Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
IT that stands up to the FCA, your network’s compliance team, and whoever is personally accountable for resilience.
In most businesses, an IT failure is a bad day. In a regulated firm it’s a reportable event, a question at your next compliance review, and in some cases a matter sitting against a named individual’s regulatory record. Add the fact that advisers and brokers are specifically targeted by fraudsters, and IT stops being an operational concern and becomes a governance one. This page is about handling that properly without making your working week harder.
The accountability is personal. Under the Senior Managers and Certification Regime, responsibility for operational resilience sits with a named person rather than with the firm in the abstract. That changes the conversation. “The IT provider will sort it” is not an answer anybody wants to give to a regulator with their own name on the file.
Resilience has to be evidenced, not asserted. FCA firms are expected to identify their important business services, set tolerances for disruption, and be able to show they can stay within them when things go wrong. That is a technical question with a compliance consequence, and in a lot of smaller firms nobody has mapped it.
You’re a named target for fraud. Advisers and brokers talk to clients about money, on dates, by email. A compromised mailbox watched quietly for a fortnight produces exactly the right message at exactly the right moment. The client acts on it because it came from you.
And your supplier is part of your compliance picture. When a regulated firm outsources IT, the firm is expected to have done due diligence on that supplier and to have an exit plan. Which means your IT provider should be making that easy, not something you have to
In this sector, trust is the product. A single incident damages it, and the regulatory follow up lasts far longer than the outage.
Finance and insurance firms are actively targeted with phishing, account takeover and ransomware, and the consequences run wider than downtime. A material incident is likely to be reportable. Client data is likely to be involved. Your PI and cyber insurers will have questions, and so will your network or principal firm if you operate under one.
Meanwhile the quiet risks accumulate: call recordings that aren’t retained properly, an adviser’s laptop that isn’t encrypted, a backup nobody has restored from, an account belonging to someone who left.
The work that satisfies a regulator is the same work that prevents the incident. Enforced multi-factor authentication, email security built for impersonation, managed and encrypted devices, controlled access, tested recovery with a known timescale, and a documented record of all of it. Done properly, your compliance review becomes a matter of handing over documents rather than preparing a case.
Advanced email protection against account takeover and lookalike domains, domain configuration that makes your address harder to spoof, and monitoring for compromised mailboxes. The attacks aimed at your sector are social rather than technical, and the defences have to match.
Tested recovery with a stated timescale, mapped against the services your clients actually depend on, so there’s a real answer when somebody asks how long you could be down and what that would mean.
We maintain the technical evidence as we go: what’s protected, how, who has access, what’s backed up and when it was last tested. Written for a compliance review rather than for a technician.
Two minutes, a handful of questions, covering the ground your insurer, your network and your next review will ask about.
This is the most clear cut recommendation we make. You hold client financial data, you’re a target for impersonation fraud, you’re accountable to a regulator, and both your insurers and your network will ask what you have in place. Professional gives you the strongest security stack we offer plus Cyber Essentials tools and certification support, and Cyber Essentials answers a meaningful portion of what those questionnaires ask in one document.
Essential covers complete cloud and email security, real Microsoft 365 backup, device security and your Microsoft 365 Business Premium licence, and it’s a reasonable position for a small firm with simple systems and no outstanding certification requirement. We’d want to understand your regulatory position before agreeing that’s enough.
The first conversation is about your important business services, your call recording obligations and how your advisers actually work. Those three usually determine everything else.
The Professional IT Support Service is for businesses that want the best — complete IT support, the strongest security we offer, and Cyber Essentials tools and certification support all in one package. If you need to protect your reputation, meet compliance requirements, and have confidence your IT is in safe hands, this is it.
Key Features
Every package is unlimited support with no ticket caps and no per-incident charges. Rolling monthly terms are available, longer terms carry a discount, and not-for-profit pricing applies across the range.
Including directors and senior advisers, who are the most targeted and the most likely to request one.
Standard filtering stops bulk nuisance. It does not stop a credible message from a near identical domain about a transfer your client was expecting.
Storing recordings is only half the obligation. Being able to find a specific call quickly, years later, is the half that gets tested.
Advisers work from home, from client meetings and from cars. A lost unencrypted laptop with client files on it is a reportable incident rather than a lost laptop.
Not a backup policy. A measured answer to how long until you could serve clients again.
Who can reach client records, and evidence that leavers lost access on their last day.
This is the part that stops most people, and it’s usually smaller than imagined.
What you run, how advisers work, what’s recorded and retained, what’s backed up, and which services your clients genuinely depend on. About an hour, no obligation, findings in writing.
Email security, multi-factor authentication and device protection, because that’s where the incident starts.
Controls documented in a form your compliance function or network can use, rather than reconstructed when a review is announced.
Unlimited support, monitoring and patching, with the documentation maintained rather than allowed to age.
Questions finance and insurance firms ask us
We support everything around them: devices, connectivity, access, email, backups and the hosting or network they depend on. We work alongside the software vendor’s own support rather than replacing it, so you aren’t refereeing between two suppliers with a client waiting.
Yes, and it’s worth looking at properly rather than assuming the current setup is compliant. The things that catch firms out are retention periods, retrievability and what happens to recordings when a phone system changes. Phones sit alongside IT in our group, so it’s one conversation rather than two suppliers.
We’ll help you answer it accurately, and where there’s a gap we’ll tell you what it takes to close it and how long. We’ve no interest in helping anyone complete one of those optimistically.
Expected, and we make it straightforward. We’re an NCSC Assured Service Provider, Cyber Essentials Plus certified, and ISO 9001 and ISO 27001 accredited, all independently verifiable, and we’ll provide the supporting detail your process needs including how an exit would work.
The most common serious incident in your sector, and largely preventable. It’s a combination of protecting mailboxes so they can’t be read, filtering for impersonation, domain configuration, and a stated process with clients about how you will and won’t confirm payment details. We can help with all four.
That’s exactly the question we’d want to answer with you, because at the moment most firms don’t know. We’ll measure it rather than estimate it, and if the answer is uncomfortable, that’s useful information to have before a regulator asks rather than after.
Normal, and manageable. Encrypted managed devices, the same access controls wherever someone is, and support that doesn’t depend on being in the office.
We don’t work to fixed SLA response times, and that’s deliberate. We work on priority, so a suspected mailbox compromise is treated as a suspected mailbox compromise rather than queued behind a slow printer because a contract says four hours.
No. You can take any package on a rolling monthly term. Longer terms carry a discount, and the current rates are on each package page, but that’s your choice, not a condition.
We work with advisers, brokers and other regulated firms across Bristol, Bath, Cheltenham, Gloucester, Somerset and Swindon, with remote support anywhere in the UK. We’re an NCSC Assured Service Provider, Cyber Essentials Plus certified, and ISO 9001 and ISO 27001 accredited, which is usually exactly what your own supplier due diligence is looking for.
Start with an hour and a straight answer to two questions: how long could you be down, and what could you evidence if you were asked tomorrow?
Benjamin Mitchell – Headsup Wealth