The short answer: Good cybersecurity for financial advisers rests on five areas. These are clear ownership, strong sign-in controls, protection against email fraud, tested backups and oversight of IT suppliers. The Central Bank of Ireland’s guidance on operational resilience and outsourcing touches on each one. Your compliance adviser confirms exactly what applies to your firm.
This guide is for advisers, brokers and small financial services firms in Meath, Cavan, Westmeath, Louth and Dublin. It sets out a practical framework and shows where an IT provider can help. It isn’t legal or regulatory advice.
Where the Central Bank guidance fits
The Central Bank’s operational resilience guidance explains how firms should prepare for, respond to, recover and learn from disruption. It focuses on disruption to critical or important business services. The Central Bank republished it in July 2025. At the same time, it withdrew its 2016 guidance on IT and cybersecurity risk. Instead, it pointed to the EU’s Digital Operational Resilience Act (DORA) as the common standard.
However, not every small firm is directly subject to DORA. Even so, the guidance says such firms should consider equivalent measures in line with their nature, scale and complexity. In practice, that makes cybersecurity for financial advisers a question of proportion, not paperwork for its own sake.
Governance: who owns cybersecurity for financial advisers
The operational resilience guidance stresses the responsibilities of boards and senior management. So in a small firm, a named principal or director should own IT risk. Your IT provider does the technical work, but the decisions stay with you.
A provider supports this ownership in practical ways. For example, we keep up-to-date records of your devices, accounts, systems and suppliers. We also help with the IT questions in insurer and due-diligence questionnaires. As a result, the person responsible can answer questions from records rather than memory. In short, cybersecurity for financial advisers starts with a named owner.
Access and identity: who can open client files
After all, client files hold sensitive personal and financial data. Therefore, each person needs their own login, with multi-factor sign-in. The Data Protection Commission’s data security guidance advises against shared credentials. It also says staff should only reach the data they need for their role.
Good cybersecurity for financial advisers also covers leavers. When someone leaves, remove their access the same day. Also, review who can open shared mailboxes and client folders on a regular basis. Gold adds leaked-password alerts and a business password manager. It also includes application control, which limits the software that can run on your PCs.
Email fraud and cybersecurity for financial advisers
Advisory firms receive bank details and signed documents by email every day. That makes them a target for fake payment requests. For many firms, email is where cybersecurity for financial advisers meets daily work. The NCSC’s business email compromise guidance recommends a strict call-back check for any change of bank details. Use a phone number you already hold, not one from the email.
On the IT side, Gold includes email security and phishing awareness training for staff. Silver doesn’t include email security or a password manager. For that reason, client-facing staff usually suit Gold, while lighter users can go on Silver.
Hypothetical example
A six-person brokerage in Mullingar gets an email that appears to come from a product provider. It asks the firm to update the bank account for commission payments. The administrator rings the provider on the number already on file. The request turns out to be fake, so no details change.
Backup and recovery in cybersecurity for financial advisers
Many firms have a backup, but fewer have tested a restore. Both our packages back up Microsoft 365 email, OneDrive and SharePoint. We scope device and server backup in your proposal. We also test restores every two weeks, and you can request the records. Without restore tests, cybersecurity for financial advisers can leave a gap at the worst moment.
Beyond backups, recovery also depends on response times. Our helpdesk runs Monday to Friday, 9am to 5:30pm, and after-hours emergency support costs extra. Gold adds 24/7 security monitoring by our security operations centre partner. That monitoring is separate from the helpdesk. Likewise, it’s worth agreeing how the office keeps working if email or a key system goes down.
Third-party oversight and outsourcing
The Central Bank’s Cross-Industry Guidance on Outsourcing says boards and senior management remain ultimately accountable for outsourcing risk. It applies in proportion to each firm’s nature, scale and complexity. It also covers areas such as disaster recovery, exit strategies and registers of outsourcing arrangements.
In practice, your IT provider is also one of those third parties. So strong cybersecurity for financial advisers includes overseeing the provider itself. We supply information about us for your outsourcing records. In addition, our client master services agreement includes the GDPR data processing agreement. Your compliance adviser can confirm what else your records need.
How Sweeney Computer Services can help
We’ve supported Irish businesses from Hurdlestown, Kells, Co. Meath, since 1985. Our approach to cybersecurity for financial advisers maps each area above to a service. Gold, from €70 per user per month excluding VAT, covers email security and 24/7 monitoring. It also includes application control, the password manager and awareness training. Silver starts from €45 per user per month excluding VAT. Microsoft 365 licences are billed separately.
See our IT support for financial services firms, our cybersecurity services and our managed IT support. You may also find our guide to handling client ID documents securely useful.
A quick sense-check
Want a second view on your firm’s IT security?
Book a short call with Michael Sweeney about your accounts, email, backups and suppliers.
