A family office should approach cybersecurity the way it approaches audit and tax: with an independent assessment first, a documented program second, and an accountable owner throughout. The sequence matters more than the tooling, because an office that buys security products before it understands its own risk surface ends up with expenses it cannot evaluate and gaps it cannot see.
The comparison with audit and tax is closer than it sounds. When the United States National Institute of Standards and Technology revised its Cybersecurity Framework in February 2024, it added a governance function and explained it in terms a family-office executive will recognize: cybersecurity is “a major source of enterprise risk that senior leaders should consider alongside others such as finance and reputation.” The United Kingdom’s National Cyber Security Centre makes the same point from the other direction, telling organizations to “communicate cyber risk in a way that fits in with how your organization talks about other types of risk (such as legal or financial risk).” A family office already has a discipline for risks of that kind: have them examined by someone independent, decide what to do about them at the level that carries accountability, and review the result on a cycle.
Start with an independent assessment
The practical starting point is an independent risk assessment conducted by a firm with no commercial stake in the remediation that follows. An assessor who also sells the tooling they recommend is not conducting an assessment. They are scoping a sale.
A framework gives the assessment its structure, and the choice between the established ones matters less than offices tend to think. The CIS Critical Security Controls, maintained by the Center for Internet Security, are prioritized so that an organization knows where to begin: “Every enterprise should start with IG1,” the first implementation group, which CIS defines as “essential cyber hygiene.” The NIST framework is outcome-based by design. It “provides a series of outcomes to prioritize and address cybersecurity risks but does not specify actions for meeting those outcomes,” and it “was developed for organizations of any size, sector, or maturity,” which includes an office of six people. Both are used internationally and carry weight with banks, custodians and insurers, and a national scheme such as the United Kingdom’s Cyber Essentials can sit beneath either where a family’s entities operate in that jurisdiction.
What no framework supplies is knowledge of how a family lives. The NCSC is candid about the limit of any baseline used alone: “using a baseline such as Cyber Essentials on its own has its limitations in that only the risks generally considered by the Cyber Essentials scheme will be covered by its recommended controls.” For a family office, the risks a standard baseline does not consider are most of the consequential ones, so a rigorous assessment begins with an inventory wider than any corporate template. It covers every network and device across the office, the residences, the vacation properties, vehicles and aircraft, the family’s personal devices, the cloud services in use and the channels the family uses to reach the office. It identifies where exposure is greatest, including the gaps enterprise security teams routinely overlook, and it ranks what it finds by the consequence to the family’s security, privacy and finances rather than by how easy each item is to fix.
Turn the findings into a program with owners
An assessment produces a list of findings, and a program is what that list becomes once somebody has decided the order, the owner and the budget for each item. The two are easy to confuse because working through a list feels like progress. Closing the findings of one assessment closes those findings; what creates a program is the decision record around them, which is what lets the next assessment find less.
NIST’s governance function is built around that record: leadership accountable for cybersecurity risk, and roles, responsibilities and authorities that are established, communicated and enforced. In a family office we translate that into three names for every workstream: the person who drives it, the person who approves its spending and its exceptions, and the people who must be consulted, which includes the family whenever a control will change how they live. In our experience a finding with no owner is still open a year later.
The workstreams themselves are familiar: a written information security program setting out roles, acceptable use and incident response; education that reaches family members and household staff as well as employees; vulnerability management by whoever runs the office’s technology; network security that extends to the residences; due diligence on the outside parties who hold family information; and an incident response plan that has been rehearsed. What distinguishes a family office is less the list than how far each item has to reach.
Where frameworks stop and the family begins
Frameworks assume a managed environment of devices an organization issues, accounts it controls and staff it can instruct. A family lives largely outside that, and the gaps an assessment uncovers there usually need specialist help that a general provider does not offer. Each is a category to choose within, by criteria, rather than a brand to adopt on someone’s recommendation.
- Personal devices and home accounts. Family members use phones, tablets and laptops the office did not issue and cannot govern like company equipment. Whatever protects them has to work without the authority the office holds over its own systems, and the test that matters is whether the family keeps it switched on.
- Public exposure. What is already published about the family, and what can be removed, is several jobs with different lifespans, and the free, permanent protections should come before any paid removal service. We set out the sequence in what is already public about your family.
- Credit and tax identity. Credit freezes, where the national credit system offers them, and in the United States the IRS Identity Protection PIN, block specific misuses of an exposed identity at little or no cost. They are individual acts the office cannot batch, which is why they need an owner more than they need a vendor.
- The managed IT provider. Most offices need one, and most providers keep systems running well. What their contract leaves uncovered is set out in what your IT provider doesn’t cover, and the standard the office holds the provider to is the office’s to write.
- Residential technology and its integrators. Audio-visual and home-automation contractors install systems on the family’s networks and usually keep remote access to support them, with a commercial incentive toward uptime rather than segmentation. Who owns the network at each house, and what those contractors must accept, is covered in the household perimeter.
The NIST framework places due diligence before a supplier relationship begins rather than after, and the same order applies to every one of these categories. Running that diligence on the advisors and providers who already hold family information is the subject of how to run a security review on your advisors.
Who should hold the whole picture
Someone has to hold the assessment, the program, the specialists and the provider together, along with the record of what was decided and why. A larger office can do that itself; a smaller one usually retains an advisor. Either way, the coordinating role belongs with a party that does not earn from the remediation it recommends. Annapurna has no implementation practice, takes no product revenue and has no commercial stake in the remediation that follows an assessment, and that is the basis on which we select and oversee the specialists a family needs.
Handled this way, cybersecurity stops being a series of disconnected purchases and becomes a program: a known baseline, a named owner, and a record of what was decided and why. That record is what makes the next decision easier, and it is what an office has to show when a bank, an insurer, or a family member asks who is responsible.
Tony Gebely, Annapurna’s chief executive, set out this approach on the WealthTech Podcast.
Where this sits
The independent assessment is the work of our cybersecurity risk assessments, and turning its findings into a sequenced program with named owners is cybersecurity program development. Who in the office should own each layer is worked through in family office cybersecurity governance.
Sources
National Institute of Standards and Technology (United States), Cybersecurity Framework FAQs
Center for Internet Security, CIS Controls Implementation Groups