Two ways to work with MTradecraft: build the compliance file, then have it tested.
Tradecraft Advisors is a fictional $750M adviser we invented so you can see real output instead of a feature list. BrainTrust Premium helps a CCO build and maintain the documents and records behind the cybersecurity program. Separate audits and assessments test whether the firm's systems match those documents, then hand the CCO rule-mapped findings and a fix plan for the IT provider.
Generate the written program from your own answers, train employees with completion records, document vendor oversight, prepare for incidents, watch the public footprint each quarter, and check exam readiness.
MTradecraft tests the agreed systems and documents, writes findings mapped to the SEC rule each one bears on, and gives you a prioritized fix plan your firm and its IT provider can work from.
MTradecraft documents what it finds and what should change. Your firm and its technology providers make the changes. We never sell the remediation, so the findings are not a sales pitch for the fix.
All 13 sample PDFs open at no charge with a free BrainTrust account (join free). A free account opens the samples; it does not include the tools shown here. Jump to the full PDFs.
Tradecraft Advisors LLC
A deliberately ordinary mid-size adviser. If your firm looks anything like this, the documents below are what your BrainTrust output looks like, generated from your own answers instead of ours.
The technology the program has to cover
Product categories shown for realism. No affiliation with or endorsement by any vendor is implied.
What membership builds
Six jobs every compliance program has to do, shown at the moment each one matters, and the document the tools produced for it. Under each one: what the CCO walks away with.
How to view Sign in with a free BrainTrust account.
Build the written program
Tradecraft Advisors' manual was last touched in 2021. Reg S-P was amended in 2024, the firm adopted AI tools nobody wrote down, and the annual review is 90 days out. The CCO needs an adopted, current written program, not a template with the firm name pasted in.
Generated with the Policies & Procedures Manual Builder and the AI Toolkit.
Definitions
“Customer Information” means any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by the Firm or on its behalf. (17 C.F.R. § 248.30(d)(5).) For clarity, Customer Information includes records of customers of other financial institutions that the Firm holds, processes, or has access to.
“Cybersecurity Incident” means any actual or reasonably suspected unauthorized access to or use of Customer Information or Firm Information, or any event affecting the confidentiality, integrity, or availability of the Firm's Information Systems.
Access Controls (reviewer red-line copy)
The Firm enforces multi-factor authentication for all users of the Microsoft 365 environment, consistent with the firm profile provided at generation. Exceptions require written IT vendor CCO approval and are recorded in the exception log maintained under Section 12…
4.2 Approved Tools
The Firm maintains a register (Appendix A) of every AI tool approved for business use, the approved use cases for each, and the data classes each tool may receive. A tool not on the register is not approved.
Basis: Rule 206(4)-7 (adequacy of written policies); 17 C.F.R. § 248.30(a)(1) (safeguards for customer information).
Status: Required. Evidence: Appendix A register, reviewed quarterly.
6.1 Data Protection
No employee may enter Customer Information or Sensitive Customer Information into any AI tool that has not been approved for that data class in Appendix A. Client-identifying detail is removed or…
Every substantive control in both documents carries its regulatory basis, status, and evidence line, so when a rule changes or the annual review comes around, the firm can find every clause that depends on it instead of rereading the manual from page one.
Train the people
Tradecraft Advisors' biggest attack surface is not a server. It is 22 inboxes. A written program is only as strong as the people named in it, who have to recognize the Tuesday-morning wire fraud before it happens, and when an examiner asks how the firm trains its employees, the answer has to be a record, not a recollection.
Delivered through FieldCraft, MTradecraft's Employee Cybersecurity Training. Included with membership for up to 50 users, with completion tracking built in.
| Module | Assigned | Complete | Status |
|---|---|---|---|
| Phishing and email fraud | 22 | 22 | [ COMPLETE ] |
| Wire transfer verification | 22 | 21 | [ 1 OVERDUE ] |
| Handling client information | 22 | 22 | [ COMPLETE ] |
| Ransomware and device safety | 14 | 12 | [ IN PROGRESS ] |
Overdue learners are re-notified automatically; per-learner completion records follow on page 2 and are retained in the firm's compliance file as evidence the program operates…
Evaluate a vendor
Reg S-P now requires written service-provider oversight, including due diligence and monitoring. Tradecraft Advisors' most important vendor is also its biggest: Microsoft 365 touches more of the firm's customer information than any other system. "It's Microsoft, it's fine" is not a due-diligence file.
