🚀 Rocket IT Solutions

IT Compliance Checklist

Industry-Standard Compliance for Finance & Legal Sectors

Prepared for: Rocket IT Solutions | Date: March 2026

SOC 2 Readiness Assessment

Access control policies documented and enforced
Multi-factor authentication enabled for administrative accounts
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Background checks completed for employees with data access
Vendor risk management program in place
Security awareness training conducted quarterly
Incident response plan tested annually
Data backup and disaster recovery procedures documented
System availability monitoring with 99.9% uptime target
Annual penetration testing completed
Vulnerability scanning conducted monthly
Change management process with approval workflow

GLBA Compliance (Financial Services)

Written information security program (WISP) established
Risk assessment completed and updated annually
Customer data encrypted at rest and in transit
Access controls based on least privilege principle
Privacy notices provided to customers annually
Third-party service provider agreements include security requirements
Employee training on GLBA requirements completed
Incident response plan includes breach notification procedures
System activity logs retained for minimum 7 years
Physical security controls for data centers/server rooms
Secure disposal procedures for customer data
Business continuity plan tested annually

FINRA Cybersecurity Guidelines

Senior management oversight of cybersecurity program
Technical controls: firewalls, intrusion detection, antivirus
Cybersecurity governance structure defined
Vendor due diligence process for critical service providers
Branch office cybersecurity inspections conducted
Penetration testing and vulnerability assessments performed
Cybersecurity metrics reported to board quarterly
FINRA Rule 4511 recordkeeping requirements met
Email retention and supervision systems in place
Mobile device management (MDM) for BYOD policy
Incident response plan aligned with FINRA expectations
Cyber insurance policy with $1M+ coverage

Legal Industry Security Standards

ABA Model Rule 1.6(c) - competence to safeguard client data
Client confidentiality agreements and NDAs in place
Encryption for email communications containing privileged information
Secure client portal for document sharing
Conflict checks system with access controls
Document retention policy aligned with legal requirements
E-discovery readiness with litigation hold procedures
Attorney-client privilege protected in cloud storage
Metadata scrubbing tools for document production
Secure file transfer protocols (SFTP, HTTPS)
Remote access via VPN with MFA
Ethics training on technology and data security

Quarterly Compliance Review Template

Review Period: Q__ 20__

Conducted by: ___________________________

Date: ___________________________

All user access reviews completed and documented
Security patches applied within 30 days of release
Antivirus definitions updated and scans running
Backup integrity tests passed (restore verification)
No unresolved high-severity vulnerabilities
Security awareness training completion rate: ____%
Incidents reported and resolved: ___
Policy violations identified: ___
Audit findings remediated: ___
Vendor security reviews completed: ___

Action Items:

_____________________________________________________________

_____________________________________________________________

_____________________________________________________________

Documentation Requirements

Maintain the following documents for auditor review:

Information security policies and procedures
Risk assessment reports (annual)
Employee training records and acknowledgments
Incident response logs and post-mortem reports
Penetration test and vulnerability scan reports
Vendor security assessments (SOC 2 reports, questionnaires)
System access logs (retain 1-7 years per regulation)
Business continuity and disaster recovery test results
Change management approval records
Insurance certificates (cyber liability, E&O)