Based in Denver, serving the Denver metro area
Financial advisory firms
Security-first IT for Denver financial advisory firms
Tecnico Desk helps financial advisory firms with 10 to 75 people protect client information, tighten Microsoft 365 or Google Workspace, and organize the evidence behind their security program. Tito Marcos founded Tecnico Desk after working in IT across industries that include financial services.
Regulation S-P raised the bar
SEC-registered investment advisers with less than $1.5 billion in assets under management had until June 3, 2026 to comply with the amended Regulation S-P. Larger advisers had until December 3, 2025. The SEC's Division of Examinations also named Regulation S-P a 2026 examination priority.
The amendments include:
- A written incident response program
- Notice to affected customers within 30 days in covered incidents
- Oversight of service providers that hold customer information
- Written records showing compliance
Rules vary by firm type and registration. State-registered advisers and other financial firms may fall under different requirements, so confirm what applies with your compliance counsel.
Sources: Baker Donelson, JD Supra, and Foley & Lardner.
Where we help
The technical work behind each obligation, and the records you can keep on file.
| Your obligation or risk | Technical support we can provide | What you can keep on file |
|---|---|---|
| Incident response | Response workflow, contact list, and a tabletop walkthrough | Dated plan and exercise notes |
| Service provider oversight | Vendor and access inventory, plus security questionnaire support | Vendor list and review notes |
| Customer information access | MFA, admin role, offboarding, and file-sharing reviews | Access review records and screenshots |
| Email and payment fraud | SPF, DKIM, and DMARC work, plus payment verification steps | DNS records, DMARC reports, and written process |
| Backups and devices | Backup checks and device protection review | Restore test notes and coverage reports |
Why email deserves attention first
In Coalition's 2026 Cyber Claims Report, business email compromise and funds transfer fraud made up 58% of the cyber incidents it observed in 2025. Coalition also found that 52% of funds transfer fraud claims began with business email compromise. That data covers its policyholders across several countries and business sizes, so treat it as a useful signal rather than a measure of your firm's risk.
A good first step is checking how your email domain is protected against spoofing. Run a free domain scan, or see our DMARC and email security services.
Sources: Coalition and Reinsurance News.
What an engagement looks like
No case studies or client names here. This is the process every advisory firm goes through and the documents it produces, so you can judge the work before you commit.
How an engagement starts
The same six steps, in the same order, for every client. See the first 30 days for the day-by-day version.
-
1
Security Fit Call
A short call to understand your advisory firm, your current IT setup, and what brought you here. Free, no pressure.
-
2
Proposal and scope
A written scope and price before any work starts. Larger or higher-risk environments are scoped after a Tecnico Ready review.
-
3
Environment access and discovery
Least-privilege administrative access, documented as we go, and an inventory of users, devices, sharing, and email settings.
-
4
Security review delivery
The Tecnico Ready findings, explained in plain English, with the fixes ranked by risk.
-
5
Remediation and hardening
The highest-priority gaps are fixed as a scoped project, not folded into a monthly fee.
-
6
Steady state and first report
Ongoing monitoring and support begin, with a monthly executive summary you can read without an interpreter.
What the security review delivers
Every Tecnico Ready review produces the same four documents. They are yours to keep whether or not you continue with us.
-
Risk summary
Where your advisory firm is exposed today, in plain English.
-
Priority findings
The highest-impact issues ranked by risk so you know what to address first.
-
30-day action plan
A practical plan focused on the changes that reduce the most risk in the first month.
-
Security improvement roadmap
A longer-term view of what to improve over time as your security posture matures.
Founder-led
Tito Marcos founded Tecnico Desk after nearly 20 years in IT across financial services, construction, government, and professional services. You work with the people who built the service, not a ticket queue.
Confidentiality controls
We sign confidentiality agreements, follow least-privilege access so our staff only touch what a task requires, and log administrative work. Access is documented from day one.
Honest scope
We implement and evidence technical controls and work alongside your compliance consultant or counsel. We do not give legal advice, and we do not certify compliance.
Tecnico Desk LLC, 1905 Sherman St #200, Denver, CO 80203. (983) 223-1422. On-site across the Denver metro, remote support nationwide.
What we do not do
Tecnico Desk is not your compliance consultant, law firm, auditor, or insurance broker. We do not certify compliance or guarantee an exam outcome. Your firm and its counsel decide how the rules apply. Forensic and legal breach work is handled by specialist firms.
Frequently asked questions
Do you replace our compliance consultant?
No. We handle the technical side and can work with your compliance consultant or counsel.
Do we have to replace our current IT provider?
No. We can handle security alongside your current provider or take on both security and day-to-day IT.
Does this make us compliant with Regulation S-P?
No technology provider can make that determination for you. We help put technical controls and supporting records in place so your firm and its advisers can assess them.
What does it cost to get started?
The Security Fit Call is free. A Tecnico Ready review starts at $2,500 as a one-time fee. Final pricing depends on users, devices, platforms, and scope.
Colorado firms should also know the deadline in Colorado breach notification requirements if client data is ever exposed.
Keep reading
Guide
Microsoft 365 security checklist
The identity, email, and sharing settings that matter most in Microsoft 365.
Guide
Onboarding and offboarding securely
Close the account, mailbox, and shared-file gaps people leave behind.
Guide
Cyber insurance renewal requirements
The controls underwriters are asking about this cycle, and the evidence they want.
Protect client information, and keep the records to show it.
Book a Security Fit Call, a short, plain-English conversation about your firm’s environment and whether we are a fit. No pressure to switch providers.
Booking opens our Microsoft Bookings calendar in a new tab. No pressure, no obligation.