If something disrupted your RIA tomorrow morning, would your team know exactly what to do?
You may think the answer is yes.
But a lot of firms do not discover gaps in communication, decision-making, backups and recovery planning until they are already dealing with the disruption.
That is not the moment I want you figuring out who is in charge.
September is National Preparedness Month, which makes this a good time to have a very simple conversation with your leadership team.
You do not need an all-day retreat.
You do not need a 40-page presentation.
You need 15 minutes, the right people and five direct questions.
For an RIA, those 15 minutes can reveal a lot about your business continuity plan, incident response readiness and ability to keep serving clients when normal operations break down.
1. If Our RIA Could Not Operate Tomorrow, What Would We Restore First?
This sounds simple until you really think about it.
Your RIA probably depends on a long list of systems every day:
- CRM
- Portfolio management software
- Custodian access
- Financial planning software
- Document storage
- Client portals
- Phone systems
- Microsoft 365 or Google Workspace
But disaster recovery is not about turning everything back on at once.
It is about knowing what needs to come back first.
Your own RIA preparedness checklist uses recovery priorities such as restoring client contact information, phone and email access first, then financial planning and trading capability, followed by less critical administrative functions.
That is the kind of thinking I want your team to do.
Ask:
What systems do we need to communicate with clients?
What do advisors need to continue serving clients?
What systems contain information we cannot operate without?
What could stay down for a day without causing major harm?
If nobody agrees on the answer, that is useful information.
You just found something that needs to be documented.
2. Who Makes Decisions During an RIA Cybersecurity Incident or Business Disruption?
Pressure exposes unclear ownership very quickly.
When nobody knows who has authority, people wait.
Or they make different decisions.
Or five people start calling five different vendors.
That is how a manageable problem can become chaotic.
Your team should know who is responsible for:
- Starting the incident response process
- Contacting your IT or cybersecurity provider
- Alerting the CCO
- Communicating with employees
- Contacting critical vendors
- Coordinating with legal counsel
- Contacting your cyber insurance provider
- Making decisions about client communications
- Documenting what happened
The amended Regulation S-P framework in your RIA materials emphasizes a written incident response program that includes investigation, containment and customer notification procedures.
A written plan matters.
But the people in that plan matter just as much.
If I asked everyone on your leadership team, “Who takes charge during a cybersecurity incident?” I would want to hear the same answer.
3. How Would We Communicate If Email or Phones Were Unavailable?
Most of us do not think much about communication tools when they are working.
Then Microsoft 365 goes down.
The phone system stops working.
Internet access disappears.
Or an incident forces you to stop using a compromised account.
Now the simplest question becomes difficult:
How do I reach everybody?
Your RIA should know the answer before that happens.
If employees cannot access email, where do they get instructions?
If your normal phone system is unavailable, how do clients reach you?
If your office loses internet access, how does leadership coordinate the response?
Do you have an offline list of employee phone numbers?
Do you have current contact information for your custodian, IT provider, legal counsel and cyber insurer?
Your RIA readiness checklist specifically calls for key employee contact information, critical vendor contacts, a client communication plan and offline copies of emergency contacts.
That is not busywork.
It is what keeps a communication problem from becoming an operational problem.
4. What Is Our RIA’s Biggest Operational Dependency?
Every RIA has something it depends on more than it realizes.
Sometimes it is technology.
Sometimes it is a vendor.
Sometimes it is a person.
Maybe almost everything runs through your CRM.
Maybe your advisors depend heavily on one portfolio management platform.
Maybe one employee knows how an important operational process works and nobody else has ever written it down.
Maybe your office has only one reliable internet connection.
Maybe your document management platform holds nearly every important client file.
These dependencies are easy to ignore when everything is working.
They become very obvious when something fails.
For RIAs, vendor and system dependencies deserve particular attention because sensitive customer information may be stored across custodians, CRMs, financial planning platforms, document systems and other third parties. Your readiness materials specifically call for firms to assess the operational and data privacy impact if critical vendors are breached or become unavailable.
Ask your team:
What one system would hurt us most if it disappeared for 24 hours?
Then ask:
What would we do about it?
Do you have another way to work?
Is the process documented?
Can your data be recovered?
Do you know who to call?
If the answer is “not really,” you just identified an important business continuity risk.
