Most SEC-registered advisers run on Microsoft 365, and most of the controls a firm needs to meet its cybersecurity obligations are already included in the licenses it pays for. The gap is rarely a missing tool. It is configuration that was never finished, logging that was never turned on, and the space between what the MSP set up and what the CCO can prove.
The expectation is multi-factor authentication for every user — enforced and evidenced, not merely enabled. "We have MFA" is not the same as "here are 90 days of sign-in logs showing MFA was enforced on every login." The second is the answer that survives an exam.
Logging is what turns posture into evidence. The annual Rule 206(4)-7 review is far easier to defend when the configuration baseline and drift reports are sitting in the evidence file, dated.
The 2024 Regulation S-P amendments made safeguarding, detection, and response explicit, written, testable requirements.
The New SEC Regulation S-P Amendments: What Every RIA Needs to Know →
Across RIA assessments the same five recur: half-enabled MFA, DLP configured but not enforcing, audit logs never reviewed, Defender left untuned, and exposed Azure workloads. Each is a configuration-and-evidence problem, not a licensing one — and each maps to a specific obligation.
Microsoft 365 and Azure for RIAs: The Deployment Mistakes I Find Almost Every Time →
The Microsoft 365 / Azure Configuration Audit is a benchmark scan of the tenant with pass/fail results mapped to SEC-relevant controls — Regulation S-P, Rule 206(4)-7, Rule 204-2 — delivered as a written report with a screenshot for every finding, regulatory mapping for every failure, and a prioritized remediation roadmap. It is available as a one-time engagement or as the recurring Q1/Q3 component of the annual programs.
The controls exist in Microsoft 365; meeting the requirements depends on configuring them correctly and producing evidence they are in force. SEC obligations are satisfied by demonstrable controls — enforced MFA, audit logging, DLP, encryption, access reviews — not by the presence of a license.
Audit logs enabled in Microsoft Purview with a retention period that meets Rule 204-2 recordkeeping obligations, plus Entra ID sign-in logs that evidence MFA enforcement across the review period.
MFA is foundational but not sufficient. Regulation S-P also requires data loss prevention, encryption, role-based access with periodic reviews, a written incident response program, and service-provider oversight — all of which an RIA must be able to evidence.
A configuration audit produces the report, the regulatory mapping, and the remediation roadmap. The first call is twenty minutes and there is no obligation on either side.
Click here to start a conversation →