Financial services IT support in Brisbane

Financial advice and broking practices hold payslips, bank statements, identity documents, tax file numbers and detailed pictures of clients' wealth. Criminals can use that information to commit identity fraud, and they can use a hijacked email account to redirect money. The most common route is not a sophisticated hack. It is a stolen email password, a fake email that appears to come from a client asking for funds to be moved, or client documents sitting on a personal drive or unencrypted laptop.

A second problem is evidence. Clients, licensees and auditors increasingly ask how client data is protected. "We think it is fine" is a weak answer. Being able to show where files live, who can open them and how they are backed up is a strong one.

The Privacy Act 1988 and the Notifiable Data Breaches scheme may apply, depending on the practice. If personal information is accessed or disclosed in a way likely to cause serious harm, the practice may need to notify the OAIC and the people affected. Whether it applies to your practice, and whether an incident is notifiable, is for you and your advisers to decide.

If you hold an Australian financial services licence or are authorised under one, ASIC has set out expectations about cyber resilience for licensees, including publishing good practice guidance. Licensees generally need adequate risk management and systems, and cyber risk is part of that. Check with your licensee or compliance adviser about what is expected of your practice.

APRA's prudential standard CPS 234 on information security applies to APRA-regulated entities, such as banks, insurers and many superannuation trustees, and in some cases to the third parties that service them. Most small advice practices and broking businesses are not APRA-regulated, so CPS 234 will not apply directly. If your practice services an APRA-regulated entity, the contract with that entity may pass related requirements down to you, and you should read it carefully.

Technology supports compliance, it does not determine it, and no IT provider can guarantee compliance. This page is not legal or compliance advice.

Advice practices commonly use platforms such as Xplan (from Iress), Midwinter and Class, along with investment and superannuation platforms such as Netwealth, plus Microsoft 365 for email and files. Mortgage brokers commonly use aggregator and CRM systems supplied through their aggregator. We look after the devices, network, access, backups and security around your systems and work with the software vendor on application issues. The agreement states which products are covered and who owns each part.

The Essential Eight, from the Australian Signals Directorate, is a baseline of mitigation strategies. In a financial practice, the first priorities are usually:

• Multi-factor authentication on email, advice and CRM platforms and remote access.
• Patching, so known weaknesses in operating systems and applications are closed.
• Regular, tested backups that ransomware cannot alter, so client files can be restored without paying.
• Restricting administrator access, so a single compromised account cannot reach every client.
• Application control and macro settings, which help block malicious attachments.

It is a framework to work towards in stages, not a certificate.

Every client document has a clear home, controlled access and a retention rule. Nothing lives on a personal drive or an unencrypted laptop. Access is set per team or per adviser, not one login that opens everything. Email filtering, multi-factor authentication and a verification step for payment instructions reduce the chance of fraudulent transfers. You can show a licensee, auditor or client what controls are in place and how they are checked. Our blog posts on payment redirection scams and Microsoft 365 security cover the practical details.