One engagement in three phases
We establish which requirements apply to your firm, close the gaps in order of importance, and then run the program so that it stays current. Each phase builds on the records of the one before it.
Applicability and risk assessment
Before anyone writes a policy or buys software, you need to know what actually applies to your firm. We determine that from how the firm operates, covering the federal rules that reach your firm, such as the Safeguards Rule (16 CFR 314) or, for banks and credit unions, the interagency information-security guidelines your prudential regulator examines against, the data-security laws of the states where you do business, and the terms your regulators, investors and clients impose.
- A structured conversation about your firm that takes hours of your team's time rather than weeks
- Each requirement that applies to you, with its source named
- The places where current practice falls short, ranked by exposure
- A fixed fee and a two-week timetable, agreed before we start
When a deadline is close, we can shorten the timetable.
Assessment report
The requirements we identify for your firm in a single document, each with its source and each gap explained in plain terms.
Risk register
Each open gap written as a risk with a recommended remedy. Your team adds the rating and the owner.
Executive summary
Where the firm stands and what to address first, written for partners, directors and owners.
Remediation and policies
Because the assessment has already shown what needs to be done, remediation is priced from findings rather than estimates. We write the policies examiners read first, put the supporting controls in place, and bring your vendors under proper oversight.
- Policies written around your firm's operations and approved by your leadership
- Controls put in place with your IT provider, most urgent first
- A vendor program with a register, risk tiers and a review schedule
- Each fix linked to the finding it resolves, which is where your evidence file begins
Policy set
Information security, incident response, vendor management and access control, written for how your firm works.
Evidence file
Dated, versioned records for each closed gap. This is the file you open when an examiner asks to see the work.
Vendor program
A tiered register of your vendors with a review calendar and documented oversight, as §314.4(f) of the Safeguards Rule requires.
The ongoing program
A program that nobody runs falls out of date within a year. For a monthly retainer, we act as your security and compliance function. We keep the calendar, maintain the evidence, report to leadership and manage renewals, and a principal is responsible for all of it.
- A calendar of certifications, reviews, tests and vendor reassessments
- Rule changes tracked against your obligations and reflected in the program
- Monthly reports, and the annual board report the Safeguards Rule calls for where it applies (§314.4(i))
- Support with questionnaires and examinations when they arrive
Monthly report
What was completed, what is due, and which rule changes affect you.
Board report
Program status, incidents and risk, in the form directors and partners read.
Evidence file
Kept current through the year, so certifications, examinations and client reviews draw on records that already exist.
SOC 2 and NIST CSF 2.0 from the same work
When a client asks for SOC 2 or a NIST CSF position, there is no need to start again. We express the work already done in NIST CSF 2.0 terms and review it against the SOC 2 Trust Services Criteria your clients ask about.
SOC 2 readiness assessment
Learn how far you are from an audit before you pay for one. You receive a criterion-by-criterion view, an evidence index and a plan, scoped to the criteria your clients request.
NIST CSF 2.0 position
Your program described in the six CSF functions that boards and risk teams recognize. We report what is in place, what is open and what is pending, and we do not reduce it to a single score.
How Crucible compares with the alternatives
Each option has a role. What differs is who takes responsibility for the program.
| Capability | IT provider | Compliance software | Full-time CISO | Crucible |
|---|---|---|---|---|
| Determines which rules apply to you | No | Framework menus only | Yes | Yes, with sources cited |
| Writes policy for your operations | No | Generic templates | Yes | Yes, specific to your firm |
| Runs the program day to day | Infrastructure only | Your staff run it | Yes | Yes, led by a principal |
| Attends examinations and client reviews | No | No | Yes | Yes |
| Specialist knowledge of regulated financial services | Rarely | Technology-sector focus | Hard to find | The whole of our practice |
| Cost | Already in your budget | Subscription plus staff time | $250,000 or more a year | A fraction of a full-time hire |
We work with your IT provider and use software where it helps. The question is who is accountable for the outcome.
Begin with the assessment
A fixed fee, a two-week timetable, and findings that cite their sources, whatever you decide afterward.