The most regulated sector we serve, and the one attackers price highest. Sophos controls mapped to OSFI B-13, the GLBA Safeguards Rule and NYDFS Part 500, sized for firms in Canada and the United States. Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States. Three questions every financial services owner asks. Tap a card to jump to the detail. Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research. An attacker logs in as an advisor or admin and reaches client accounts without tripping an alarm. Rules and standards Branches and systems stop, client data is stolen, and regulators must be told. Exploited vulnerabilities started 40% of ransomware attacks on financial services firms. Source Rules and standards A convincing email, call or video of a client or executive gets money moved. NYDFS lists AI-enabled social engineering among the top AI cybersecurity risks for regulated firms. Source Rules and standards What fixes it A fintech partner, file-transfer tool or misconfigured cloud account exposes client data. Rules and standards Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records. What breach and ransomware research says about this sector. Every figure links to its source. The 2026 DBIR notes the finance sector "continues to be heavily targeted by financially motivated external attackers." Figures shown are the all-industry 2026 DBIR baselines. Sophos surveyed 369 financial services IT and security leaders in 17 countries whose organizations were hit by ransomware. Source: Sophos Financial services ranks eighth of the ten highest-risk industries in TrendAI's 2026 Cyber Risk Index (38.9, level with utilities). TrendAI's Cyber Risk Index combines individual asset and risk-factor scores into one figure for an organization's overall security risk. Bars start at 35 so the gaps are visible. Source: TrendAI 2026 Cyber Risk Report The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain. The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date. What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again. for a federally regulated Canadian financial institution to report a technology or cyber incident to OSFI for a NYDFS-regulated company to notify the Department after determining a cybersecurity incident has occurred for a business under the FTC Safeguards Rule to notify the FTC when 500 or more consumers are affected A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key. Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection Information is encrypted when it travels and when it is stored on laptops and phones, so a stolen device or intercepted message is unreadable. Covered by: Sophos Firewall VPN, Sophos Mobile, Axcient x360Sync Systems log sign-ins and changes, and the logs are kept long enough to investigate. Covered by: Sophos Next-Gen SIEM, Sophos XDR A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline. Covered by: Sophos MDR Plus responds 24/7 and documents the incident A risk assessment and regular scans, with the most dangerous gaps fixed first. Covered by: Sophos Managed Risk, TrendAI Vision One CREM Regular training so people recognize phishing, fake invoices and impersonation. Covered by: Sophos Email catches most lures; a staff training program covers the rest Suppliers with access to your systems or data are vetted, and their access is limited and removed when no longer needed. Covered by: Sophos Workspace Protection limits vendor access; ITDR finds stale accounts Copies of your data that an attacker cannot delete, and a restore you have actually tested. Covered by: N-able Cove, Axcient x360Recover and x360Cloud The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them. Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the financial services rule each row helps with. Decide who is responsible, which rules apply and what is allowed. List what you have and find the gaps before attackers do. Firewall, email and device protection, safe logins and remote access. Watch accounts, networks and logs for signs of an attack. Contain an attack fast, work out what happened, and tell the people who need to know. Backups you have tested, so you can restore instead of paying. The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records. All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence. Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request. Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation. Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud. The list follows Marsh's twelve key cyber controls. Source Where insurers dig deeper: Financial firms are asked hardest about wire-fraud controls (email security and call-back checks), MFA everywhere, and privileged account management. A credit union with a head office, four branches, about 90 staff and a hosted core banking platform would typically run: Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency. Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days. Available in Canada and the USA. Sophos Silver Partner. The main ones on this page are listed by country. In Canada: OSFI Guideline B-13, Technology and Cyber Risk Management, Bill C-8, Critical Cyber Systems Protection Act. In the United States: FTC Safeguards Rule (GLBA), 16 CFR Part 314. In the United States, New York: NYDFS 23 NYCRR Part 500. In Both: PCI DSS v4.0.1. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates. Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor. B-13 asks for governance, asset management, detection and response, and incident reporting. Sophos MDR Plus covers detection and response, Next-Gen SIEM covers logging and reporting, ITDR and Endpoint cover identity and device controls, and Managed Risk covers asset and vulnerability visibility. Nuformat provides the mapping with the quote. If the firm is a non-bank financial institution under GLBA, such as a lender, broker, advisor or auto dealer, yes. It requires a written program, MFA, encryption, monitoring and FTC notification of breaches affecting 500 or more people. Three controls together: Sophos Email Plus to block impersonation and look-alike domains, MFA on every mailbox so stolen passwords do not work, and a call-back rule for any change of payment instructions. Nuformat supplies the first two. Canada's Critical Cyber Systems Protection Act received Royal Assent on June 15, 2026. It applies to designated operators in finance, telecommunications, energy and transportation as regulations are phased in; smaller firms are more likely to feel it through their banking partners' vendor requirements. Yes. Nuformat is a Sophos Silver Partner with offices in Markham, Ontario and Dallas, Texas, quoting in CAD and USD. It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.Cybersecurity for credit unions, advisors, lenders and insurers.
