Las Vegas headquartered. For advisory firms that already have IT support. Duties depend on how the firm is registered.
Independent assessment and incident preparation for firms that hold sensitive customer information and already have an MSP or a small internal IT team.
Independent wealth managers, investment advisers, and related financial firms hold account data, identity documents, and instructions that move money. That is enough reason to know whether email, identity, and recovery controls work. It is not enough reason to pretend every financial business has the same regulatory file.
Amended SEC Regulation S-P requires covered broker-dealers, investment companies, registered investment advisers, and transfer agents to keep a written incident-response program and, in defined circumstances, to notify affected individuals. If your firm is one of those institutions, incident readiness is a practical operating need. If it is not, Mojave will not invent the obligation. The scoping call is where coverage is sorted out. We do not provide a legal opinion.
An independent advisory firm with a modest professional and operations staff, high-value customer information, and either an outsourced MSP or a small internal IT capability. The person who usually starts this is the principal, the COO, or the chief compliance officer. The IT provider should see the findings. They do not have to be displaced.
If the firm does not hold sensitive customer information and has no incident-readiness need, this assessment is not the right project, even in financial services.
This is not a broker-dealer compliance program, a custody audit, or a promise that customer notification duties have been met. Authorized testing, if a custodian or insurer requires it, is a separate scope with written authorization. It is not included here.
Financial-services questions
No. Amended Regulation S-P applies to covered broker-dealers, investment companies, registered investment advisers, and transfer agents. Those institutions need a written incident-response program and, in defined cases, customer notification. A firm that is not a covered institution can still have a serious need to protect customer information. We scope the work to the firm in front of us and do not treat every financial business as having the same duty.
The baseline reviews agreed evidence and configuration. It does not include exploitation, social engineering, or an attack simulation. Authorized penetration testing is considered only when a client requirement justifies it, under written rules of engagement and a qualified delivery arrangement.
You can keep that relationship. Mojave is engaged separately to assess important controls, explain the findings to management, and hand your MSP or internal IT team a prioritized plan. Where a specialist gap remains, implementation help is available under its own scope.
No. Mojave does not issue a certification, a CPA attestation, or a statutory audit opinion. A written plan does not, by itself, establish that safeguards are operating or that a regulation has been met. Insurance eligibility and claim payment are decisions for your insurer.