For RIAs & financial advisers

Prove your cybersecurity program to the SEC, and to your clients.

An exam is on the calendar, an institution wants due diligence, or the Safeguards Rule is the question nobody has answered in writing. TRM builds a defensible program calibrated to how regulators and clients actually evaluate one.

Book a 15-minute call → Take the readiness assessment
Where the pressure comes from

An SEC examination

The exam is scheduled, or the deficiency letter already arrived.

An institutional client

Due diligence wants proof before they grow the relationship.

GLBA & state rules

The Safeguards Rule applies whether or not anyone has asked.

What you're facing

The pressure rarely comes from one direction.

  • An SEC examination

    The exam is scheduled, or the deficiency letter arrived. You need documented controls and evidence that hold up to an examiner's scrutiny.

  • An institutional client

    A key client's due-diligence team sent a questionnaire and wants proof of a working security program before they'll keep (or grow) the relationship.

  • GLBA & state rules

    The Safeguards Rule and state privacy laws apply to the client data you hold, whether or not anyone has asked about them yet.

  • The questions get specific

    An examiner asks who owns access, backups, and the incident plan. Those are the answers that have to be in the file.

How we work

Fixed scope, delivered by the senior person.

Every engagement is delivered personally by Teddy Mutterperl. Scope and price are agreed in writing before work begins. A full engagement runs three to seven weeks. When the exam date is sooner than that, a focused engagement is scoped to the date. See the full catalog →

What you leave with

What you can hand an examiner.

  • Assessment

    A scored NIST CSF 2.0 maturity report, the top ten gaps, a 12-month roadmap, and a board-ready summary. Fixed scope, $3,000–$8,000.

  • Remediation

    The policies, the incident response plan, and the evidence an examiner or an institutional client asks to see. Fixed scope, $3,500–$7,500.

  • Retainer

    A named senior advisor, quarterly board reporting, questionnaire and exam support, and on-call guidance. From $3,000 a month.

Client work

One engagement.

Registered investment adviser · ~15 employees · Southeast

Trigger
An SEC examination.
Engagement
Senior advisory on the regulatory questions in front of a small firm.
Outcome
SEC exam, no material findings.
“Having someone who understood both the regulatory requirements and the practical constraints of a small firm made all the difference. This wasn't generic advice.”

Chief Compliance Officer · Registered investment adviser · identity withheld under NDA

Verbatim quote used with written permission. This is the outcome of one engagement, not a guarantee of any examination result.

Where to go next

The rest of the practice.

The engagement catalog is on Services. If the first need is the document, the Data Classification & Handling Standards and the Incident Response Plan Starter Kit download in the browser after intake, and the purchase is credited in full against an engagement booked within 90 days. A directional read on the program is the readiness assessment. The same practice also serves law firms and SaaS companies.

Book a call

Facing an exam or a client questionnaire?

A 15-minute call, no obligation. Bring whatever landed on your desk.

Book a 15-minute call → Take the readiness assessment

TRM Solutions is an independent advisory practice not affiliated with, endorsed by, or sponsored by any current or former employer. Employer names describe professional experience only. Engagements are conducted in a personal capacity and do not involve employer systems, data, clients, vendors, or confidential information. Client engagements are covered by NDA. Assessments and templates provide directional guidance and are not a penetration test, audit, certification, or guarantee of security.