The page in 30 seconds
See the top risks →
See what they ask for →
See the feature match →1. The problem: your top 4 risks, the rule behind each, and what fixes it
1Stolen credentials and privilege misuse
2Ransomware that freezes client service
3Wire fraud and AI-made impersonation
4Third parties and cloud mistakes
The risk in numbers
If ransomware hits a financial services firm
Ranked #8 of the 10 highest-risk industries
How an attack unfolds here, and where Sophos stops it
What you have to comply with
Where Rule or expectation What it asks for Canada OSFI Guideline B-13, Technology and Cyber Risk Management Federally regulated financial institutions must govern technology and cyber risk, maintain asset inventories, detect and respond to incidents, and report material incidents. Effective January 1, 2024. Source Canada Bill C-8, Critical Cyber Systems Protection Act Received Royal Assent June 15, 2026. Designated operators in finance, telecommunications, energy and transportation will need cyber security programs and incident reporting as regulations are phased in. Source United States FTC Safeguards Rule (GLBA), 16 CFR Part 314 Non-bank financial institutions (lenders, brokers, advisors, dealers) need a written security program, MFA, encryption, monitoring and, since May 2024, FTC notification of breaches affecting 500 or more people. Source United States, New York NYDFS 23 NYCRR Part 500 Licensed entities need MFA, asset inventories, monitoring, incident reporting within 72 hours and annual certification; amended requirements phased in through 2025. Source Both PCI DSS v4.0.1 Any firm that handles card payments; future-dated requirements became mandatory March 31, 2025. Source 2. The rules, in plain English
1Lock every login with a second step
2Scramble sensitive data
3Keep a record of who did what
4Have a plan, and report on time
5Find and fix weak spots on a schedule
6Teach staff to spot scams
7Check your vendors
8Back up, and prove you can restore
Feature match: what you need, and who covers it
How the pieces fit together
Set the rules
Know your weak spots
Keep attackers out
Spot what gets through
Stop it fast
Get back to work
What you need Sophos TrendAI Backup: N-able Cove or Axcient 1Password Helps meet
ProtectSophos Firewall (XGS) TrendAI Network Security (intrusion prevention, used alongside a firewall) – – PCI DSS Req. 1 and 11.5; OSFI B-13 Defend
ProtectSophos Endpoint
Sophos Endpoint for ServerTrendAI Endpoint Security – – PCI DSS Req. 5; NYDFS 500.14(b)(1) EDR (Class A)
ProtectSophos Email TrendAI Email and Collaboration Security – – PCI DSS 5.4.1 anti-phishing; NYDFS 500.14(a)(2) web and email filtering
Detect and RespondSophos MDR TrendAI MDR – – GLBA 314.4(h) incident response plan; NYDFS 500.16 and 500.17 72-hour notice
Protect and DetectSophos ITDR TrendAI Identity Security – 1Password Business GLBA 314.4(c)(1) and (c)(5) MFA; NYDFS 500.7 and 500.12; GLBA 314.4(c)(1) access controls
DetectSophos NDR TrendAI XDR for Networks (NDR) – – PCI DSS 11.5 intrusion detection; OSFI B-13 Detect
ProtectSophos Workspace Protection (ZTNA) TrendAI ZTSA Private Access – – NYDFS 500.12 MFA; PCI DSS 8.4
IdentifySophos Managed Risk TrendAI Cyber Risk Exposure Management – – GLBA 314.4(d)(2) scans every six months; NYDFS 500.5
Protect and DetectSophos Next-Gen SIEM TrendAI Agentic SIEM – – GLBA 314.4(c)(8); NYDFS 500.6 audit trail
Protect and Recover– – N-able Cove for Microsoft 365
Axcient x360Cloud– NYDFS 500.16 business continuity and backups; OSFI B-13 2.9 Disaster recovery
Protect and Recover– – N-able Cove for PCs, Macs and servers
Axcient x360Recover– NYDFS 500.16; OSFI B-13 2.9 Disaster recovery
Protect– – Axcient x360Sync – GLBA 314.4(c)(3) encryption; NYDFS 500.15
