By and large, the RIAs I audit run on Microsoft 365, and almost none of them are configured to survive an SEC exam. That gap is the entire problem. Firms buy Microsoft 365 the way they buy office furniture. Email works, Word opens, Teams rings, and the MSP says security is included. Nobody asks the harder question, which is whether the tenant produces the evidence an examiner will ask for.
It usually does not.
The rest of this article is available to members of the MTradecraft community.