They should expect secure technology management that supports investment teams, portfolio operations and external collaboration without weakening control over sensitive data. This includes Microsoft 365, identity and access management, endpoint security, backups, monitoring and user lifecycle processes. The provider should also maintain clear evidence of how key controls operate, helping leadership respond more confidently to investor due diligence, cyber insurance reviews and internal governance requirements.

It should address risks such as account compromise, payment fraud, phishing, unauthorised access, data leakage and attacks on employees or third parties involved in transactions and portfolio management. Strong controls include multi-factor authentication, conditional access, endpoint protection, secure email, privileged access management and tested recovery procedures. Regular review is important because investment activity, new assets, external advisers and changing supplier relationships can continually alter the firm’s risk exposure.

Effective support helps maintain control when new entities, users, systems and external partners are introduced during acquisitions, disposals or portfolio restructuring. Access can be provisioned and removed through defined processes, devices can be secured, data sharing can be governed and technology dependencies can be reviewed before they create operational problems. This reduces the risk of legacy access, inconsistent security settings and undocumented changes remaining after a transaction is completed.

They can make due diligence easier by maintaining current evidence of access controls, endpoint security, backup testing, incident readiness, security policies and remediation activity throughout the year. Root.12 adds a structured assessment of the wider control environment, showing where evidence is strong and where gaps remain. This enables firms to respond to security questionnaires with documented information rather than collecting screenshots, reports and approvals after a request has already arrived.

It should provide clear ownership, documented controls and evidence showing how technology risks are monitored and managed over time. Root.12 assesses the environment across 12 defined areas, identifies weaknesses and turns findings into prioritised remediation actions. This helps management prepare for audits, regulatory scrutiny, insurer reviews and investor assurance requests without suggesting that an IT provider replaces the firm’s own FCA responsibilities.