# Financial Services IT for Banks, Credit Unions and Insurers

> Networks, communications, security and support for banks, credit unions, insurers and advisors. Trybus Solutions delivers financial services IT nationwide.

*Source: https://trybussolutions.com/financial-services/ · Trybus Solutions · Chattanooga, TN · 423-633-1817 · info@trybussolutions.com*

## Technology in a Regulated Financial Environment

Trybus Solutions works with banks, credit unions, insurers, and wealth and advisory firms on the technology underneath regulated financial work. That covers wired and wireless networks across branch and office estates, communications and contact center, security and segmentation, cloud and on-premises infrastructure, the devices staff and advisors use, and support.

These projects almost always begin with an obligation rather than an ambition. A platform is coming up on end of support. A merger has arrived with its own network, directory and phone system. An examination or a client questionnaire has produced findings with dates attached. Branches are being consolidated or refitted, or a recording arrangement no longer matches the retention answer somebody gave in writing.

Most of our clients here have their own IT team, and usually a compliance or risk function with opinions about the design. We are there for the parts that need people who have worked inside a regulated estate before. This page is about the environment; the service pages below describe the work.

## What Is Different About Financial Services

### Recorded Conversations Have a Second Life

Capturing the call is the straightforward part. Where the recording lands, who may play it back, how long it is held, whether it can be produced on request, and what evidence exists that somebody reviewed it are all design questions. FINRA Rule 4511 sets a six year floor for member records with no other stated period, and requires the format to satisfy SEC Rule 17a-4.

### Supervision Leaves Its Own Record

Communications review is a separate obligation from retention. FINRA Rule 3110 requires member firms to review incoming and outgoing correspondence and internal communications, and the evidence of review has to identify the reviewer, what was reviewed, when, and what followed. A system that captures messages but produces no reviewable queue moves that work onto somebody manually.

### Branches With Nobody Technical On Site

A branch network is a long list of small sites, and at most of them the person who power cycles the switch is whoever is nearest to it. Equipment has to arrive configured, come up without help and be recoverable from somewhere else, because sending an engineer to a rural branch costs more than the hardware.

### Resilience That Has to Be Demonstrated

Second links and a second site are the visible half. The examined half is the written plan behind them. FINRA Rule 4370 requires a written business continuity plan covering data backup and recovery, mission critical systems, alternate communications with customers and with employees, and alternate work locations, approved by senior management and reviewed at least annually.

### Vendor Questionnaires Land on the IT Team

Clients, insurers and examiners all send assessments, and the answers about encryption, access, logging and subcontractors come from infrastructure rather than from legal. The GLBA Safeguards Rule requires firms in its scope to select service providers capable of appropriate safeguards, contract for them and reassess them periodically. That obligation runs in both directions.

### Payment and Cardholder Systems Sit Apart

Card processing, ATM and interactive teller networks, and anything else touching cardholder data carry their own scope boundary. Segmentation is not itself a PCI DSS requirement, and the standards council says so plainly, but limiting where cardholder data lives reduces the number of systems that have to be assessed. Drawing that boundary is a network design job first.

## Technology We Work With

We hold partner relationships across the technology industry, and our engineers also work in platforms we do not sell. A project in a regulated firm starts on whatever is in the branches and the data center now, whoever supplied it, and on the controls already agreed with an examiner.

We do not publish comparisons between manufacturers. Which platform suits an organization is something an assessment works out, not something a website should decide.

[See all technology partners →](https://trybussolutions.com/partners/)

## What Constrains a Financial Services IT Team

The list is rarely the constraint here. The calendar is. A change board meets on fixed dates, and most of the year has an examination, an internal audit or a client assessment somewhere in it. A plan that does not say which window it is aiming for tends to sit.

- **Change control runs to a committee calendar:** Anything touching a system that moves money goes through a change board meeting on fixed dates. A technically small change can take longer to approve than to perform, and a plan assuming a window will be granted when it is asked for is the plan that slips.
- **Examinations produce work with dates attached:** Findings from an examination, an internal audit or a client assessment arrive with remediation dates somebody else set. That work goes to the front of the queue whatever was already there, which is why roadmaps in this sector get rewritten more often than they get finished.
- **Retention obligations outlive the platform holding them:** SEC Rule 17a-4 requires broker-dealers to preserve certain records for six years and others for three, in each case with the first two years in an easily accessible place. Communications sent and received sit in the three year group. Storage bought on a five year refresh has to hand its contents to whatever replaces it.
- **Consolidation leaves two of everything:** Mergers and branch acquisitions are constant in banking and insurance, and each one arrives with its own network, directory, phone system and set of habits. Deciding what is worth standardizing and what can be left alone until it fails is most of the planning work.
- **An incident becomes a reporting clock:** The GLBA Safeguards Rule requires a written incident response plan and, for firms in its scope, notification to the Federal Trade Commission no later than thirty days after discovering a security event involving the unencrypted customer information of at least five hundred consumers. A clock that short changes how detection and logging are built.

## How We Work With Financial Institutions

Seven service lines. A financial services project usually draws on several.

### [Collaboration and Unified Communications →](https://trybussolutions.com/collaboration-unified-communications/)

Phone systems across branches and offices, contact center for service, collections and claims lines, meetings for advisors working remotely, and the recording, retention and supervision requirements designed in at the start.

### [Cybersecurity →](https://trybussolutions.com/cybersecurity/)

Segmentation around payment and cardholder systems, identity and multi-factor for staff, advisors and third parties, privileged access with a record of what was done while elevated, and logging that produces evidence an examiner will accept.

### [Networking and Connectivity →](https://trybussolutions.com/networking-connectivity/)

Branch connectivity with a second path that has been tested, wireless in banking halls and back offices, wired refresh in occupied buildings, and separation between staff, customer facing systems, payment systems and guest access.

### [Cloud and Infrastructure →](https://trybussolutions.com/cloud-and-infrastructure/)

Compute, storage and backup for the applications around the core platform, designed against retention obligations, the recovery expectations a continuity plan already commits to in writing, and change windows the change board controls.

### [Digital Workplace →](https://trybussolutions.com/digital-workplace/)

Teller and platform workstations, advisor laptops that leave the building, mobile devices that reach customer data, and the lifecycle work that keeps a device estate consistent enough to describe accurately.

### [Governance, Risk and Compliance →](https://trybussolutions.com/governance-risk-compliance/)

Control mapping and audit evidence against the frameworks you already answer to, third-party risk in both directions, and the practical job of turning a finding with a date on it into completed and documented work.

### [Managed Services and Support →](https://trybussolutions.com/managed-services-and-support/)

Ongoing operation and support of the environment as a separate agreement, with auditable access records for the work performed. Some clients hand over everything, and some keep operations in house and use us selectively.

## Talk to Us About a Project in a Regulated Firm

Tell us what is running, how many locations it covers and which examination or audit window the plan has to clear. We will tell you what we think the work involves.

Or call [423-633-1817](tel:+14236331817) · [info@trybussolutions.com](mailto:info@trybussolutions.com)