Questions firms ask
What's the difference between data security and data privacy?
Security keeps attackers out; privacy controls who and what can see client information, including your own staff and the tools they use. A firm can block every outside attack and still expose client data when someone pastes a client's statement into a public AI tool. Security is the foundation. Privacy is what clients are trusting you with.
Is it safe for my staff to use ChatGPT with client information?
Not on a personal or free account. Depending on the plan and settings, what's typed into consumer AI tools can be stored and used to train models. The safer setup is a business AI workspace with training turned off, written rules for client data, and unapproved AI apps blocked from connecting to your files. Your team keeps the speed of AI without handing it client data.
How should a small firm answer a client's security questionnaire?
Answer from records the firm already keeps: a written security policy, a recent access review, an incident response plan, and backup test results. Most questionnaires ask the same things in different words, so the first one is the hard one. After that, the work is keeping those records current.
What will our cyber insurance carrier ask before renewing?
Expect questions about multi-factor authentication (especially on email, remote access, and admin accounts), endpoint detection and response, backups that are offline and tested, patching, and phishing training. Carriers increasingly want documentation behind each answer. Have it ready before the renewal form arrives.
What happens if a laptop with client files is lost or stolen?
If the drive is encrypted and the laptop can be wiped remotely, it's usually a hardware problem, not a data breach. Many state breach-notification laws treat encrypted data differently when the key wasn't exposed, so encryption can decide whether you replace a laptop or notify clients. Confirm the specifics with your counsel, and turn encryption on before you need it.
What do the Reg S-P amendments require from a small RIA?
The SEC's 2024 amendments require registered investment advisers to keep a written incident response program, notify affected clients within 30 days of a breach involving sensitive information, and make sure service providers report breaches to the firm within 72 hours. Smaller advisers had to comply by June 3, 2026. Your IT provider is one of those service providers. Compliance is your call with your compliance advisor; NeXNet sets up and documents the IT side.
What does the FTC Safeguards Rule require from a small tax or accounting firm?
Tax preparers count as financial institutions under the FTC Safeguards Rule. That means a written information security program with a named Qualified Individual, a risk assessment, multi-factor authentication, encryption of client data, staff training, vendor oversight, and an incident response plan. A breach exposing unencrypted data on 500 or more people must be reported to the FTC within 30 days. The IRS also asks preparers to confirm their data-security obligations when renewing a PTIN.
How much does IT and privacy support cost?
Most firms pay one monthly fee based on headcount and the level of protection they need. At NeXNet, that fee covers support, security, and privacy controls; one-time projects, such as a hardware refresh, are quoted separately before any work starts. A quote takes one conversation about your team size and how your firm handles client data.