By and large, the RIAs I audit run on Microsoft 365, and almost none of them are configured to survive an SEC exam. That gap is the entire problem. Firms buy Microsoft 365 the way they buy office furniture. Email works, Word opens, Teams rings, and the MSP says security is included. Nobody asks the harder question, which is whether the tenant produces the evidence an examiner will ask for.
It usually does not.
The rest of this article is free to read with a BrainTrust account. Free members also get every Insight, the Securing Compliance exam report, the Mock SEC Cyber Exam, and the Document Review Matrix — name and email, no card.