Vendor Due Diligence — Self-Report

Thank you — your response was received.

The MTradecraft team will review your submission. Self-reported answers are recorded as vendor-attested and are independently reviewed before publication. Questions: vdd@mtradecraft.com.

This questionnaire supports the service-provider due diligence SEC-registered advisers document under Reg S-P (17 CFR §248.30(a)(5)) and Rule 206(4)-7, and the vendor oversight FINRA expects of member firms. Please answer for the entity named below. Your answers are recorded as vendor-attested and reviewed by MTradecraft before any publication. Fields marked * are required.

Leave this field empty

Information Security Practices

Business Continuity Plan *

Cybersecurity or Information Security Policy *

Incident Response Plan *

Records Retention Policy *

SOC 1 / SOC 2 / SSAE-18 Reports *

ISO Certification *

Secure Disposal Procedures *

Physical Safeguards (locked server rooms, key-card access) *

Remote Work Policies *

Firewalls & Intrusion Prevention *

Encryption of data in transit and at rest *

Remote Wipe Capability *

Strong Password & MFA Enforcement *

VPN for Remote Log-In *

Company-Issued Devices Only *

Mobile Device Management (MDM) *

Virus & Malware Protection *

Network Monitoring / SIEM *

Penetration Testing *

Vulnerability Assessments *

Restrictions on Removable Media *

Patch Management Program *

Cybersecurity Insurance *

Terminated Employee Access Revocation *

Least Privilege / Role-Based Access Control *

Access Rights Reviewed Annually *

Backup & Redundancy Procedures *

Data Loss Prevention (DLP) Solution *

Fraudulent Wire Change Prevention (call-back policy) *

📎 Documents: please email SOC 2 reports, ISO certificates, and policies to vdd@mtradecraft.com — do not upload them here.

Training & Oversight

Do you train employees on client information protection? *

Yes No

If yes, how frequently and on what topics?

Would you allow client-provided training materials to be incorporated into your program? *

Yes No

Cyber Incidents & Testing

Were there any breaches or intrusions in the past year? *

Yes No

Did your firm experience a significant business disruption in the past year? *

Yes No

Do you periodically evaluate the effectiveness of internal and external controls? *

Yes No

If yes, describe the incident, records impacted, and corrective actions.

If yes, describe and note whether your BCP worked as expected.

If yes, describe the process and frequency.

Confidentiality & Compliance

Vendor maintains controls to protect confidential data and prevent unauthorized disclosure. *

I confirm

Vendor will not disclose client information except when legally required. *

I confirm

Vendor certifies internal cybersecurity controls sufficient to protect confidential data. *

I confirm

Vendor agrees to notify the client firm of any breach involving the firm's customer information as soon as possible, and no later than 72 hours after becoming aware of it. *

I confirm

Vendor maintains MNPI policies and procedures compliant with federal securities laws. *

I confirm

Certification

Authorized Signatory Name *

Signatory Title *

Date *

Signature *

I certify that all responses are true and complete to the best of my knowledge, and acknowledge that the client firm will rely on this information. *

I certify

By submitting, you certify the responses are true and complete to the best of your knowledge and acknowledge the client firm will rely on this information. Public information about your firm only; do not include client data. Not legal advice.