Depending on your firm type, you may be subject to FINRA, SEC Regulation S-P, FTC Safeguards Rule, or state-level financial privacy laws. All of these require documented cybersecurity programs, access controls, incident response plans, and in some cases third-party vendor oversight.