Govern and ProtectSophos AI Defense TrendAI ZTSA AI Service Access – – NYDFS AI cybersecurity guidance (2024); NIST AI RMF
ProtectSophos Mobile TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them. – – GLBA 314.4(c)(3) encryption; NYDFS 500.15 encryption Every Sophos product line, mapped to financial services (17 lines)
Sophos product line Use in financial services Helps meet Sophos Firewall (XGS)Protect Branch perimeter, IPS and encrypted site-to-site links. PCI DSS Req. 1 and 11.5; OSFI B-13 Defend; GLBA 314.4(c)(3) encryption in transit Sophos Virtual FirewallProtect Protects core banking, lending or portfolio systems hosted in the cloud. PCI DSS Req. 1; OSFI B-13 Defend Webserver Protection add-onProtect Protects online banking, client portals and payment pages. PCI DSS 6.4.2 automated protection for public web apps Sophos SwitchProtect Segments the cardholder data environment and back office from branch traffic. PCI DSS Req. 1 (segmentation) Sophos AP6 wirelessProtect Staff and guest Wi-Fi kept off the payment network; rogue AP detection. PCI DSS Req. 1 and 11.2 (wireless) Sophos EndpointProtect Advisor and teller devices protected against malware and ransomware. PCI DSS Req. 5; NYDFS 500.14(b)(1) EDR (Class A) Sophos Endpoint for ServerProtect Protects servers that hold client and account data. PCI DSS Req. 5; GLBA 314.4(c) Sophos XDRDetect Cross-product investigation and alerting for an in-house security team. NYDFS 500.14(b)(2) centralized logging and alerting (Class A); PCI DSS Req. 10 Sophos MDR and MDR PlusRespond 24/7 monitoring and response with incident reports regulators accept. GLBA 314.4(h) incident response plan; NYDFS 500.16 and 500.17 72-hour notice; OSFI B-13 Respond Sophos ITDRDetect, Respond Least privilege and MFA coverage across Entra ID and Active Directory. GLBA 314.4(c)(1) and (c)(5) MFA; NYDFS 500.7 and 500.12; PCI DSS Req. 7 and 8 Sophos NDRDetect Detects lateral movement toward core systems that agents cannot see. PCI DSS 11.5 intrusion detection; OSFI B-13 Detect Sophos EmailProtect Stops wire fraud and impersonation before money moves. PCI DSS 5.4.1 anti-phishing; NYDFS 500.14(a)(2) web and email filtering Sophos Next-Gen SIEMDetect Log retention, correlation and reports for examiners and auditors. GLBA 314.4(c)(8); NYDFS 500.6 audit trail; PCI DSS Req. 10 Sophos Managed RiskIdentify External attack surface and vulnerability scanning on a schedule. GLBA 314.4(d)(2) scans every six months; NYDFS 500.5; PCI DSS 11.3 Sophos Workspace Protection (ZTNA)Protect Per-application access for remote advisors with device health checks. NYDFS 500.12 MFA; PCI DSS 8.4 Sophos MobileProtect Encrypts and manages advisor phones that receive client data. GLBA 314.4(c)(3) encryption; NYDFS 500.15 encryption Sophos AI Defense Quote on requestGovern, Protect Controls client data shared with AI tools. NYDFS AI cybersecurity guidance (2024); NIST AI RMF Cyber insurance: what it pays for and what insurers check
Your own costs
Claims against you
The 12 controls insurers look for
A worked example: a credit union with four branches
Where What runs there Head office XGS 2300 HA pair with Xstream, Sophos Endpoint on servers and PCs, MDR Plus, Next-Gen SIEM Four branches XGS 118 with Xstream, AP6 access points, SD-WAN to head office Identities ITDR on Entra ID and Active Directory; 1Password Business for shared accounts Mailboxes Sophos Email Plus plus MFA Vendors and remote staff Sophos ZTNA, per application Records and Microsoft 365 Cove backup with a tested restore Get this sized and quoted for your organization
Frequently asked questions
Which cybersecurity rules and frameworks apply to financial services?
