Stratum Tech Group · Katy, TX
Written cybersecurity policies for your advisory firm, built on the FTC Safeguards Rule and your state's rule, filled in for you.
State-registered investment advisers in many states must keep written physical security and cybersecurity policies and procedures covering five functions, review them every year, and deliver a privacy policy to clients. Answer about 40 short questions (5 required) about your firm, custodians, software and current safeguards. Get your policies, risk assessment, incident response plan, client privacy policy draft and a dated gap list as a Word file and a printable page.
One-time price, no subscription. Delivered on screen right after checkout and by email. 14-day refund if it doesn't fit your firm.
What you get
Policies by the five functions
Identify, Protect, Detect, Respond and Recover, written around your custodians, CRM, planning software, email, storage, e-signature and archiving, with the person responsible for each.Your state's rule cited
Exact cites for Virginia (21VAC5-80-260), South Carolina (13-413), Kentucky (KRS 292.336(6)) and Michigan (R 451.4.21). Other states get the NASAA model rule wording with a line to confirm your state's version. Texas has no version of this rule that we found, so Texas firms get the FTC Safeguards Rule program with the five functions as good practice.FTC Safeguards Rule crosswalk
Advisers not registered with the SEC are named in the FTC Safeguards Rule (16 CFR 314.1). A table maps 314.4(a) to (j) to your policy sections, with the under-5,000-consumer handling of 314.6.Privacy, review and gap list
Client privacy policy draft and delivery log (engagement, yearly, on change), annual review record, Qualified Individual annual report template, vendor list, training sign-off, data map, dated gap list.Texas firms
If your home state or any state you are registered in is Texas, your program adds a Texas page: when a cybersecurity incident needs another notice (to a regulator, law enforcement, or clients under a breach law), 7 TAC 116.23 asks you to send the Texas Securities Commissioner a copy at the same time, with the number of Texas clients affected if you know it. The page also holds a placeholder for the written system 7 TAC 116.21 asks for on suspected financial exploitation of vulnerable adults.
Price
RIA WISP Instant
- Policies and procedures by the five functions
- Risk assessment, incident response plan, FTC notice steps
- Client privacy policy draft and delivery log
- Annual review record, vendor list, training sign-off, gap list
- Word file and printable page, yours to edit
For comparison
What it is not
Not a security audit, not penetration testing, not monitoring, not a compliance review and not legal advice. Your IT provider or compliance counsel can help with those; the gap list shows where.How it works
- Answer about 40 short questions (5 required) about your firm, systems, safeguards, people and privacy practices (about 10 minutes).
- Pay $249 through Stripe checkout.
- Your program opens on screen and arrives by email. Download the Word file and fix anything that doesn't match how you work.
- Have your compliance counsel review the privacy policy, work through the gap list by its dates, train staff, then sign the adoption page.
Questions
Does my state have this rule?
We read the adopted text in Virginia, South Carolina, Kentucky and Michigan word for word on 2026-11-09, and the program cites them exactly. Many other states adopted a version of the NASAA model rule; some did not, or changed it. For those states the program uses the NASAA model wording and tells you to confirm your state's version with your regulator or counsel. Texas: we did not find a Texas version of this rule; Texas firms get the FTC Safeguards Rule program, the 116.23 notice steps and the 116.21 placeholder, with the NASAA functions as good practice.
Is this for SEC-registered advisers?
No. Regulation S-P is the SEC's privacy rule for SEC-registered firms. This program is written for state-registered advisers under their state rule and the FTC Safeguards Rule, not for Regulation S-P.
Does this mean we pass our exam?
No document can promise that. The rules ask you to keep written policies and also to carry them out. This gives you the written policies built around your answers and a dated list of what is still missing.
Is this legal advice?
No. Stratum Tech Group is an IT company, not a law firm. Have your compliance counsel review it, especially the client privacy policy.
Can I edit it?
Yes. The Word file is yours. Review it every year; the program sets your next review date.
What do you do with my answers?
We use them only to build your program. We never ask for client data and never sell your information. See terms and privacy.