A real Written Information
Security Plan, built for your firm.
Every state-registered RIA counts as a "financial institution" under the FTC Safeguards Rule. That means a real, written security plan is legally required. Not the PDF you found once searching "WISP template" and never opened again.
Every RIA owner we've looked into
runs the same way.
One person handling the client calls, the investing, the compliance filing, and the security paperwork gets whatever time is left at the end of a long week. Most don't know the FTC Safeguards Rule applies to them at all, state-registered advisers are covered even though SEC-registered ones answer to a different rule. The ones who do know usually have one of two things: nothing written down, or a template pulled off the internet once and never matched to how the firm actually handles client data.
Most firms this size have never seen the rule text itself, only vendor marketing about it. We build to the actual requirement, not a summary of it.
A direct way to know
if this is you.
KOVACS is a fit if
- You're a solo or small state-registered RIA in Ohio, not SEC-registered.
- You're the one actually handling client data day to day.
- You have nothing written down, or a downloaded template you never matched to your practice.
KOVACS is not a fit if
- You're SEC-registered. A different rule applies to you (Reg S-P), and you'd want a firm that focuses on that instead.
- You run more than roughly 25 distinct vendor tools. At that scale, an outsourced CCO or a full compliance platform is likely a better fit than a vendor-by-vendor service like ours.
- You already have an active, properly maintained WISP and only want a one-time second opinion. We're built for ongoing work, not a single audit.
A plan built around
how you actually run.
One document. Matched to your firm.
Not a filled-in template.
Structured around what the FTC Safeguards Rule actually requires. Written in your firm's language, not ours.
- Program LeadNames who at your firm is responsible for the plan
- SafeguardsAccess controls, encryption, authentication, in plain terms
- VendorsEach tool that touches client data, reviewed and documented
- TrainingWhat your staff are shown, and when
Priced by what the work
actually requires.
Outsourced compliance officers for a firm this size typically run $8,000-25,000 to start, then $8,000-15,000 or more a year. We publish our price because we think you should be able to see it before a call, not after one.
- A written security plan built for your firm
- Annual review and update
- Vendor review for each tool that touches client data
- Incident response support, scoped and explained upfront
- No lock-in, cancel any time
- Everything in Starter
- A client-facing summary you can share with your own clients
- No lock-in, cancel any time
- Everything in Growth
- Quarterly review instead of annual
- $65 per additional vendor tool past 25
What else is
actually out there.
| Free template | Outsourced CCO firms | Adelia Risk | KOVACS | |
|---|---|---|---|---|
| What it is | A document you fill in yourself | Someone runs your entire compliance job | A broader cybersecurity retainer, serves several industries | A WISP built and maintained for your firm specifically |
| Price | $0 | Roughly $8,000-25,000 to start, $8,000-15,000+/yr | "A few hundred a month" and up, not published | $700-2,200/mo, published on this page |
| Built for state-registered RIAs specifically | No | Not usually | Not exclusively, serves other industries too | Yes |
| Names the FTC Safeguards Rule directly | Sometimes | Rarely | Not as a primary focus | Yes |
| Lock-in contract | No | Often, annual terms | Not stated publicly | No |
Adelia Risk and firms like them are real, established options, and for a firm that wants a broad, ongoing cybersecurity partner across several areas, they may be the better fit. KOVACS is narrower by design: one document, built and kept current for a state-registered RIA specifically, at a price shown upfront.
Questions worth
asking upfront.
Know what you're
actually required to have.
Book a 30-minute call. We'll walk through what the FTC Safeguards Rule and Ohio's own rule actually require for a firm your size, no obligation.