Cyber security for financial services, Wirral
Cyber security for financial services firms on the Wirral
Cyber security for a Wirral financial services firm comes down to three things. Keep client data confidential, keep client money moving to the right account, and be able to show the FCA, your network and your insurer that both are under control. It’s written for small financial services firms of two to thirty people, from Birkenhead and Wallasey to Heswall, West Kirby and Bebington.
Run to the NCSC’s Cyber Essentials standards. Twenty years securing hospital and government systems. Microsoft and Datto partner.
What the FCA expects on cyber security from a small firm
Systems and controls. Every FCA-regulated firm has to have adequate systems and controls for the risks it runs, and cyber risk is one of them. There’s no cyber checklist in the Handbook for a small firm. What counts is whether you can show you took reasonable steps.
The Consumer Duty. In force since July 2023, it asks firms to avoid foreseeable harm to customers. A breach of client data, or an outage on completion day, is foreseeable harm.
SM&CR. A named senior manager is accountable. In a small financial services firm, that’s usually the person reading this.
The ICO. Client files are personal data under UK GDPR. A breach that’s likely to put people at risk has to be reported within 72 hours.
Cyber security for appointed representatives and networks
If you’re an appointed representative, your network is responsible for you to the FCA and sets its own security requirements. Platforms, product providers and lenders increasingly send questionnaires too.
The questions are usually the same few, whoever’s asking. If the answers are already true of your firm, the questionnaire takes an afternoon. If they aren’t, the questionnaire is the to-do list.
What cyber security for a financial services firm covers
All of it is inside our IT support for financial services, at £55 a person a month.
Sign-in security
Multi-factor sign-in on every account, partners included, and admin rights only where they’re needed. Only 40% of UK businesses use it on email (DSIT 2025).
Email security
Filtering for phishing, lookalike domains and malicious attachments, plus SPF, DKIM and DMARC so nobody can send mail as your firm.
Threat detection and response
Every laptop watched for ransomware and credential theft, and a compromised device isolated before it spreads.
Encrypted, managed devices
Every laptop and phone holding client files encrypted and managed, so a lost device can be wiped the same day.
Backups that restore
Devices and Microsoft 365 backed up away from the office and test-restored on a schedule.
Practice for your team
Short, regular phishing practice built around what reaches an adviser: fake platform logins, invoice changes, a client who suddenly writes differently.
Eight checks on your firm’s cyber security
A director can answer these in ten minutes. The ones you can’t answer with a confident yes are where to start. 85% of attacks on UK businesses start with phishing (DSIT 2025), so most of them are about the inbox.
- Every adviser, every administrator and every shared mailbox uses multi-factor sign-in.
- Bank-detail changes are only confirmed by phone, on a number already on file.
- Every laptop and phone with client files on it is encrypted and can be wiped remotely.
- Somebody has restored a client file from backup in the last three months.
- Leavers lose access to email, the platform and the back office the day they go.
- Staff have had phishing practice this year, not just a policy to sign.
- You’d know within a day if a staff password turned up in a breach.
- You know who’d tell the ICO, your network and your insurer, and in what order.
Cyber security on the Wirral, delivered remotely
Almost all of this work is done remotely, so it doesn’t matter whether you’re in Birkenhead, Wallasey, Heswall, West Kirby, Hoylake or Bebington. When something genuinely needs a visit, it’s booked in. You deal with Eric, who sets the security up and is the person you speak to when something looks wrong.
For other kinds of Wirral business, see cyber security on the Wirral. For financial services firms elsewhere in the North West, see cyber security for financial services.
Cyber security for a financial services firm, priced
Same number every month. Microsoft licences billed separately.
Cyber security for financial services firms: common questions
Does the Consumer Duty cover cyber security?
Not by name, but it reaches it. The Duty expects firms to avoid causing foreseeable harm to customers, and a breach that exposes client data, or an outage that stops a mortgage completing, is exactly that kind of harm. Firms were fined for weak security long before the Duty existed. The Duty makes the customer outcome the test.
Do the FCA's operational resilience rules apply to us?
Probably not, if you're a small advice or broking firm. The operational resilience chapter of the FCA Handbook (SYSC 15A) applies to banks, building societies, insurers, enhanced scope SM&CR firms, payment and e-money firms and a few others. The general duty to have adequate systems and controls applies to everyone, though, and that's where cyber security sits for most firms on the Wirral.
Our network has sent us a security questionnaire. Can you help?
Yes. Appointed representatives usually get the same handful of questions: multi-factor sign-in, encryption, backups, updates, training and how you'd report an incident. If those are in place, the questionnaire is answered from what's already set up. A one-off review or questionnaire on its own is a fixed price.
Do financial services firms need Cyber Essentials?
The FCA doesn't require it. Some networks, platforms, lenders and insurers ask for it, and it's a sensible baseline either way. We run to Cyber Essentials standards and set firms up the same way, so getting the certificate through an accredited certification body is paperwork rather than a project.
Can you work alongside our current IT provider?
Yes. They keep the day-to-day support and we run the security alongside them. It's a separate arrangement, priced per person and agreed before anything starts, with the boundary written down.
How much does cyber security cost a small financial services firm?
It's inside our managed IT support at £55 a person a month. That covers endpoint protection with threat detection and response, updates, and device encryption and management. It also covers email filtering, multi-factor sign-in, phishing practice, breached-password monitoring and tested backups. Microsoft licences are billed separately. For a four-person firm, that's £220 a month.
Have a chat with Eric
Fifteen minutes with Eric. Bring your network’s questionnaire if that’s what started this.
Cyber security for your Wirral financial services firm
The controls that protect client data and client money, the evidence the FCA, your network and your insurer ask for, and a person who picks up. From £55 a person a month.