Which products cover the main cybersecurity needs for financial services?
Which Sophos products map to OSFI B-13?
Does the FTC Safeguards Rule apply to a small advisory firm?
How do we stop wire-fraud emails?
What is Bill C-8 and does it affect us?
Do you quote for both Canadian and US firms?
Will Sophos help us get or renew cyber insurance?
Industries · Financial services · Canada and USA
In plain terms: Financial firms are hit by the same ransomware and credential attacks as everyone else, with two differences: the regulator expects evidence of the controls, and a wire-fraud email costs real money the same afternoon. Detection, response and logs are not optional here.
1The problem
2The rules
3The fix
GLBA 314.4(c)(5) MFANYDFS 500.7 and 500.12PCI DSS Req. 8
GLBA 314.4(h) incident response planNYDFS 500.16 and 500.17OSFI B-13
PCI DSS 5.4.1 anti-phishingNYDFS 500.14(a)(2) email and web filteringNYDFS 500.14(a)(3) social engineering trainingNYDFS AI guidance (2024)
GLBA 314.4(b) risk assessmentNYDFS 500.9 risk assessment
48%
of breaches involved ransomware (all industries)
Verizon 2026 Data Breach Investigations Report
48%
of breaches involved a third party (all industries)
Verizon 2026 Data Breach Investigations Report
31%
of breaches began with an exploited vulnerability (all industries)
Verizon 2026 Data Breach Investigations Report
62%
of breaches involved the human element (all industries)
Verizon 2026 Data Breach Investigations Report
Most common way in40%Exploited vulnerabilitiesthe most common way in
What it costs$2.1Mmedian ransom paid
And then$1.74Maverage cost to recover, ransom not included
1Entry
What happensPhished credentials or an exposed remote portal
What stops itSophos Email Plus; ITDR flags MFA gaps; XGS firewall with IPS
2Foothold
What happensAn advisor's workstation
What stops itSophos Endpoint blocks exploits and credential theft tools
3Spread
What happensToward file servers, CRM and email
What stops itNDR and XDR see lateral movement; firewall segmentation
4Impact
What happensWire fraud, encryption, data theft
What stops itMDR Plus responds 24/7; Next-Gen SIEM keeps the evidence; Cove restores
24hours
72hours
30days
FTC SafeguardsNYDFSPCI DSS
FTC SafeguardsNYDFSPCI DSS
FTC SafeguardsNYDFSPCI DSS
OSFINYDFSFTC Safeguards
FTC SafeguardsNYDFSPCI DSS
FTC SafeguardsNYDFSPCI DSS
FTC SafeguardsNYDFSOSFI
NYDFSOSFI
Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.
Govern
Sophos AI Defense
Identify
Sophos Managed Risk
Protect
Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile
Detect
Sophos NDRSophos ITDRSophos Next-Gen SIEM
Respond
Sophos MDR
Recover
N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall.
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted.
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation.
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends.
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password.
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own.
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network.
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first.
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when.
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data.
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure.
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives.
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved.
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost.
Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.
1
MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection
2
Email filtering and web securitySophos Email; Sophos Firewall web filtering
3
Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud
4
Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials
5
Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR
6
Patch and vulnerability managementSophos Managed Risk; TrendAI CREM
7
Incident response planSophos MDR Plus includes incident response
8
Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume
9
Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP
10
Logging and monitoringSophos Next-Gen SIEM; MDR
11
Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched
12
Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts
Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source
Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.
Sources