file transfer programs, or via other electronic means

Password requirements for Supervised Persons, including complexity, and change frequency

Electronic transmission of client NPI to or from its Supervised Persons

Management of network and information access rights to 1) prevent unauthorized persons from accessing network resources and devices, 2) control access to information based on the need for the information to carry out role or job functions, and 3) timely revise access rights in the event of changes in employment status or job functions

Standards related to login attempts, failures, lockouts, and unlocks or resets

Standards regarding any remote devices (i.e., Adviser-issued and personal devices) used to access the Adviser’s system externally, including any encryption of such devices and the Adviser’s ability to remotely monitor, track, and deactivate these devices

Detection and mitigating responses to cybersecurity incidents

Vendor cybersecurity monitoring and due diligence on the cybersecurity for vendor service providers that are given, or have access to, client NPI