How do RIAs prepare for SEC cybersecurity examinations?

“Start with a written information security policy aligned to NIST or ISO 27001. Document your risk assessment process annually, not just the output.”