SaberGuard is the technology and security lead for small registered investment advisers (RIAs). It oversees your IT provider, handles the cybersecurity side of Regulation S-P, vets new vendors, and leads the projects your provider doesn't. Firms without an IT provider can hand over day-to-day IT as well.
SaberGuard works for your firm, not for your provider. It reviews what the provider proposes and tells you whether the work is needed before you approve it, checks what the provider has set up, and keeps written records of the oversight. Your provider keeps running your systems.
Retainers, paid up front, reserve 5.5 hours a month for $1,000, 14 hours a month for $2,500, or 20 hours a month for $3,500. Without a retainer, advisory is $200 an hour.
The Fully Managed tier covers a business-hours remote help desk, staff onboarding and offboarding, devices, network, email security, backup, and liaison with your custodian, CRM, and other business systems. Add an advisory retainer if you also want a security lead for the regulatory work.
Fully Managed from $165 per user per month, with a $600 monthly minimum.
Fractional CISO and CTO work on a monthly retainer, with one person to call when a technology decision comes up. You decide what each month's hours go to, such as a risk register, a quarterly report to leadership, or an incident response plan and tabletop exercise.
For an SEC-registered firm, an IT provider that can access client information generally counts as a service provider under Regulation S-P. SaberGuard does the due diligence and monitoring the rule calls for, and reviews the provider's proposed work before you approve it.
A fixed-fee program for SEC-registered firms: gap review, incident response program, service-provider oversight procedures, records, staff training, and a tabletop exercise.
A due diligence questionnaire built from Regulation S-P's service-provider requirements, sent to every new vendor that will handle client information, with the answers kept in your vendor register.
MFA on every account that can reach client information, and monitoring for signs that a mailbox has been taken over. If your firm is SEC-registered and can direct transfers or payments from clients' accounts to third parties on their instructions, it may also need a written identity theft program under Regulation S-ID.
Network and firewall rebuilds, Microsoft 365 or Google Workspace setup and hardening, and finding the cloud apps staff use without approval.
Not sure? The scoping call starts with this question.
Regulation S-P, as amended in 202417 CFR 248.30
Written safeguards for customer information, an incident response program, client notice as soon as practicable and no later than 30 days after you become aware of unauthorized access, oversight of service providers, and records of all of it.
Books and records; compliance programRules 204-2 and 206(4)-7
The Regulation S-P records kept with your books, and an annual review of your compliance policies by your CCO.
Regulation S-ID17 CFR 248.201
A written identity theft prevention program if your firm can direct transfers or payments from individual clients' accounts to third parties on their instructions. Authority to deduct only your own advisory fee does not count.
FTC Safeguards Rule16 CFR Part 314
A written security program with a qualified individual in charge, MFA, encryption, and vendor oversight. If unencrypted information about 500 or more consumers is acquired without authorization, the FTC must be notified within 30 days of discovery. Firms with information on fewer than 5,000 consumers are exempt from a few requirements, such as the written incident response plan, but not from these.
Massachusetts data security regulation201 CMR 17.00
A written information security program, which the Securities Division told advisers in April 2010 it would ask to see on routine examinations.
Compliance dates and exam priorities. The compliance dates have passed: December 3, 2025 for advisers with $1.5 billion or more in assets under management, and June 3, 2026 for all other SEC-registered advisers. The SEC's fiscal 2027 examination priorities, a staff statement released October 23, 2026, say staff will evaluate response program policies and procedures, including customer notification procedures and oversight of service providers.
Sources:17 CFR 248.30SEC adopting release 34-100155SEC fiscal 2027 examination priorities
Regulation S-P does not apply to state-registered advisers. 201 CMR 17.00 applies to both kinds of firm if you hold personal information about Massachusetts residents.
Your current policies and safeguards checked against each element of amended Regulation S-P, with the gaps listed in a risk register you keep.
Written procedures to detect, respond to, and recover from unauthorized access to customer information, including how you decide whether clients must be notified and what the notice says.
Due diligence and monitoring procedures for every vendor that handles customer information, and a vendor register that records what each one holds and how it will notify you.
The written policies, procedures, and records Rule 204-2 requires for Regulation S-P, organized so you can produce them when asked.
A staff session on spotting and reporting incidents, and a tabletop exercise that tests the incident response program. Both are documented.
Ward Agent reads your Microsoft 365 or Google Workspace configuration: MFA, admin roles, sharing settings, mail security, and accounts that should have been closed. It never reads email, files, calendars, or client records. The dated results go in your program file. Ward Agent's rules are mapped to the HIPAA Security Rule. Continuous monitoring for Regulation S-P is coming soon.
The program feeds your CCO's annual review under Rule 206(4)-7. It does not replace the review.
If you keep your provider, SaberGuard checks what it has set up and follows up on what is missing.
SaberGuard adds IT and security checks alongside your in-house compliance team, outsourced CCO, or compliance consultant.
201 CMR 17.00 requires a written information security program (WISP) from anyone who owns or licenses personal information about a Massachusetts resident, and it makes no exception for SEC-registered firms. In an April 2010 notice, the Securities Division told advisers it would ask to see the program on routine examinations.
Massachusetts requires contracts that bind service providers to protect personal information (201 CMR 17.03(2)(f)2). Regulation S-P requires oversight policies but not contracts.
Under M.G.L. c. 93H, sections 3 and 3A, a firm that owns or licenses the affected data must notify the Attorney General, the Office of Consumer Affairs and Business Regulation, and affected residents as soon as practicable and without unreasonable delay. When Social Security numbers are exposed, it must also offer at least 18 months of free credit monitoring. Your incident response program tracks the state and federal steps side by side; your counsel decides the wording of each notice.
Monthly retainers for advice and engineering
Starter retainer$1,000a month
5.5 hours a month, about $182 an hour. A few reserved hours each month for questions, reviews, and small fixes.
Core retainer$2,500a month
14 hours a month, about $179 an hour. Reserved time for an ongoing security program or a steady run of IT projects.
Program retainer$3,500a month
20 hours a month, about $175 an hour. The most reserved time at the lowest rate, for firms that want SaberGuard as their security and technology lead.
Or $200 an hour with no retainer, scheduled when SaberGuard has time free from retainer work. Either way, you decide what the hours go to, such as provider oversight, policy upkeep, or exam preparation.
For SEC-registered investment advisers
Fixed feequoted after a scoping call
Advisers registered with the Massachusetts Securities Division instead of the SEC answer to different rules. The same scoping call sets their fee.
Per user, per month
Fully Managed is security and day-to-day IT from one provider, for advisory firms without an IT department.
SaberGuard assesses and advises. It does not warrant or certify compliance or promise an audit or exam outcome.
A 30-minute scoping call covers who you are registered with, who runs your IT today, and which vendors handle client information.
SaberGuard assesses and advises; it does not warrant compliance.