Home / Vendor Security Review
TechFort Services
Vendor Security Reviews for Small Regulated Firms
Your regulator holds you responsible for every provider that touches your data, not just your IT company.
Most regulators, including CIMA, the FTC Safeguards Rule and HIPAA, expect you to oversee the outside providers that handle your data. TechFort builds and keeps your vendor register: who each provider is, what data they hold and where, what proof of security they have given you, how fast they will tell you about a breach, and how you get your data back when you leave. We include ourselves in it.
What we ask each provider for
- Proof of security controls: a SOC 2 or ISO 27001 report from large providers, or a completed security questionnaire from smaller ones.
- A breach-notice promise fast enough for you to meet your own deadline, such as CIMA's 72 hours or the FTC's 30 days.
- Where your data is stored, and who at the provider can see it.
- Proof of cyber insurance.
- A way to delete or return your data when you leave.
- 2-step sign-in on the accounts your staff use with them.
Who belongs on the register
Email and file storage, accounting and payroll, practice or matter management, data rooms, e-signature, backup, AI and note-taking tools, and any firm you share drives or folders with. The ones staff signed up for on their own count too; our scans find them.
Kept current
The register is reviewed every year and whenever you add a provider, and it is ready to hand to your regulator, auditor or insurer on request.
Who does the work
Christian Ririe leads every compliance engagement personally. He spent 15 years at the World Bank, where he worked with its Internal Audit department on the yearly audits, testing servers and systems for vulnerabilities. We test to the public NIST SP 800-115 guide and OWASP testing methods.
We use AI to draft, scan and test, and every deliverable is reviewed, tailored and owned by TechFort. That is how a small firm gets a complete program at a fraction of what it usually costs.
Straight answers
Common Questions
Do you review TechFort too?
Yes. We complete the same security questionnaire about ourselves, and our work is covered by the periodic independent review in your program.
What if a provider will not answer?
We record that, rate the risk, and suggest options: limiting what data they hold, adding contract terms, or replacing them. Your leadership decides.
Related
You Might Also Need
Security Compliance Programs
Policies, testing and proof for regulated small firms, kept current every year.
Learn moreCybersecurity Policies
The written policy set regulators and insurers ask for, matched to how your firm actually works.
Learn moreCIMA Cybersecurity Compliance
For Cayman Islands regulated entities: the CIMA Rule and Guidance, mapped and met.
Learn moreTired of waiting on hold for IT help?
Book a free 15-minute call. We'll talk through what's bugging you about your current setup - no commitment, no hard pitch, ever.
Call or text us
509-418-0682Call or text anytime - you get a real local tech, not a phone tree, not a ticket queue, not a call center three time zones away.
What happens next
- You tell us what's going on (15 minutes, tops).
- We take a free, no-strings look at your setup.
- You get a flat monthly price - and a plain-English plan.