Generated from the Vendor Due Diligence Portal: a 600+ vendor catalog, ~78 researched fields per vendor, every answer cited to a live source or flagged for vendor attestation.
What it is
Cloud productivity, email, and file storage. For this firm it is a principal repository of Customer Information and the main channel through which sensitive documents move.
Gets full Reg S-P oversight treatment because Tradecraft marked this vendor as receiving customer information.Evidence synopsis
- SOC 2 Type II and ISO/IEC 27001 certificates current at review; scope checked against the services the firm actually uses. Source: Microsoft Service Trust Portal, reviewed Aug 2026.
- Vendor breach-notice terms reviewed against the Reg S-P requirement that the firm's oversight be designed to obtain provider notice within 72 hours. Source: Microsoft Products and Services Data Protection Addendum, security-incident notification terms.
- Data-residency and subprocessor disclosures on file. Source: Microsoft subprocessor list, published disclosure, Aug 2026.
Watch-outs and open items
- Tenant-level controls (MFA enforcement, external-sharing limits) are the firm's responsibility, not the vendor's; two items route to the firm's decision log…
Institution's decision
| ☐ Approve ☒ Approve with conditions ☐ Decline |
| Conditions: confirm tenant MFA report quarterly; close two open items by [DATE] |
| Reviewed by: ____________________ Title: CCO Date: ____________ |
Handle an incident
Tuesday, 9:40 a.m.: an operations associate reports that a client "confirmed" wire instructions the firm never sent. This is the moment the program is for. The plan activates, the team assesses what was accessed, and the deadline is unforgiving: once the firm becomes aware that unauthorized access to or use of customer information occurred or is reasonably likely to have occurred, required customer notice is due as soon as practicable and no later than 30 days out, subject to the rule's exceptions. If the breach sits at a service provider, the firm's vendor oversight must be designed so the provider tells it within 72 hours of becoming aware; without that, the firm may never hear at all.
Generated with the Incident Response Plan Builder (before the incident) and the Incident Response Assistant (during it).
8. Customer Notification
The Firm will notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice will be provided as soon as practicable, but not later than 30 days after the Firm becomes aware. (17 C.F.R. § 248.30(a)(4)(iii).) The 30-day clock runs from that awareness, not from completion of the harm assessment.
4. Detection and Identification
Alerts and escalations from the Firm's managed IT / security provider [FILL IN: MSP NAME], including endpoint, email, and network monitoring. Any employee who suspects an incident must report it immediately; there is no penalty for a good-faith report that proves…
Routes detection through an MSP because Tradecraft answered: IT is outsourced.| Time | Action | Status |
|---|---|---|
| 09:40 | Associate reports client-confirmed wire instructions not originated by the Firm; plan activated | Report logged |
| 09:52 | Custodian contacted; hold requested on pending disbursement | |
| 10:15 | Affected mailbox isolated; credentials reset; MSP engaged for log preservation | |
| 10:40 | Assessment opened: was customer information accessed or used without authorization, and whose? Awareness that unauthorized access or use occurred, or is reasonably likely to have occurred, starts the 30-day outer limit for customer notice | Assessing |
Determination record, notification decision, and 204-2(a)(25) retention checklist follow on pages 2–3…
Check the outside
Tradecraft Advisors hosts nothing on-premises, so it is tempting to assume there is nothing to scan. But the firm still has a public footprint: its domain, its DNS, its mail configuration, its login pages. That footprint is what an attacker sees first, and it drifts without anyone deciding to change it. A dated quarterly scan, with findings worked to closure, is one way the annual review shows the external safeguards are operating and reviewed.
Delivered as the Quarterly External Vulnerability Scan, included with membership. External only. Nothing to install, no credentials, no agents.
Act on these first
| Ref | Finding | Owner | Status |
|---|---|---|---|
| EX-014 | DMARC policy is p=none, so the firm does not ask receiving mail systems to quarantine or reject messages that fail DMARC authentication. Move to quarantine, then reject | MSP | [ OPEN ] |
| EX-015 | Retired marketing subdomain still points at a deprovisioned hosting service, a takeover candidate. Remove the DNS record | MSP | [ OPEN ] |
| EX-009 | TLS certificate on the client document portal alias expires in 21 days; auto-renewal not confirmed | MSP | [ IN PROGRESS ] |
| EX-006 | Two employee addresses appear in a 2024 third-party breach corpus; confirm those passwords were rotated and are not reused | Firm | [ CLOSED Q2 ] |
Checks with no finding (41 of 44): no exposed admin panels, no open database or remote-desktop ports, mail transport encryption in place, no expired certificates on primary hosts…
Prepare for scrutiny
A records request arrives from the Division of Examinations. The question is not only whether the firm has policies. It is whether the file proves the program operates. Tradecraft Advisors ran the Mock SEC Cyber Exam a quarter earlier, on purpose, to find the gaps before an examiner did.
