Three Service Levels, Built Around How Regulated You Are

Every engagement is an ongoing program, not a one-off project — no surprise bills, no multi-year lock-in, and the same named point of contact every time. The right level for your firm depends on the rules you answer to and the protection you want — and that’s not something you guess from a page. It’s what the Compliance Readiness Review settles.

The three levels in detail

Our three levels aren’t sized by headcount, and they aren’t a menu. Each adds a layer of work on top of the one below. What your firm actually carries — which regulators you answer to, what data you hold, what you’re required to produce — determines which level you land in. That’s what the Compliance Readiness Review settles.

The documentation deepens as the levels climb — a safe-harbor claim at the first level, formal written programs and examination-ready evidence at the top. What every level shares is the discipline around it: we produce what your firm needs, help you produce what only you can, and keep all of it current as your firm and the rules change. That’s why this is a subscription and not a project — compliance documentation that isn’t maintained stops being evidence.

Safe Harbor Essential

Built to meet the SB 2610 safe-harbor standard, customized to fit your firm.

Identity and access — we manage your user accounts, multi-factor authentication, conditional access, and passwords: adding and removing users, resetting MFA, recovering locked accounts, and adjusting access when roles change. Access is reviewed against your current roster every month, with a quarterly MFA and account-hygiene audit.
Endpoint management and patching — your managed devices run under our monitoring, with operating-system and third-party patching kept current. We enroll and retire devices, resolve failed patches, and handle policy exceptions. You get a monthly patch-compliance report, with any exception logged and justified.
Managed detection and response — detection agents run on your managed devices. We triage alerts, contain threats, document incidents, and keep the agents healthy. You get a monthly alert summary, and every incident is documented whether or not it escalates.
Backup and recovery — your email and managed-workstation data is backed up. We resolve failed jobs, adjust retention, and restore files or mailboxes on request. Backups are verified monthly, with a quarterly test restore backed by written evidence.
Email and web protection — we manage your mail filtering, mail-authentication records, and web/DNS filtering: handling quarantine, resolving false positives, and updating records when your mail flow changes. Authentication posture is checked monthly, with a quarterly filtering review.
Security-awareness training — assigned training and simulated phishing for your whole staff. We enroll new people, reassign, chase completion, and produce records on request. Completion is pulled quarterly and filed as evidence.
Compliance documentation set — your SB 2610 control documentation, policies, and evidence package, kept current as your firm and the rules change. We run a quarterly currency pass and an annual control-set review that refreshes the evidence package and delivers a written annual summary.

Safe Harbor Plus

Everything in Essential, plus the documented compliance program the FTC Safeguards Rule and IRS WISP require — risk assessment, incident response, governance, and vendor oversight.

Written risk assessment — the documented risk assessment the FTC Safeguards Rule and the IRS WISP require, maintained as your firm changes — new systems, staff, and data flows. Formally refreshed each year with a written report.
Incident response plan — your written incident-response plan and supporting procedures, kept current and updated after any real incident. Exercised annually in a tabletop, with a written record of participants and findings.
Federal program documentation — your Written Information Security Program, your Qualified Individual designation, and the supporting policy set the FTC Safeguards Rule and IRS WISP require, kept aligned as the rules and your firm change. Reviewed annually, and produced on request for a regulator, insurer, or client questionnaire.
Independent penetration testing — we coordinate the test and act on the findings; the testing vendor’s cost passes through, our labor is included. We scope it, manage the vendor, and remediate findings within your covered services. You get the test report plus a written record of findings closed.
Governance reporting — an annual report documenting your program to leadership, regulators, or your insurer. Delivered each year.
Vendor risk management and third-party oversight — a vendor inventory, risk classification, and oversight records. We assess new vendors, maintain the register, and handle vendor security questionnaires, with an annual vendor review cycle.

Safe Harbor Advanced

Everything in Plus, plus examination-ready programs for firms that answer to an examiner — federal or state.

SEC Regulation S-P incident response and notification — the written incident-response program and customer-notification procedures Regulation S-P requires, including the 30-day notification obligation. We keep it current and execute the notification workflow if an incident triggers it. Reviewed annually, with incident records retained.
TSSB program for state-registered advisers — (applies only to state-registered advisers) records kept in the required form, a written supervisory system, and a nonpublic-information system, maintained and produced on the Texas State Securities Board’s timetable. Reviewed annually against current TSSB requirements.
TRAIGA AI governance — an acceptable-use policy and documentation of how your firm controls AI use under the Texas Responsible AI Governance Act, updated as your tools and usage change. The policy is reviewed annually and the usage documentation kept current.
Examination evidence package — the assembled, examiner-ready body of evidence across all your covered services, kept current rather than reconstructed on demand. Completeness is reviewed annually and produced on request.

How the engagement works

You don’t pick a level off this page. Here’s how it actually works — the review comes first, and what applies to your firm sets the rest.

You share your data first — before anything, we gather what’s needed to see where your firm actually stands. It’s the prerequisite to a useful review, and we don’t put one on the calendar without it.
Compliance Readiness Review — we look at your firm against the rules that actually apply to you, and establish what you’re truly obligated to do.
We present what we found — you get the full picture — your obligations, where the gaps are, and what it takes to close them. It’s yours to keep, whether or not we go further.
You choose your level — your obligations point to a tier. You decide how far you want to take it.
Products get sorted — some tools you already have or buy directly; others we provide on your behalf. That’s settled per firm, based on what you actually need.
We implement — setting up and deploying your program — scoped and handled as its own phase, so the recurring work rests on a real foundation.
The recurring program begins — monthly support and documentation of your covered services, keeping your compliance current as your firm and the rules change.

Common questions

Why won’t you just quote a price up front?

Because an honest number doesn’t exist until we’ve looked. Your price depends on what the rules actually require of your firm, which products you need us to provide, and how many people and devices you’re covering — and none of that is knowable from a page. Quoting blind would mean padding to protect ourselves or lowballing and revising later. The Review settles it, and then the number is real.

We already have an IT provider — how is this different?

Most firms do, and a good one is worth keeping. But keeping your systems running and building a defensible compliance program are different jobs. This isn’t help-desk work — it’s the written programs, the evidence, and the documentation that stand up when a regulator, an insurer, or a client asks. We do that specific work; your IT can keep doing theirs.

Is the Review really complimentary?

Yes. The Compliance Readiness Review itself is free, and what we find is yours to keep whether or not we work together. The one condition is that we can’t schedule it until we have the information it depends on — without that, an effective review isn’t possible. If you’d rather we gather that groundwork for you, that’s a separate, optional, billable service — but the Review on the other side is still free.

Are we too small — or too large — for this?

The work is built around firms of roughly 10 to 50 people — small enough that you get us directly, large enough to carry real regulatory weight. Smaller or larger doesn’t mean no; it means the engagement looks different, and the Review is where we figure out the right shape for your firm.

Start with the Review

You don’t pick a level from this page — you start with the Review. It’s a working session where we look at where your firm actually stands against the rules that apply to it. Afterward, once we’ve worked through what we found, you get a written report in plain English: what’s in place, what’s missing, and the level that fits your firm. No pressure, no obligation. The report is yours to keep, whether or not you ever hire Briggs IT.