Data Security Review Checklist

Pull the current badge roster from the access control system and reconcile against active employees in HRIS. Common gotchas: contractors whose badges were never decommissioned, and shared badges issued to the cleaning vendor that haven't been rotated.

Confirm every advisor and ops user with Schwab Advisor Center, Fidelity Wealthscape, Pershing NetX360, or Altruist access has hardware or app-based MFA enrolled. SMS-only MFA is no longer acceptable under most custodian policies and is a known SIM-swap weakness.

Pull last quarter's VPN and RDP session logs. Look for off-hours sessions, sessions from unexpected geographies, and concurrent sessions per user. Tag anything anomalous for follow-up with the user before closing the review.

Confirm AES-256 encryption on the CRM database (Wealthbox, Redtail, Salesforce FSC), the document management store (NetDocuments, ShareFile, Laserfiche), and any local file shares holding client account data. Spot-check that backup volumes are also encrypted, not just primary storage.

Run an SSL Labs scan on every public-facing domain — client portal, planning tool deep links, marketing site forms that collect PII. TLS 1.0 and 1.1 are deprecated; weak cipher suites and expired certs are common audit findings.

Pick a non-trivial dataset — a CRM table, a planning file, a portfolio accounting export — and restore it to a test environment. A backup that has never been restored is not a backup. Document the restore time against the firm's RTO.

Walk the firewall ruleset with the network admin. Common findings: any-any rules left over from a vendor onboarding, port forwards to decommissioned systems, allow rules to former employee home IPs.

Run the authenticated scan against the internal network and a credentialed scan against the DMZ. Tenable, Rapid7, and Qualys are common tools. Capture the report and record the highest severity finding for the conditional below.

Patch or compensate for any CVSS 9.0+ findings within 72 hours per the firm's vulnerability management policy. If the affected system is a vendor-managed appliance, open a P1 ticket with the vendor and document the compensating control until the patch ships.

Have each department head certify their team's access list — CRM roles, custodian portal entitlements, document store permissions. Least-privilege is the standard; an associate advisor does not need principal-trade entitlements.

For every rep terminated in the prior quarter, confirm Form U5 was filed within 30 days and that the off-boarding checklist closed CRM, custodian portal, M365, archiving, and any planning-tool seats. Stale custodian access for departed reps is a common SEC exam finding.

Confirm Entra ID / Active Directory / Okta enforces NIST 800-63B-aligned policy: minimum 14 characters, breached-password rejection, no forced rotation absent suspicion of compromise. Document any service accounts exempted and the compensating MFA / vault controls.

Confirm latest stable releases on the planning tools (eMoney, MoneyGuide, RightCapital), the CRM, the rebalancer, and any local trading apps. Out-of-support browsers used to access custodian portals are a recurring finding.

If the firm operates its own client portal or planning portal, run OWASP-aligned application testing — at minimum authenticated DAST. If the portal is fully vendor-hosted, collect and review the vendor's most recent pentest summary instead.

Sample five reps and reconcile their personal phone usage against the texting archive (MyRepChat, Hearsay Relate, Smarsh Connect). The 2022-2024 SEC and CFTC sweep on personal-device texting drove $2B+ in fines; this is the highest-velocity exam topic in advisor compliance.

For each rep with unarchived business communication, document the gap, retrieve and archive what is recoverable, and issue written supervisory action per the firm's WSPs. Repeat offenders move to heightened supervision.

Roll up findings, remediation status, and open items into the firm's annual GLBA Safeguards Rule report. Attach scan output, restore test logs, access-review certifications, and SOC 2 receipts. This is the document the SEC or state examiner will request first.