There’s something we get asked a heck of a lot here at Compex IT, and that’s: “If you could only do one thing to protect our financial firm’s data, what would it be?”
It’s a pretty tricky question to answer, because (like ogres and onions – yep that’s a Shrek reference!), cybersecurity has layers. There’s no silver bullet, but if you really had to make us pick just one move that’s simple, free, and surprisingly overlooked in financial services, it would be this:
Turn on full disk encryption on every device that holds client data.
Not flashy, not expensive, but powerful. So, why would this be our number one suggestion? Let’s talk about it!
Why is encryption important?
Okay, so imagine for a moment that you’re heading home from a client meeting. Somewhere between checking emails and catching up on market news, you leave your laptop on the train. It happens, we’re human.
Now let’s say that laptop has confidential client spreadsheets, access to your CRM, maybe even reports with personal and financial data. You’re not pulling your hair out with worry — after all, it’s password-protected, right?
But here’s the problem with that; if your hard drive isn’t encrypted, that password won’t protect you. A thief doesn’t need your password to get the data. They can simply remove the hard drive, plug it into another device, and browse through everything with no login screen required. Just like that.
Full disk encryption makes that data unreadable without the correct credentials. Even if someone pulls the drive out and tries to access it elsewhere, they’ll get nothing but scrambled noise.
Why this matters even more for financial advisors
If you’re in financial advice or planning, you hold some of the most sensitive data out there like:
- Personal identifying info (names, addresses, DOBs)
- Investment and pension details
- Tax information
- Access to financial platforms
Clients trust you to keep that private, and regulators expect it too. Under GDPR, a lost or stolen unencrypted device can be classed as a reportable data breach. That means informing clients and the ICO and potentially facing fines or reputational damage.
If you’re a financial firm, you’ll be under FCA oversight which means the bar is even higher. Firms are expected to show they’ve taken reasonable steps to protect data. Encryption isn’t just reasonable, it’s absolutely essential.
“But I’ve got a password — isn’t that enough?”
Nope. This is the big misconception. Login passwords protect the device from casual access. They don’t protect the data on the hard drive.
Encryption is different. It scrambles the entire drive so that, without the encryption key, no one can read a single file. So, if the device ends up lost, stolen, or left behind in a taxi, encryption is your last line of defence. Without it, your client data is just sitting there, ready to be taken.
“Isn’t encryption complicated or expensive?”
Not at all. In fact, most modern operating systems come with full disk encryption built-in:
- Windows has BitLocker
- macOS has FileVault
Turning it on usually takes a few clicks and maybe a system restart. You don’t need extra software, expensive licenses, or deep technical know-how. For most small firms, it’s just a matter of awareness and putting it on your setup checklist.
What you should do next
Here’s how to turn this from a nice idea into action:
Audit all devices
Are all laptops, desktops, and mobile devices used for client work encrypted?
Make it policy
Add encryption checks to your device onboarding process. Any new machine coming into the business must have encryption enabled before it’s used.
Cover remote workers
If your team works from home or travels, their devices are at higher risk. Make sure encryption is turned on there too.
Pair it with MDM
If you’re using Mobile Device Management tools, you can remotely wipe a lost device, but only if the data is encrypted is that really effective.
Final thoughts
Hopefully we’ve now shown you just how important encryption is and you’re already running to make sure all of your devices are encrypted! Don’t forget that whilst encryption is great, it shouldn’t be your only line of defence. It’s one important part of a layered security approach, which should also include things like strong passwords, multi-factor authentication, secure backups, regular software updates, and staff awareness training.
That said, encryption is one of the easiest and most impactful things you can do — especially when sensitive financial data is involved. If you haven’t already made it a standard across your firm, now’s the time.
And if you’re not sure where to start or want a second pair of eyes on your setup, we’re here to help. Book a free, no obligation chat with Mark to talk about how we could work together!