Choosing a website host or maintenance provider involves more than checking whether a site has an SSL certificate. For a Jacksonville financial firm, website provider security evidence for financial firms should show how the provider can access systems, what information it may handle, and how safeguards and incident response work in practice.
A website provider is only one part of a firm's security and compliance program. Hosting arrangements do not, by themselves, satisfy the firm's regulatory duties. Treat this checklist as a way to gather and assess vendor information, then confirm your obligations and contract terms with the firm's compliance professionals and qualified counsel.
Start by mapping the provider's role
Before requesting documents, write down what the provider actually does. A company that hosts a site may have a different role from the team that updates WordPress, manages forms, supports analytics, handles email, or processes payments. Those functions can involve different systems, access rights, and information.
Ask the provider to describe which systems it administers, what information it can access, where that information is stored or transmitted, and which other companies may be involved. Include website forms and plugins in the discussion. A form that requests customer details may introduce different considerations from a page that only displays general business information. For practical questions about form fields and intake, see this guide to website intake form questions.
Use the provider's answers to define the review's scope. If another vendor manages email or payment processing, do not assume the website host can answer for that service. Identify who is responsible for each component and which party has access to the relevant information.
Request evidence of access controls
Ask for a clear description of how administrative access is assigned, approved, reviewed, and removed. The provider should be able to explain who can access the website, hosting account, backups, and related tools, and what controls limit that access. Ask how the provider handles individual accounts, authentication, privileged access, and former staff or contractor access.
Request evidence appropriate to the service, such as a current access list, a description of access-review practices, or a sample record showing how access changes are documented. You do not necessarily need sensitive internal details. The goal is to see whether access is limited to people who need it for their work and whether the provider can demonstrate how it manages that access.
Also clarify account ownership and recovery. The firm should know who controls the domain, hosting account, website administrator accounts, and recovery methods. Ask how the firm can regain access if the provider relationship ends or a key contact is unavailable.
Understand information handling
Ask the provider to explain what customer or firm information it collects, stores, views, transmits, or can access while delivering its services. Request a description of the information's path through the website and connected tools, including forms, plugins, analytics, and any external services. The answer should distinguish information the provider can access from information it does not handle.
Then ask how information is protected and what happens to it when it is no longer needed. Look for written terms covering permitted uses, retention, deletion, backup copies, and assistance with returning or removing information when service ends. Ask how the provider will confirm that deletion is complete when applicable.
Do not rely on a general statement that information is “secure.” Ask for details that match the firm's actual use of the service. The website security review process can also help identify which website components and data flows need attention.
Inspect safeguards and maintenance evidence
Ask what safeguards apply to the specific services the provider delivers. Depending on the arrangement, relevant evidence may include a written security overview, a recent assessment summary, patching and maintenance records, backup and recovery procedures, monitoring practices, and summaries of security testing. Ask when the evidence was prepared, which systems it covers, and whether any gaps are being addressed.
For a WordPress site, ask how the provider handles core, theme, and plugin updates; how it evaluates updates before applying them; and how it responds to a vulnerability or malware finding. Ask how often the provider reviews its procedures and tests whether recovery steps work. You can use the WordPress hosting security checklist as a starting point for questions about website-specific safeguards.
Evidence should be relevant and understandable, not merely impressive-looking. A certification or security badge may be useful context, but ask what service, system, and period it covers. If a provider cannot share a document, ask whether it can provide a summary or answer specific questions in writing.
Set incident expectations before an event
Ask who the firm should contact if the provider suspects unauthorized access, malware, data exposure, or a service disruption. Request the incident escalation process, the contact method for urgent reports, and an explanation of what information the provider will share as it investigates. Confirm how the provider will preserve relevant records and cooperate with the firm's response.
Put a usable notification process in the contract. Define what events must be reported, how quickly the provider must notify the firm, how updates will be shared, and who is responsible for coordinating communications. The firm should not assume that a provider's internal incident procedures automatically meet the firm's needs.
Under Florida Statute 501.171, a third-party agent must notify the covered entity of a breach as soon as practicable and no later than 10 days after determining or having reason to believe a breach occurred (Florida Statute 501.171). Applicability and the firm's own obligations depend on the circumstances, so have qualified counsel or compliance professionals review the relevant requirements and contract language.
Make subcontractors and contract terms visible
Ask whether the provider uses subcontractors or other service providers that can access the firm's website, hosting environment, or information. Request their roles, the information or systems they can access, and how the primary provider evaluates and oversees them. The firm should know which parties are involved, rather than relying on a general assurance that vendors are vetted.
Make sure the written agreement reflects the arrangement. Review terms for permitted data use, access restrictions, security expectations, subcontracting, incident notification, cooperation, retention, deletion, and service termination. The agreement should also identify how the provider will communicate material changes to its services or security practices.
Use the NASAA's Cybersecurity Checklist Guidance for firm websites as another reference when assessing website-specific safeguards. Adapt any checklist to the firm's business, the information involved, and the requirements that apply to it.
Keep the review active
Vendor due diligence is not only a one-time document request. Keep a record of the provider's answers, evidence reviewed, decisions, open questions, and follow-up actions. Revisit the review when the website changes significantly, a new service or subcontractor is introduced, the provider changes its practices, or an incident raises new concerns.
A provider that can explain its responsibilities, show relevant evidence, and work within clear written expectations gives the firm a more useful basis for oversight than broad claims alone. Still, the firm remains responsible for deciding how the provider fits into its overall security program.
Frequently asked questions
What security documents should a financial firm request?
Ask for materials that match the service, such as an access-control description, security overview or assessment summary, maintenance and patching practices, backup and recovery procedures, incident contacts, and written data-handling terms.
How can a firm verify who has administrator access?
Request a current access list or another appropriate record, ask how access is approved and reviewed, and confirm how access is removed when someone no longer needs it. Also clarify who controls the firm's accounts and recovery methods.
Should a hosting contract include incident-notification deadlines?
Yes, the firm should review whether the contract sets a clear notification process, including the events covered, timing, contacts, updates, and cooperation. Have counsel or compliance professionals assess the language for the firm's circumstances.
Does a secure host mean the firm has met its cybersecurity duties?
No. Hosting safeguards are one component of a broader program. The firm should assess its own obligations, the information involved, and the roles of all website and technology providers.
Conclusion
Request evidence that is specific to the provider's access, systems, information, and responsibilities, then document how the firm evaluates it. If you want to discuss WordPress updates, security, backups, or performance optimization for your site, contact Zevonix at (904) 658-0777.