Where does your firm stand on the 24 security controls?

Have the firm's defences been penetration tested in the last 12 months?

Scanners find known flaws; a tester finds the chain of small weaknesses that leads to a real breach. The SFC strongly advises licensed firms to have one at least once a year, carried out internally or by an outside consultant; an independent outside tester is PTS's standard. A test the firm commissioned of its own systems counts; a vendor's test of its own platform counts only if the firm has seen the report.

Do all staff get regular security awareness training, covering phishing?

Most attacks start with an email, and AI now makes fake ones far more convincing. The SFC requires regular awareness training for all staff with phishing as a topic, at least yearly for internet brokers; once a year is PTS's standard for every firm.

Does the firm send staff test phishing emails at least every quarter? PTS's standard

PTS's standard: a test email every quarter, and short training for anyone who clicks, show whether the training works. The SFC's review reports test emails as good practice; it does not require them.

How often are the firm's laptops, servers and network devices scanned for vulnerabilities?

Once an attacker is inside, unpatched machines let them spread. The SFC strongly advises a technical review with vulnerability scanning at least once a year; monthly is PTS's standard.

How often is everything the firm exposes to the internet scanned for weaknesses (the office firewall, remote access, and any website or server the firm runs)?

Internet-facing systems are probed constantly; a forgotten test server or an old VPN is often the way in. The SFC strongly advises scanning at least once a year, within its yearly technical review; monthly is PTS's standard.

Are security patches installed on every device within a month of being tested, and urgent ones sooner?

Most breaches use a flaw that already had a fix. The SFC requires patches implemented within one month of completing testing, and urgent ones as soon as possible.

Is every operating system and piece of software still supported by its maker?

Software out of support gets no more security fixes. The SFC requires it off critical servers and databases, internet-facing and trading ones included, isolated or not; other unsupported software is to be replaced in good time unless its risk is properly mitigated, for example by isolating it (25EC7). Software its maker still patches under paid extended support counts as supported. None anywhere is PTS's standard.

Must every member of staff use a second factor (not just a password) to sign in? PTS's standard

A second factor on every staff account is PTS's standard. The SFC requires a second factor for remote access (25EC7) and for client logins (the Internet Trading Guidelines, 1.1); for administrator and cloud accounts it expects a phishing-resistant second factor of firms that trade electronically, and asks others to consider one (26EC32).

Does signing in from outside the office always need a second factor (not just a password)? SFC's bar

Outside the office means from home, on the move or abroad: remote access to the office network, and signing in to email, files or any other system holding firm data, whoever signs in, the IT provider's engineers included. The SFC requires a second factor for remote access (25EC7). On administrator and cloud accounts it expects a phishing-resistant second factor of firms that trade electronically, Type 13 depositaries and virtual asset platforms, and asks other firms to consider one (26EC32); the administrator accounts are asked about in PTS's full assessment. The question before this one, every member of staff on every sign-in, is PTS's standard.

Are administrator rights limited to a few named people, with their use logged and monitored? SFC's bar

The SFC's rule. Answer Yes only if all three hold: a few named administrators (the IT provider's engineers included), their use logged, and someone watching those logs.

Do IT administrators use separate accounts for admin work, never their everyday account? PTS's standard

Everyday accounts with admin rights are how ransomware gets in. The SFC requires administrator accounts to be few, logged and monitored (asked above); separate accounts used only for admin work are PTS's standard.

Before anyone acts on a payment instruction or a change of bank details, is it confirmed by a call-back on a known number and approved by a second person?

Payment instructions and changes of bank details are the target of impersonation fraud, now with faked voices and video. The SFC asks for a second person's approval (maker-checker) on high-impact actions such as these; a firm holding client money also confirms withdrawals to third parties with the client, such as by a call-back. A call-back on every instruction, as well as the second person, is PTS's standard. Where the fund administrator makes the payments, answer for its check on the firm's instructions; otherwise for the firm's own.

Is remote access to the office network only through a VPN or a similar secure service? SFC's bar

The SFC's rule for reaching the internal network from outside: a VPN or its equivalent. The second factor it needs is asked under multi-factor authentication. A firm with nothing in the office to connect to chooses the third answer.

Is firm data blocked on personal laptops and phones, so it opens only on devices the firm manages? PTS's standard

PTS's standard. The SFC asks only for tighter access from personal devices. A personal phone whose work apps the firm controls counts as managed.

Is the office network split so staff laptops, guests, and any servers or printers are on separate networks?

Separation stops one infected laptop reaching everything.

Is the disk encrypted on every laptop and desktop that holds firm data?

A lost laptop with unencrypted client files is a reportable incident.

Which anti-malware or endpoint protection does the firm use?

The SFC requires anti-malware on every server and workstation; detection and response with someone watching the alerts is PTS's standard.

Is incoming email scanned for phishing? SFC's bar

The SFC requires phishing detection and prevention. Microsoft 365 and Google check mail as standard; answer No only if nothing does.