Generated with the Mock SEC Cyber Exam. Free to run; answers never leave the browser.
| Item | Governing rule | Status |
|---|---|---|
| Written incident response program adopted and current | §248.30(a)(3) | [ SATISFIED ] |
| Service-provider oversight: due diligence documented for material vendors | §248.30(a)(5) | [ PARTIAL ] |
| Incident records kept in an easily accessible place for 5 years, first 2 in an appropriate office | 204-2(a)(25), (e)(1) | [ SATISFIED ] |
| Annual review documents adequacy AND effectiveness | 206(4)-7 | [ OPEN ] |
| Identity-theft red flags program reviewed for covered accounts | Reg S-ID | [ PARTIAL ] |
| Employee cybersecurity training assigned and completion documented | 206(4)-7, §248.30(a)(1) | [ SATISFIED ] |
Sections: Program governance · Reg S-P incident response · Privacy & identity theft · Books & records · Safeguards in practice · Training & exam readiness…
The tools write the program. The engagements verify that the systems match it, and every finding is mapped to the rule it supports.
From documented to demonstrated
Everything in Section 1 is the firm's own account of its program: what it does, who owns it, how it responds. An examiner reads that account, then asks for evidence that it matches the systems.
Tradecraft Advisors' mock exam left this item open. Rule 206(4)-7 requires the annual review to cover the adequacy of the policies and the effectiveness of their implementation. The written program answers the first half. The second half takes testing: is Microsoft 365 set up the way the policy says, are the firm's public-facing systems as clean as the vulnerability scan suggests, and does the written program match both.
The engagements below produce that evidence. In a separately scoped engagement, MTradecraft reviews the agreed systems, records what it finds, and writes findings mapped to the SEC rule each one bears on: what the issue is, why it matters, who should own it, and the recommended order of work. MTradecraft does not change settings and is not the firm's IT provider. Each sample report was written against the documents in Section 1: the audit cites the incident record and the vulnerability scan, and the gap analysis reads the P&P manual.
Engagements are billed separately from membership; members pay the member price. Each starts with a short scope call so the quote covers exactly your environment.
Microsoft 365 / Azure Configuration Audit
Use this when your policies say Microsoft 365 is protected and you need independent evidence of how user access, email protection, external sharing, and activity records are actually configured.
A summary for the firm, each finding mapped to the SEC rule it relates to, a shaded box with the settings for the IT provider, an order of work, and an appendix that accounts for every test that failed.
Cybersecurity Vulnerability Audit
Use this when you need one report that covers what the internet can see, what the office network exposes, and whether the written program matches, with the technical detail packaged for your IT provider.
An excerpt of the full report: testing dates and scope, findings at a glance, representative findings from each component, a scope matrix showing what is included, optional, and excluded, and the remediation sequence.
Compliance Documentation Gap Analysis
Use this after an audit, or before an exam, when you need to know where the manual and plans say one thing and the tested environment shows another, with the wording that closes each gap.
Where the written program and the tested environment diverge: a coverage matrix, each gap with the rule it bears on and the wording that closes it, and an appendix the CCO can work as a red-line.
How to view Sign in with a free BrainTrust account, the same as the membership samples.
Every sample above, complete and unabridged
Two lists, one per section, so nobody has to work out which documents came from the membership and which from an engagement. Each is the full, watermarked PDF. Every PDF opens with a free BrainTrust account. A free account is required to open the sample PDFs. After signing in you return to this page automatically.
Not a member yet? Create a free BrainTrust account, then come back to this page.
What BrainTrust Premium includes
Everything in Section 1 comes from one BrainTrust Premium membership, generated from the firm's own answers. The audit and assessment reports in Section 2 are separate paid engagements and are not included. Also in the membership, beyond what fits on this page:
Stop starting from blank templates. Describe your firm once, generate the working file, and adopt it through your own governance. Manual, vendor reports, and incident plans from your answers; training, scan, and incident records as the program runs.