The FCA's March 2025 deadline has passed. What it means for IFA managing directors right now.
Firms that have not documented their Important Business Services are in active breach. Here is what a non-compliant firm needs to do next.
Patrick MurphyWhy your IT provider cannot tell you how secure you are − and why that matters to your board.
Your IT provider manages systems. That is not the same as governance oversight. There is a structural reason they will never independently assess their own work.
Gerard OuattaraConsumer Duty has a cyber dimension. Most IFA boards have not connected the two.
A cyber incident that disrupts client servicing is a Consumer Duty failure, not just an IT event. Here is how GOIA maps the governance bridge.
Patrick MurphyDMARC: the email security configuration that costs nothing to fix and appears in almost every IFA firm assessment.
A DMARC record set to "none" means your firm's email domain can be impersonated. Fraudulent payment instructions can appear to come from your managing director.
Gerard OuattaraHow one cyber insurance premium reduction paid for a governance review three times over.
The investment case for cyber governance framed in financial terms - how the Insurer Evidence Pack translates directly into premium outcomes at renewal.
Gerard OuattaraWhat happens in GOIA's bi-annual incident response tabletop exercise − and why your board needs one.
A facilitated IR exercise is the fastest way to identify whether your board's theoretical IR plan would survive first contact with a real incident.
Gerard OuattaraFree Resource
Can't find what you need? Ask Patrick directly.
Ask Patrick - Cyber Clinic for IFAs is a free resource built by Patrick Murphy. Ask any question about FCA cyber expectations, operational resilience, or governance and get a plain-English answer.