Guide
How to Choose a Managed IT Provider for Your Financial Firm
Your managed IT provider will hold the keys to client data, email and every system your firm runs on. Here is what to ask, what to expect and what to avoid before you sign.
Key takeaways
- Regulators expect you to oversee the IT providers that handle client data, so choosing one is a compliance decision as well as a technology decision.
- Look for financial industry experience, security tools included in the plan, documentation you can show examiners and clear support coverage.
- Ask how the provider protects its own access to your systems, and ask for evidence such as a SOC 2 report.
- Read the contract for scope, response times, incident notice, data ownership and how you leave.
Why it matters
Why choosing an IT provider is a compliance decision
For most businesses, an IT provider is a vendor like any other. For a financial firm it is one of the most important service providers you have. The provider holds administrator access to your email, file storage, workstations and network, so it can see and change the systems that hold client records, account numbers and tax returns.
Regulators treat that access as your responsibility:
- SEC Regulation S-P: as amended, advisers and broker-dealers must oversee service providers that handle customer information, and those providers must notify the firm within 72 hours of a breach. See our Regulation S-P compliance checklist.
- FTC Safeguards Rule: accounting and tax firms and other covered financial institutions must select service providers that can protect customer information, require those safeguards by contract and assess the providers periodically. See our WISP guide for accounting and tax firms.
- NYDFS Part 500: covered entities need a written third-party service provider security policy. See our NYDFS Part 500 compliance checklist.
- FINRA: Regulatory Notice 21-29 reminds broker-dealers that outsourcing a function to a vendor does not outsource the responsibility to supervise it.
In practice, the provider you pick shapes how well you can answer examiners, auditors and cyber insurance carriers when they ask how client data is protected. For the rest of your vendors, see our vendor due diligence checklist.
What to look for
Seven things to look for in a managed IT provider
1. Experience with financial firms
Ask which types of firms the provider supports today and which regulations its clients answer to. A provider that already works with advisers, accounting firms, banks or insurance agencies knows the software you run, the busy seasons when you cannot afford downtime and the evidence your examiners ask for.
2. Security built into the plan
Multi-factor authentication, endpoint detection and response, email security, patch management and tested backups should be part of the standard service, not add-ons you discover after signing. Ask for the security baseline every client gets. Our Microsoft 365 security checklist and cyber insurance requirements checklist show the controls carriers and examiners expect.
3. Documentation you can hand to an examiner
A good provider keeps an asset inventory, patch and backup reports, access changes and incident records as a matter of routine. Ask to see sample reports, and ask how quickly the provider can produce evidence when an exam or a cyber insurance renewal questionnaire arrives.
4. Clear support coverage
Find out who answers the phone, where the engineers are based, how tickets are tracked and which response times are written into the agreement. If your team works early mornings, evenings or weekends, confirm that after-hours support is part of the plan.
5. Backups that are tested
Ask how often backups run, where the copies are kept, whether at least one copy is protected from ransomware and when a restore was last tested. How fast you can recover matters as much as the backup itself. See our backup and disaster recovery services.
6. Strong protection of their own access
Attackers target IT providers because one provider can open the door to many clients. In 2021, ransomware reached businesses through a flaw in Kaseya VSA, a remote management tool used by IT providers, and in 2022 CISA and partner agencies issued a joint advisory on threats to managed service providers and their customers. Ask how the provider secures its remote management tools, whether its staff use multi-factor authentication everywhere, how administrator access is limited and logged, and whether it can share an independent report such as SOC 2.
7. Pricing you can predict
A flat monthly fee per user or per device should state exactly what is included. Ask about onboarding fees, project rates, after-hours charges and licenses billed separately. Our guide to what managed IT services cost explains the common pricing models.
Questions to ask
Questions to ask every managed IT provider
- Which financial firms like ours do you support, and which regulations do they answer to?
- Which security tools and settings are included for every client?
- Who answers support calls, where are your engineers based and what are your response times?
- Do you offer support outside business hours?
- How do you document our environment, and which reports will we receive?
- How are backups protected and tested, and how fast can you restore a server or a mailbox?
- How do you secure your own remote access tools and administrator accounts?
- Can you share a SOC 2 report or another independent review of your security?
- How quickly will you tell us about a security incident that affects our data?
- What is included in the monthly fee, and what is billed separately?
- How does onboarding work, and how do you avoid disruption during the switch?
- If we leave, how do we get our passwords, documentation and data back?
Before you sign
Contract terms to check before you sign
- Scope: every service, device and location covered, so nothing falls between your firm and the provider.
- Response times: written targets for urgent, high and normal requests.
- Security incident notice: a notification window that supports your own obligations, such as the 72-hour service provider notice under Regulation S-P.
- Confidentiality and data ownership: your data, credentials and documentation belong to your firm.
- Term and renewal: contract length, automatic renewal and notice periods.
- Exit assistance: what the provider hands over and how it helps a new provider take over.
Red flags
- Security tools offered only as optional extras
- No written response times and no plan for after-hours problems
- Vague answers about who has administrator access to your systems
- Your domain, Microsoft 365 account or firewall registered in the provider’s name instead of your firm’s
- No documentation of your environment, or reluctance to share it
- Long contracts with steep termination fees and no help when you leave
How FinFortify works
How FinFortify answers these questions
FinFortify Inc. has provided managed IT services and cybersecurity to financial firms since 2010 and has supported hundreds of them, from wealth management and accounting firms to banks, credit unions, insurance agencies and private equity firms. Our US-based engineers build every client environment on the same security baseline, document the work so you can show examiners how client data is protected, and offer 24/7 support plans. FinFortify is a SOC 2 compliant provider and a Microsoft Cloud Solution Provider partner.
See what is included in our managed IT services for financial firms, compare managed IT and in-house IT, or read how to switch managed IT providers if you are moving from another provider. When you are ready, request a quote.
FAQ
Choosing a managed IT provider: frequently asked questions
What is a managed IT provider?
A managed IT provider, also called a managed service provider or MSP, takes ongoing responsibility for your technology for a monthly fee: help desk support, monitoring, patching, backups, security tools and planning, instead of billing by the hour after something breaks.
Why does a financial firm need a specialized IT provider?
Financial firms hold sensitive client data and answer to regulators such as the SEC, FINRA, the FTC and state agencies. A provider that knows those requirements builds security and documentation into the service, so you are ready when an examiner, auditor or insurer asks.
Should we ask an IT provider for a SOC 2 report?
Yes. A SOC 2 report is an independent review of a service provider’s security controls. It supports the vendor due diligence your own compliance program requires, alongside questions about how the provider protects its access to your systems.
How long does it take to switch to a new IT provider?
It depends on the size of your firm and how well your current environment is documented. A planned transition runs in stages, with access, backups and security tools moved over before the old provider is removed. Our guide to switching managed IT providers walks through each step.
Talk to an IT provider built for financial firms
Tell us about your firm and we will show you how FinFortify handles security, support and documentation.
