IT for advisory and insurance offices that hold other people's financial lives

Compliance Rules That May Apply

The items below are requirements your organization may face. They are not claims that RanchoIT holds these certifications.

• Many insurance agencies and non-SEC financial firms are "financial institutions" under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule (16 CFR Part 314) generally applies, including a written program, MFA, encryption, and — since May 13, 2024 — FTC notice within 30 days when unencrypted information about 500 or more consumers is acquired without authorization.
• SEC-registered investment advisers and broker-dealers are covered by Regulation S-P, not the FTC Safeguards Rule. In 2024 the SEC adopted amendments to Regulation S-P that require an incident-response program and notice to affected customers as soon as practicable, and no later than 30 days after the firm becomes aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Confirm your own compliance date with counsel;
• The Red Flags Rule can apply to firms that are creditors or maintain covered accounts (Regulation S-ID for SEC-regulated entities; the FTC rule for others).
• PCI DSS applies if the office takes payment cards. California Civil Code 1798.82 can require resident breach notice.
• New York's 23 NYCRR 500 does not apply to a California office unless that firm is actually subject to it. SOX is not cited here unless a firm is, or is part of, a public reporting company.

Why This Matters Locally

We work with professional offices in Rancho Cucamonga, Upland, Claremont, La Verne, San Dimas, Ontario, and Fontana, plus advisors who meet clients across the west Inland Empire. No implied endorsements of any broker-dealer or carrier.

Frequently Asked Questions

Are we under the FTC Safeguards Rule or the SEC's Regulation S-P?

It depends on how the firm is registered and what business it does. SEC-registered advisers and broker-dealers generally follow Regulation S-P. Many insurance agencies and other financial firms follow the FTC rule. Your compliance counsel should confirm which regime applies; we implement the technical pieces.

Can you guarantee we will pass an SEC or state exam?

No. No honest IT provider can. We can help you put documented safeguards in place and keep them running.

Do you host our portfolio-management software?

We support the devices, network, and backups around the tools you already use, and we work with those vendors when needed.

What should we do first if we suspect a client's mailbox was used to request money?

Call us, contain the account, and follow your incident-response plan. Notification duties can be time-sensitive. We help with the technical containment and documentation; legal notice decisions stay with the firm and its counsel.