CEO Update

Keeping our client’s personal information and our businesses safe from cyber criminals has never been more important than right now.

We are pleased to announce the launch of the refreshed Cyber Security Policy as announced at the recent Adviser Days. Our focus for this policy is to present information in a way that is easily understood and makes sense, segmenting requirements for the different audiences i.e. users, business owners and it technicians.

To support this, we have also:
• Provided greater clarity of what components of the requirements Fitz Group IT takes responsibility for if you use the Fitzpatricks infrastructure.
• Provided lists of helpful information to support your search for suitable products or services to incorporate in your network (password managers, email filtering, anti-virus, firewalls, cloud storage and our recommended Cyber Insurance Broker).
• We will provide a list of all cyber requirements so that if you wished, you could give this to your IT professional and have them take care of all the technical requirements to give you peace of mind.

Whilst most policy settings remain largely unchanged, many have been enhanced and with more clarity around what these requirements are, you should refresh yourself (and all the people in your business) on the entire policy. There are a couple of new items you should be aware of.

These are:
• Your Cyber Incident Response Plan must be in place by 1st July 2023 in line with the completion of your Business Continuity Plan.
• Personal information emailed to clients and others external to the Fitzpatricks environment (with some exceptions) will need to be encrypted. This control recognises the inherent risk of email and its vulnerability in today’s environment. The good news is that we have a client portal through which we can share this information in an efficient, practical manner. We understand how challenging this type of change is so have given you till 1st July 2023 to settle your thinking and processes. Please do not wait to start to understand and apply this process.

Please take the time to read through the policy and supporting materials which can be found here: Cyber Security. If you have any questions or concerns, please contact Professional Standards.

Email: [email protected]
Phone: 07 3105 6530

Based on overwhelming demand from you, the Fitzpatricks advice community, we’d like to introduce you to Coco – FPW’s new Community Collaboration chat room.

Coco is a Microsoft Teams based chat room designed for advisers and support staff to tap into the collective wisdom of the FPW Advice Community. It enables you to share and shape new ideas with each other and ask those questions that you know someone in the community must be able to answer.

Your invitation to join Coco will be emailed to you within the next two weeks. Please look out for it as it’s not a phishing test and might otherwise end up in your junk folder.

A few things to be aware of:
1. All the usual rules about appropriate and respectful language apply.
2. Any requests or questions to the FPW team should go through the usual channels.
3. Coco is only available to advisers and support staff in the FPW Advice Community.
4. If you don’t want to be subscribed to Coco, please just send an opt-out reply to your email invitation to Caroline at [email protected].

As always, your feedback and ideas on how we use and improve this new capability are welcome. Just tell Coco! She can’t wait to hear from you!

Thank you to those of you who attended the Xplan Client Portal webinar. Hope you found it beneficial. For those of you who missed the webinar, please click here to access the recording. We will be sending out a survey shortly along with the responses to the questions that were raised during the webinar.

As background, the FPW Adviser Cyber Policy has recently been updated to require documents containing confidential or personal information to be encrypted before sending to clients and third parties or alternatively, shared with them using a trusted file share portal.

Recognising the existing policy requirement to have all client documents stored in Xplan in a readable format, i.e., not encrypted, the Xplan Client Portal will not only allow you to better protect your clients data but should be more efficient for you as you won’t need to load client documents multiple times in multiple places.

The Xplan Client Portal was selected by the members of our community on the Client Portal Working Group as the preferred solution. This portal will be launched this Friday 31st March 2023.

Please contact Siva Mehta ([email protected]) if you have any further queries in relation to this.

Fitzpatricks’ Xplan Client Portal is being relaunched on Friday 31st March. There are also some changes being made to the Client Portal that will improve data security for both existing and new users (clients).

To improve the security of your clients’ data, we are changing the minimum requirements for their Xplan Client Portal passwords in the coming weeks. To assist with this process, we will provide you with a template of suggested wording that you can use to communicate these changes with your clients. This template will outline the importance of these changes and will emphasise that your clients make these changes as soon as possible and preferably implement these requirements when they next login or are being setup for the first time.

Password strength changes

With the computing power available to bad actors today, a short simple password is not enough to protect your clients account and data. The table below gives you an indication of how long it would take a hacker to brute force (entering many passwords or passphrases in the hope of eventually guessing correctly)

As you can see, using an 8-character password (even with Numbers, Upper and Lowercase Letters, and Symbols) will only take 39 minutes to break!

To combat this, we are updating our Xplan password requirements to the following:

Password minimum length: 12
Password History: The last 2 passwords are remembered
Password Age: 180 days (you will be asked to change twice a year)

Two-factor authentication

From Monday 17th April 2023, the Fitzpatricks Xplan Client Portal will be updated to make 2FA (Two-Factor Authentication) mandatory for all clients. Please notify your clients that are currently subscribed to the Xplan Client portal of this change.

XPLAN Two-factor authentication (2FA) is a security protocol that uses two stages to verify the identity of a client to access their XPLAN Client Portal. It not only provides a valuable layer of protection to prevent unauthorised access but is also aligned to Fitzpatricks policy of not sharing passwords, i.e. 2FA can’t be implemented with two alternative authentication methods.

When a client attempts to log in to their XPLAN Client Portal with two-factor authentication, they will require their XPLAN Client Portal password and a second form of authentication. This prevents unauthorised access via compromised passwords. When a client enters their username and password to access the portal, a unique code is provided to the client using a predetermined method (email verification code OR SMS verification code). This code must be entered to complete the login process.

Coming up on 5th April we have our Virtual Adviser & Support Technical Day. This day will be made up of four separate sessions. To attend, please register for each session separately with their own registration link. Click here for all the registration links.

To help you get to know your FPW Best of Breed team, how they support you, and how you can contact them, we’ve created the Best of Breed brochure available on the Adviser Portal. We hope you both enjoy it and find it useful.

As previously communicated, we ask that all advisers complete the mandatory questionaries relating to our Incidents & Breaches and Complaints policy which has been refreshed and is to be released in April. The Kaplan Corporate Content (assessment) will be open from 11th of April and is due for completion by 28th of April. CPD points will be awarded.

Please register to our upcoming FPW webinars: