IT Services for Banks and Financial Services Firms

What IT services for banks and financial firms include

Financial firms buy the same help desk, device and network support as any office, plus a documented security program that a regulator, an examiner or an institutional client can inspect. The documentation is often as much work as the technology.

Common scope for IT support for banks, credit unions, advisers and lenders:

• Help desk and device management, including secure remote access.
• MFA, endpoint detection and response, email security and encryption.
• Logging and monitoring, with retention long enough for an investigation.
• Vulnerability scanning and penetration testing on a set schedule.
• Backup and recovery, with documented recovery time objectives.
• Policies, an asset inventory, a risk assessment and an incident response plan.
• Evidence packages for exams, audits and client due diligence questionnaires.

Day-to-day managed IT falls in a typical published range of $100 to $250 per user per month, and plans that include more security tooling reach $300 or more ³⁴. Compliance-specific work is often priced separately: a small external penetration test typically starts around $5,000 ⁹, and a virtual CISO to lead the program runs about $1,500 to $4,000 a month for firms under 50 employees in published pricing ¹⁰. Our managed IT pricing guide and vCISO services guide break these down.

GLBA and the FTC Safeguards Rule for mortgage companies and lenders

The FTC Safeguards Rule implements the Gramm-Leach-Bliley Act for financial institutions that are not under another regulator's enforcement authority, which in practice means non-bank firms ⁷. The FTC's examples include mortgage lenders, mortgage brokers, payday lenders, finance companies and tax preparation firms ⁸.

The rule's main technical requirements:

• A Qualified Individual who oversees the program; this can be an employee or a service provider ⁷.
• A written risk assessment ⁷.
• Encryption of customer information in transit and at rest ⁷.
• Multi-factor authentication on every information system, for every user ⁷.
• Continuous monitoring, or annual penetration testing plus vulnerability assessments every six months ⁷.
• A written incident response plan and an annual written report to the board ⁷.
• FTC notice within 30 days of discovering unauthorized acquisition of unencrypted information about 500 or more consumers, in effect since May 13, 2024 ⁷.

Firms holding information on fewer than 5,000 consumers are exempt from four of these provisions but still need MFA and encryption ⁷. Banks and credit unions follow their own federal or state regulators rather than the FTC rule ⁷; their IT providers should be ready to work to examiner expectations. Title companies and insurance agencies should confirm with counsel which regulator and rule covers them.

SEC Regulation S-P for advisers, hedge funds and private equity

SEC Regulation S-P now requires covered firms to run a written incident response program, oversee their service providers and notify affected customers of a breach. The SEC adopted the amendments on May 16, 2024; they were published June 3, 2024 and took effect August 2, 2024 ². Larger entities had 18 months and smaller entities 24 months to comply ¹, which put the compliance dates at December 3, 2025 and June 3, 2026. Both have passed.

Covered institutions include broker-dealers, investment companies, SEC-registered investment advisers and transfer agents, which reaches many wealth management firms, hedge fund managers and private equity advisers ¹. Confirm your own status with counsel.

What the amendments mean for IT:

• Notify customers whose sensitive information was, or is reasonably likely to have been, accessed without authorization, no later than 30 days after becoming aware ².
• Get 72-hour notice from vendors. Service providers must notify the firm no later than 72 hours after becoming aware of a breach ². That belongs in your IT provider's contract.
• Detect and investigate. You cannot assess what was accessed without logs, so log retention and monitoring move from nice to have to necessary.

Funds and private equity firms also field security questionnaires from limited partners. A program built for Reg S-P answers most of them.

NYDFS Part 500 for New York financial firms

Firms regulated by the New York State Department of Financial Services must meet 23 NYCRR Part 500, and the final phase of its Second Amendment arrived on November 1, 2025 ⁵. If your firm holds a DFS license or charter, check with counsel whether you are a covered entity.

Requirements with the biggest IT impact:

• MFA for any individual accessing any information system since November 1, 2025, unless the CISO approves a compensating control ⁶.
• A complete, documented asset inventory that tracks owner, location, sensitivity, support end date and recovery time objective ⁵.
• Notice to DFS no later than 72 hours after determining a cybersecurity incident occurred ⁵.
• Annual certification of material compliance, or acknowledgment of noncompliance, by April 15 ⁵.

Smaller firms may qualify for the 500.19(a) limited exemption: fewer than 20 employees and contractors, or less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets ⁵. The exemption removes several sections but not all. Exempt firms still need MFA for remote access, for third-party applications holding nonpublic information, and for privileged accounts ⁶.

Vendor due diligence for financial firms

Every rule on this page holds the firm responsible for its vendors, and your IT provider is usually the vendor with the most access. The FTC rule requires overseeing service providers ⁸, Reg S-P requires 72-hour breach notice from them ², and the 2026 Verizon DBIR found third-party involvement in 48% of breaches ¹¹.

Ask any IT provider for:

• A description of its own security controls, including MFA on its remote management tools and how its technicians' accounts are protected.
• Contract terms for breach notice (72 hours or less), cooperation in investigations and return of data at the end of the contract.
• The list of subcontractors that will touch your systems or data.
• Evidence it can produce for you: patch reports, backup test results, access reviews.
• Willingness to sit in on an exam or answer an auditor's questions.

Apply the same review to your custodian, CRM, portfolio and loan origination platforms. Our guide to choosing an MSP lists general contract questions, and managed security services explains the monitoring side.

Cybersecurity for financial advisors, credit unions and insurance agencies

Small financial firms face the same attacks as large ones, aimed at money movement. The FBI recorded about $3.05 billion in business email compromise losses in 2025 ¹², and fraudulent requests to move client funds or change bank details are the common thread.

A workable order for a firm of 5 to 50 people:

1. MFA on every account, starting with email, custodian and banking portals. Microsoft research found MFA reduces account compromise risk by 99.22% ¹³.
2. Callback verification for any change to payment or wiring instructions.
3. EDR on every device, then managed detection and response so alerts are watched at night. A 2026 market analysis put mainstream MDR at $8 to $25 per endpoint per month ¹⁴.
4. Encrypted, tested backups.
5. A written incident response plan that names who calls the regulator, the insurer and the FBI.

Hiring in-house is costly at this size: the median information security analyst earned $129,180 in May 2025 ¹⁵, before benefits. For a broader small-firm plan see cybersecurity for small business. Tax practices should read our accounting firm IT page; for the rules in each sector side by side, see the industries overview.