The short answerAdvice firms, wealth managers and mortgage and insurance brokers hold exactly what criminals want: identity documents, bank details and access to client investments. The FCA expects controls proportionate to your size, the Consumer Duty expects you to avoid foreseeable harm, and from 18 March 2027 PS26/2 requires qualifying incidents to be reported within 24 hours of deciding they meet the threshold. For most small firms, a well-run Microsoft 365, managed devices, strong email security, tested backups and a clear payment verification process cover the biggest risks.
Key points- Small firms are not exempt: Principles 3 and 11, SYSC and UK GDPR all apply, and PS26/2 covers every firm with a Part 4A permission from March 2027.
- The biggest risks are mailbox takeover, payment and withdrawal fraud, lost or unmanaged devices, and weak access to platforms and back-office systems.
- Principal firms remain responsible for their appointed representatives, including how they handle client data.
- A sensible baseline costs far less than one incident: MFA, managed devices, email security, backup and training.
- Your IT provider should give you monthly evidence, not just fix things when they break.
What the rules expect from a small firm
There is no lighter cyber regime for small firms. The same rules apply, scaled to your size and risk:
- Principle 3 and SYSC: adequate systems and controls, including security of your IT and client data.
- Principle 11 and SUP 15: tell the FCA about significant incidents. From 18 March 2027, PS26/2 standardises this: most advice and broking firms will submit a single standard report within 24 hours of deciding an incident meets the threshold. Our FCA cyber security guide explains the thresholds.
- Consumer Duty: avoid causing foreseeable harm to retail customers. A data breach that leads to fraud against your clients is the kind of harm it has in mind.
- Outsourcing: if you rely on an IT provider, back-office system or platform, you remain responsible for oversight. SYSC 8 applies in full to some firm types and as guidance to others.
- UK GDPR: appropriate security for personal data, and a report to the ICO within 72 hours of becoming aware of a reportable breach.
If you are a principal firm, you are also responsible for your appointed representatives. Their laptops, mailboxes and client files are part of your risk.
Where the real risks are
- Mailbox takeover. A phished adviser’s mailbox gives a criminal client conversations, valuations and identity documents, and a trusted address to send instructions from.
- Withdrawal and payment fraud. Fake client emails asking for withdrawals to new bank details, and fake provider or lender emails asking you to pay fees elsewhere. AI-generated voice calls now make phone verification harder too, so call back on a number you already hold.
- Platform and back-office access. Shared logins, no MFA and former staff who still have access to platforms or the CRM.
- Unmanaged devices. Advisers working from personal laptops and phones, with client files in downloads folders and no way to wipe them if lost.
- Ransomware. Less common for small firms than email fraud, but it can stop the business for days if backups are missing or untested.
A sensible baseline for a 5 to 50 person firm
| Area | Baseline |
|---|
| Microsoft 365 | Business Premium or equivalent, MFA for everyone, Conditional Access, legacy sign-in blocked, mailbox audit logging on, alerts for new forwarding rules. |
|---|
| Devices | Company laptops and phones enrolled in Intune or similar, encrypted, patched and wipeable. If personal phones are allowed, keep client data in managed apps only. |
|---|
| Email | DMARC, SPF and DKIM set up, advanced filtering, external sender warnings and encrypted email or a client portal for documents. |
|---|
| Access | Individual logins with MFA for platforms, back office and banking; joiners and leavers handled the same day; quarterly access reviews. |
|---|
| Payments | A written rule: no change of bank details or withdrawal instruction is acted on without a call back to a known number. Two people approve payments above a set amount. |
|---|
| Backup | Microsoft 365 and any local data backed up separately, with a restore tested at least twice a year. |
|---|
| People | Short phishing training every quarter, and a no-blame way to report a mistake quickly. |
|---|
| Assurance | Cyber Essentials, ideally Plus, renewed every year, and a written incident plan. |
|---|
Networks and appointed representatives
Networks and principal firms should set a minimum standard for their appointed representatives and check it. A simple approach is to require Cyber Essentials, MFA on email and platforms, managed devices and prompt incident reporting to the principal, and to collect evidence each year. That makes PS26/2 reporting possible, because you cannot report what you do not hear about.
What to ask your IT provider
- Can you show me, each month, MFA coverage, device compliance, patching and backup results?
- How quickly will you tell us about a security incident, and is that in the contract?
- Who at your company can access our systems, and how is that access protected and logged?
- Are you certified to ISO 27001 or Cyber Essentials Plus yourselves?
- What happens to our data and access if we leave?
Those answers are also the evidence you need for your own outsourcing oversight. Our vendor management guide covers the rest.
Keeping directors involved
The government’s Cyber Governance Code of Practice, published in 2025, sets out what directors of any organisation should do about cyber risk: own it at board level, make sure there is a plan, check staff are trained and review it regularly. For a small firm that can be a 15-minute standing item at a monthly management meeting, using the monthly report from your IT provider.
Sources and further reading
CEO, Cre8 IT
Rob Crossley is CEO of Cre8 IT, a managed IT and cyber security company that has supported businesses across the UK, the UAE and Saudi Arabia since 2012. Cre8 IT is certified to ISO 27001:2022 and ISO 9001 and is a certified Microsoft Partner.
