Financial services businesses face security requirements from multiple directions: the FMA, cyber insurance underwriters, institutional clients who conduct their own security assessments, and the NZ Privacy Act. Nexus Financial worked with Optimyze to build a demonstrable security posture that answers all of them.
Financial services businesses occupy a unique position in the cyber security landscape. They hold client financial information that has high criminal value. They handle transactions that, if manipulated, can result in direct financial losses. They're subject to regulatory oversight that includes expectations about information security. And they serve institutional clients who increasingly conduct their own IT security assessments of the firms they work with.
For Nexus Financial, this combination of drivers created a clear need: not just adequate security, but demonstrable security — the ability to show clients, regulators, and insurers that specific controls are in place and actively managed.
The Regulatory Layer: FMA Expectations
The Financial Markets Authority expects licensed financial services firms to have appropriate information security frameworks commensurate with their risk profile. While the FMA doesn't prescribe specific technical controls, its guidance makes clear that appropriate controls include: data classification and protection policies, access controls and least-privilege, incident response planning and testing, and third-party risk management. Firms that experience a significant cyber incident without these controls in place face both the incident consequences and the regulatory scrutiny that follows.
The Client Assessment Layer
Institutional clients of financial services firms increasingly conduct IT security due diligence as part of their vendor management processes. A security questionnaire asking about MFA deployment, EDR coverage, backup testing, and incident response planning was once something only large clients asked of large firms. By 2025, mid-sized clients routinely ask these questions of the advisers and managers they work with — and the inability to answer them has become a commercial risk.
What Optimyze Built for Nexus Financial
The engagement started with a full IT and security assessment — identifying the current state, the gaps relative to FMA expectations and client questionnaire requirements, and a prioritised remediation plan. The implementation delivered: Microsoft 365 with Conditional Access and MFA across all staff, SentinelOne EDR on all endpoints, immutable cloud backup with documented RTO, privileged access management with separate admin accounts, a documented security policy suite (acceptable use, data classification, incident response), and monthly security reporting that can be shared with clients or regulators as evidence of ongoing management.
The security documentation produced through this engagement also satisfied the information requested in Nexus Financial's subsequent institutional client security questionnaires — providing demonstrable evidence of controls rather than self-assessment claims.
For a financial services firm, security is simultaneously a regulatory obligation, a client relationship asset, and an insurance prerequisite. Building a demonstrable security posture addresses all three at once — and the documentation of that posture is as valuable as the controls themselves.
