The FTC Safeguards Rule tells a financial firm to write an information security program and then to run the safeguards named inside it. Writing is the half that gets done. This catalog is the other half: restricting what runs, encrypting what matters, watching the estate, protecting the mailbox, and being able to restore. All of it operated for you by Fortify 24x7, and all of it sold one entry at a time.
None of these arrive as a dramatic breach. They arrive as a routine that went unexamined for a couple of years, and they turn into a notification letter, a client call, or a finding in a written examination report.
A shared operations mailbox handles wiring instructions, custodian notices, and client paperwork. Everyone signs in to it and nobody owns it. Whoever gets inside does not need to break anything afterwards; they only have to write in a voice your clients already trust.
Filing season arrives and you add three seasonal staff. Returns land on personal laptops you cannot patch, cannot inspect, and cannot erase. April ends, the contracts end, and copies of somebody else's tax records go home in a rucksack.
One machine, one unencrypted volume, and a folder of borrower files that was only supposed to be there for a fortnight. What follows is not really a security incident. It is a notification exercise, run under whichever state statutes cover the people in that folder.
A portal account issued to a firm you stopped working with two summers ago. Nobody cancelled it because nobody kept the list. Oversight of service providers is written into the rule for exactly this reason, and it is the control most often skipped.
Each register holds a group of entries, names the platform underneath it, and states in writing where its usefulness ends. Nothing is bundled, nothing is a tier, and every entry carries a rate per unit per month that you can see before you talk to anybody.
Software on each machine reading conduct instead of signatures, a layer above it pulling the estate together, and analysts who act on whatever emerges.
Listed software executes on the desks where client files get opened. Everything outside the list is turned away, without waiting for anyone to recognise it first.
Defence attached inside the mailbox over the tenant API, examining mail that has already landed, plus short instruction for whoever happens to be reading it.
An asset record that stays true, updates that genuinely land, filtering travelling on the very same agent, and somebody keeping an eye on the phones.
Locate the regulated records before governing them, since a folder nobody has found can be neither encrypted, nor restricted, nor honestly reported on.
Copies parked at a distance from whatever they cover, and restores that get exercised instead of assumed. Recovery is the clause of a plan nobody rehearses.
The table below exists so the holes are as visible as the coverage. Four rows have no entry in our catalog whatsoever, and saying so out loud is worth more to your practice than pretending a subscription closes them. Paragraph references are given for orientation; confirm how any of them binds your firm with your own counsel.
| What the paragraph asks for | Which register carries it | How far that actually goes |
|---|---|---|
| Restricting who reaches what | Application control, Device oversight | Application control decides what may execute, and device oversight decides where a machine may go. Permission decisions inside your own identity provider remain yours. Split · 16 CFR 314.4 at (c)(1) |
| Knowing where the records sit | Data safeguards | Regulated records get located across workstations and shares, then reported by category, by volume, and by how exposed each machine happens to be. We run it · 16 CFR 314.4 at (c)(2) |
| Customer information kept unreadable | Data safeguards | Whatever the scanning found gets encrypted, and the channels it can leave along get narrowed. Settings inside a cloud platform you own stay under your hand. Split · 16 CFR 314.4 at (c)(3) |
| A second factor at sign in | Nothing to buy. Help configuring it | This belongs to your identity provider. We will set it up beside you and confirm later that it stayed on, and there is no line item attached to doing so. Your practice · 16 CFR 314.4 at (c)(5) |
| Changes recorded, software updated | Device oversight | Build and third party update status is tracked, approved updates are delivered, and whatever declined to install comes back to you as a list. We run it · 16 CFR 314.4 at (c)(7) |
| Activity logged and actually read | Monitoring and response | Machine, directory, mail, and network events are collected, retained, and put in front of an analyst who reacts to what they show. We run it · 16 CFR 314.4 at (c)(8) |
| Watching continuously, or testing instead | Monitoring and response | The staffed watching entries are the continuous route. Penetration testing and vulnerability sweeps get engaged separately, and neither is billed from this page. Split · 16 CFR 314.4 at (d) |
| Instruction for the people who read mail | Email protection | Simulation and short lessons, reported individually, so instruction reaches whoever the outcomes indicate rather than the whole practice at once. We run it · 16 CFR 314.4 at (e) |
| Keeping an eye on your suppliers | Nothing to buy. We answer yours | We happen to be one of those suppliers, and a written diligence questionnaire gets answered. Assessing your other vendors is programme work rather than a subscription. Your practice · 16 CFR 314.4 at (f) |
| A response plan, in writing | Monitoring and response, Recovery and continuity | Watching supplies the plan with detection and containment. Recovery supplies it with restoration. Drafting the document and naming who decides belongs to your practice. Split · 16 CFR 314.4 at (h) |
| A risk assessment, written and revisited | Nothing to buy. Evidence supplied | No entry in this catalog performs one. What we hand over is the asset record, the exposure figures, and update status, so whoever writes it starts from facts. Your practice · 16 CFR 314.4 at (b) |
| A qualified individual, and reporting upward | Nothing to buy | A named person inside your practice owns the programme and reports on it. That role cannot be handed to a catalog, and pretending otherwise would not help you. Your practice · 16 CFR 314.4 at (a) and at (i) |
This trade has a habit of hinting that a managed service came out of its own workshop. Ours did not. Ten commercial platforms sit underneath Equity IT Solutions, licensed through Fortify 24x7 and run by engineers who watch them for a living. Named tooling and a telephone number beats a sealed box every time, and it is also easier for your examiner to follow.