5. If Something Happened Tomorrow, What Would We Wish We Had Done Today?
This may be my favorite question.
Because it cuts through all the paperwork.
Imagine the incident has already happened.
Your team is trying to respond.
What do you wish you had done yesterday?
Maybe you wish you had:
- Tested your backups
- Updated your incident response plan
- Printed an emergency contact list
- Removed an old employee account
- Turned on MFA
- Documented a critical process
- Reviewed a vendor
- Replaced an aging computer
- Confirmed who is responsible for client communications
- Tested your business continuity plan
None of those things feel dramatic during a normal Tuesday.
That is why they are easy to delay.
But preparedness is really about answering questions while you still have time to think.
Your own Regulation S-P readiness checklist calls for documented backup procedures, recovery testing, annual BCP review, incident response procedures and clearly defined responsibilities.
I would rather have your team discover a gap during a 15-minute meeting than during a ransomware attack.
What Should an RIA Do After This 15-Minute Preparedness Meeting?
When the meeting is over, look at your five answers.
Some will probably feel solid.
Others may sound like:
“I think Bob handles that.”
“I’m pretty sure our backup does that.”
“Our IT company probably has that documented.”
“We could probably get that information from the custodian.”
Those are the answers I would circle.
Because they are assumptions.
And assumptions are where preparedness plans tend to break.
The SEC’s 2026 examination priorities continue to identify information security and operational resiliency as areas of risk affecting market participants.
That does not mean your business continuity plan needs to become complicated.
It means your people, processes and technology should work together when normal operations do not.
Where Does an RIA-Focused IT and Cybersecurity Partner Fit?
This is where the right technology partner can help turn the conversation into action.
An RIA-focused IT and cybersecurity provider should be able to help you:
- Identify critical systems and operational dependencies
- Verify backups
- Test recovery processes
- Review user access
- Strengthen MFA and endpoint security
- Document key systems
- Support business continuity planning
- Help prepare for cybersecurity incidents
- Review technology and vendor risks
The goal is not to turn your leadership team into IT people.
It is to make sure your leadership team knows what happens when technology stops working.
That is an important difference.
A generic IT provider may focus on whether the ticket gets closed.
An RIA-focused partner should understand how that technology connects to client service, sensitive customer information, compliance and operational resilience.
That is the approach behind CyberSecureRIA’s services for advisory firms.
Put This 30-Minute RIA Meeting on the Calendar
Do not wait for a storm, cyberattack or outage to start this conversation.
Put 30 minutes on the calendar.
Bring in the people who would actually have to respond.
And ask these five questions:
- What do we restore first?
- Who makes the decisions?
- How do we communicate if normal tools are down?
- What is our biggest dependency?
- What would we wish we had prepared today?
If your team can answer all five clearly, you have a good foundation.
If some answers make everyone look around the table, that is not a failure.
That is exactly what the meeting was supposed to uncover.
Now you can fix the gap while it is still just a gap.
If you would like help reviewing your RIA’s business continuity, cybersecurity and disaster recovery readiness, schedule a 30-minute discovery call with CyberSecureRIA.
I will help you identify where assumptions may be hiding, what should be documented and which technology risks deserve attention before they become operational problems.
Call 865-622-9304 or visit here.
RIA Preparedness FAQ
What should an RIA discuss in a business continuity meeting?
An RIA should discuss system recovery priorities, decision-making roles, backup communication methods, critical vendor and technology dependencies, backup recovery and incident response responsibilities.
How long should an RIA preparedness meeting take?
A first preparedness conversation can take as little as 15 minutes. The purpose is to expose unclear assumptions and identify areas that need deeper planning or testing.
What systems should an RIA restore first after an outage?
Priorities depend on the firm, but client communications, access to critical client information, custodian access, email, phone systems and essential advisory technology are common recovery priorities.
Why should RIAs test backups?
A backup is only useful if the firm can successfully recover data from it. Testing helps confirm that critical information can actually be restored when needed.
What is an RIA incident response plan?
An incident response plan documents how the firm will identify, investigate, contain and respond to a cybersecurity incident, including responsibilities, escalation procedures and customer notification processes where applicable.
How does business continuity relate to RIA cybersecurity?
Cybersecurity incidents can interrupt normal operations. Business continuity planning helps the firm continue serving clients while incident response and technical recovery efforts are underway.
