IT Support for Financial Services Firms: A Security and Compliance Checklist for Ontario Advisors, Dealers and Brokers

The security expectations a financial firm answers to depend on what kind of firm it is. In plain terms:

• Investment dealers and mutual fund dealers are members of CIRO, the Canadian Investment Regulatory Organization, whose rules include cybersecurity expectations and the reporting of cybersecurity incidents.
• Portfolio managers, exempt market dealers and investment fund managers are registered with the Ontario Securities Commission, and the Canadian Securities Administrators have published staff guidance on cybersecurity for registrants.
• Mortgage brokerages, insurance agents and credit unions in Ontario are licensed or regulated by FSRA, the Financial Services Regulatory Authority of Ontario.
• Banks, federally regulated insurers and trust and loan companies fall under OSFI, whose Guideline B-13 on technology and cyber risk sets detailed expectations. Smaller firms are not bound by it directly, but security questionnaires from the institutions you work with are often shaped by it.
• Reporting entities under Canada's anti-money-laundering law, which include securities dealers, life insurance agents and mortgage brokers, have record-keeping obligations with FINTRAC, generally for at least five years.
• Almost every private-sector firm handles client personal information under PIPEDA, which requires safeguards suited to the sensitivity of the data, breach reporting to the Privacy Commissioner of Canada when there is a real risk of significant harm, and a record of every breach kept for 24 months.

• Every person has their own account. No shared logins for the front desk, the assistant or the branch, including on custodian, carrier and lender portals.
• Multi-factor authentication is enforced, not just offered, on email, Microsoft 365 or Google Workspace, the CRM, planning software, custodian and carrier portals, banking, the VPN and every admin account. Prefer an authenticator app or a security key over text messages for administrators.
• Admin rights are held by as few people as possible, in separate admin accounts that are not used for everyday email.
• Access follows the role. An assistant who books meetings does not need trading or money-movement permissions, and a licensed representative sees the client files they serve.
• Leavers lose access on their last day: mailbox, CRM, portals, phones and any device that holds client data. Advisor departures to a competing firm are exactly when client lists walk out the door.

The incident that costs financial firms the most is usually not malware. It is an email, inside a real thread or from a lookalike domain, asking for a redemption to a new account, a change of banking details or an urgent transfer. Controls work in layers:

• Publish SPF and DKIM for every service that sends as your domain, and move DMARC to an enforcing policy so criminals cannot send as you to your clients. Our SPF, DKIM and DMARC guide explains the setup, and the email spoofing check shows where your domain stands.
• Alert on new mailbox forwarding and inbox rules, which are the first thing an attacker sets up after taking over a mailbox.
• Tag external senders and tune impersonation filtering for the names of your principals and advisors.
• Write down a call-back rule: any instruction to move money or change payment or banking details is confirmed by calling a number already on file, never one supplied in the email or text. Make it routine for every staff member, and tell clients you will never change your own banking details by email.
• Use a secure client portal or encrypted email for statements, tax slips and account documents rather than plain attachments.

• Full-disk encryption on every laptop (BitLocker or FileVault) and enforced screen locks and encryption on phones that receive client email.
• Endpoint detection and response on every computer, monitored by someone who will act on an alert at night and on weekends.
• Operating systems, browsers and line-of-business software patched on a schedule, with exceptions recorded. Unsupported systems such as Windows 10 need a replacement plan, not a shrug.
• Devices enrolled in management (for example Microsoft Intune) so a lost or stolen laptop or phone can be wiped remotely.
• A clear rule on personal devices: either they are enrolled with a work profile, or they do not get client data.
• Home and branch connections: no client work over public Wi-Fi without a VPN, and the office network separated from guest Wi-Fi.

• Decide, with your compliance officer, how long each type of record is kept: client communications, account documents, KYC and identification records, trade and transaction records. Then configure Microsoft 365 or Google Workspace retention to match, so mail and files cannot be quietly deleted before the end of the retention period.
• If you keep records for FINTRAC, a dealer or a carrier, make sure they can be found and produced within the time you would be given, not only that they exist somewhere.
• Keep audit logs for sign-ins, admin changes and mailbox access long enough to investigate an incident months after it started. Default log retention on smaller licences is often shorter than firms assume.
• Text messages and messaging apps are records too if business is done over them. Decide which channels are allowed and how they are captured.

• Back up Microsoft 365 or Google Workspace mail and files with a separate service, because the platform's own recycle bins and version history are not a backup.
• Keep at least one backup copy that cannot be changed or deleted from your normal admin accounts, so ransomware that reaches an admin account cannot reach the backups.
• Test a restore at least quarterly and write down how long it took. An untested backup is a hope, not a control.
• Know how the firm would keep serving clients if the office, the internet connection or a key application were unavailable for a day. Our disaster recovery plan guide walks through the plan itself.

• Keep a one-page plan: who decides, who calls the insurer's breach line, who contacts your regulator or dealer, who notifies clients, and who your IT provider escalates to after hours.
• Know your reporting clocks before you need them. Regulatory and contractual reporting deadlines for cyber incidents can be short, and the insurer usually wants to be called before you hire anyone.
• Preserve evidence: do not wipe a compromised laptop or delete a malicious inbox rule before logs are captured. Our IT emergency response checklist covers the first hour.

• List every vendor that holds client data, including the CRM, planning software, document storage, e-signature, phone system and your IT provider, and check how each one secures and locates that data.
• Expect questionnaires from dealers, carriers, custodians and cyber insurers asking about MFA, backups, endpoint protection and incident response. Answer them from documented controls, not memory. Our cyber insurance readiness checklist lists the controls behind the usual questions.
• Produce a short quarterly report for principals or the board: MFA coverage, admin accounts, leavers removed, patch status, backup test results, phishing training completed and any incidents.
• Train staff at least once a year on phishing and payment fraud, with short refreshers when a new scam is going around.

• Have you supported advisory, dealer, insurance or mortgage firms, and do you understand that our compliance officer, not you, decides what our obligations are?
• Will you work with our custodian, carrier, CRM and planning software vendors rather than around them?
• Who watches our security alerts at night and on weekends, and what happens when one fires?
• Can you produce written evidence of our controls for an examiner, dealer or insurer questionnaire?
• Is the agreement clear about what is included, and is project work scoped and quoted in writing before it starts? Our guide on how to compare managed IT quotes lists what to look for.

IT Rapid Support provides managed IT, Microsoft 365 administration and cybersecurity for financial advisors, wealth managers, insurance agencies, mortgage brokerages and other financial firms across the Greater Toronto Area from our office at 7810 Keele St in Vaughan. Our helpdesk is backed by a 24/7 incident line, we work alongside your compliance officer and your software vendors, and on-site work is dispatched across the GTA. Smaller practices can buy support billed by the hour; ongoing managed agreements and projects are scoped and quoted in writing. The service details are on our page for managed IT for financial services firms. To review your firm against this checklist, call (289) 582-9930 or contact us.