Is email from outside the firm marked as external? PTS's standard

A banner on outside email is PTS's standard: it makes an impostor's message stand out.

Is the firm's data (email, files and any system it runs) backed up regularly, to a copy it could restore from? SFC's bar

The SFC requires business records and client and transaction data backed up regularly, with the copies available when needed. Microsoft's or Google's own retention is not a backup: if the account is lost or locked, the records go with it.

Could someone who took over an administrator's account delete the backups? PTS's standard

If the firm relies on Microsoft or Google alone, with no backup of its own, choose the first answer: an administrator can delete the only copy. A copy out of their reach is PTS's standard; for systems on a cloud platform the SFC asks for more, a backup disconnected from the cloud after each backup.

Are the records the firm must keep (client and transaction records, accounts, advice: seven years; order records: two years) kept at least that long before they can be deleted? SFC's bar

The Keeping of Records Rules set the periods. A retention setting (in Microsoft 365, Google or the file store) that stops records being deleted early is the surest way to show it, and PTS's standard; keeping everything by habit can meet the law, but is hard to show.

Are all email and files kept for seven years, not only the records the firm must keep? PTS's standard

PTS's standard: one retention setting for all email and files is simpler to run, and to show the SFC, than sorting the records out from everything else.

Does the firm take client orders only on channels it records and keeps, with staff barred from taking them on any other? SFC's bar

For a firm that takes client orders these are the SFC's rules: orders taken by phone recorded and the recordings kept at least six months, with none taken on a mobile phone where orders are usually received (Code of Conduct 3.9); order messages by WhatsApp, WeChat or other instant messaging kept at least two years where they cannot be altered, and staff barred from taking orders on any channel the firm does not fully control (18EC30). Answer Yes only if all of these hold. A firm that trades only at its own discretion takes no client orders and chooses the second answer. A chat app used for other business is not an order channel: the next question asks about every channel.

Is every channel staff use for business messages captured and kept: email, Teams chat, Bloomberg chat, WhatsApp, WeChat, text messages and any other? PTS's standard

Count the channels staff actually use, approved or not, on their own phones as well as the firm's devices. Captured and kept means the firm holds a copy for the record: the email platform's retention, or an archive or a connector for chat. PTS's standard for every firm: every channel captured and kept like any other record, or its business use stopped.

Has the firm checked each cloud provider that holds its data: its security certifications, where it keeps the data, and how the firm would get it back?

Your data in someone else's data centre is still your responsibility: keep access, control and an exit plan. Answer Yes only if all three are on file for every provider holding the firm's data (Microsoft or Google, the backup, the archive, the order system).

How many days are the email platform's audit and sign-in logs kept?

25EC7 says keep and review the logs of critical systems and sets no period; firms that trade electronically keep trading-system audit logs for at least two years (Code Schedule 7 1.3.2(b)). PTS's standard is at least a year.

Does someone review the security logs regularly?

The SFC requires audit logs to be reviewed, not just kept, and sets no frequency; a look after an incident alone does not count. Once a month is PTS's standard.

Are security alerts watched 24 hours a day, 7 days a week? PTS's standard

An alert at 2am that nobody sees until Monday is not detection. The SFC requires detection and monitoring in step with the threat; round-the-clock watching is PTS's standard.

Are security alerts monitored and followed up at least during working hours (round the clock counts)? SFC's bar

The SFC requires detection and monitoring in step with the threat, with anomalies followed up; round-the-clock watching is PTS's standard. If alerts are watched round the clock and followed up, answer Yes.

Does the firm have an incident response plan? SFC's bar

The plan covers handling an incident and reporting it to the SFC.

When did the firm last practise its incident response plan, for example in a meeting that walks through a pretend attack (a tabletop exercise)?

The SFC requires incident plans to be tested regularly; once a year is PTS's standard.

Does the firm have a business continuity plan?

The SFC requires a plan covering loss of the office, systems, people and providers, approved and reviewed every year; PTS checks the approval and the last review with you.

Is one named senior person accountable for technology risk? SFC's bar

Without a named owner security becomes nobody's job and budgets are set blind. SFC firms must name a Manager-in-Charge for Information Technology.

Does that person get a written report on technology risk at least every quarter? PTS's standard

If no one is named, answer No. PTS's practice: a quarterly report on risks, tests and incidents, so the owner can act on them.

Does the firm keep a register of the suppliers that hold its data or can reach its systems, each checked before it starts and reviewed regularly?

Many breaches arrive through a supplier, and the firm stays responsible for anything it outsources. Answer Yes only if the register exists, new suppliers are checked before they start, and each is reviewed regularly; once a year is PTS's standard.

Does the firm have a policy on using generative AI?

The SFC's circular on generative AI applies once it is used in the firm's regulated work: research, advice, client communications or dealing. A firm that does not use it there chooses the second answer. A written policy is PTS's standard either way, since staff often use personal AI tools without anyone knowing; a written ban counts as a policy, so answer Yes.