Conduct based detection with unaided reaction on machines, covering Windows, macOS, Linux, and the nodes of a cluster.
Correlation and evidence retention across sources, so an alert arrives at an analyst with the neighbouring events already attached to it.
Allowlisting, ringfencing, and elevation on the desks where client files are opened every working day.
Mailbox level defence attached over the tenant API. This is not a gateway product, and pretending otherwise would be untrue.
Asset records, update delivery, scripting, attended remote sessions, and name lookup filtering, all from one agent.
Management of Apple hardware that has spent quite long enough belonging to nobody in particular.
Threat detection living on the iOS and Android handsets your staff read client mail with.
Locating regulated records, scoring exposure machine by machine, and applying encryption along the routes material travels.
Copies, at image level and at file level, lifted off workstations, physical servers, hypervisor guests, and a Microsoft 365 tenant.
Whatever a Google Workspace tenant holds, plus Entra ID configuration and the ledger sitting inside QuickBooks Online.
No committee has to convene and no discovery phase appears on an invoice. Practices of this size are usually covered and quiet within two weeks, and the slow part is always the tuning rather than the installing.
Half an hour. Staff count, machine count, which platform carries the client files, and whether a regulator has already put something to you in writing. What you walk away holding is a list of entries with a monthly total beside it, rather than a document that needs circulating for signatures.
Entries are chosen on this site and then you check out. Your card stays with Stripe throughout and reaches us at no point. Collection runs monthly, ahead of the period it covers, under the descriptor FORTIFY 24X7.
Installers and enrolment links show up in your portal, generally before that same working day ends. Windows, Apple hardware, handsets, and cloud tenants each take their own path, and not one of them asks anybody at your practice to learn a console.
Lists finish being observed, filters gather their exceptions, and copy windows get measured against material your practice genuinely holds. This stretch decides between a quiet rollout and a fortnight of interruptions.
Alerting lands on our desk and not in anybody's inbox at your practice. The portal carries your entries, your agent downloads, and the written trail of everything raised, which is the part that counts on the day evidence gets requested.
Most security pages aimed at regulated firms imply that buying the product settles the obligation. This one will not, because that is not how any of it works, and because a firm that believes it is covered stops looking at the places it is not.
Rates are read live from the billing service when this page loads, so the number here and the number on the card are the same number. Add what your program calls for, adjust the units on the order sheet, and settle when the list reads correctly.
Machines and cluster nodes, offered at three grades of reaction. Six entries. Read the register.
Listed software executes and everything else gets turned away. One entry. Read the register.
Defence attached to the mailbox itself, plus an instruction record. Two entries. Read the register.
Windows machines, Apple hardware, and the handsets carrying client mail. Four. Read the register.
Find regulated records first, then narrow where they may travel. Two entries. Read the register.
Desks, servers, and whichever cloud accounts almost nobody copies. Nine entries. Read the register.
Heads up: card statements show FORTIFY 24X7 - Equity IT Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.
Equity IT Solutions raises no separate charge of its own, so a second line will never turn up beside that one.