Starting a Hedge Fund: Your IT and Cybersecurity Checklist

By Anna Wendt | Tuesday, May 26th, 2015

If you missed our 'Starting a Hedge Fund' webinar last week, you missed a lot. Luckily, our webinar replay is available here, and we're now onto Part Two of our recap. If you missed Part One - which focused on the structural and formation basics of starting a new hedge fund - click here. In Part Two, we're recapping what our very own Managing Director Vinod Paul covered, specifically around IT infrastructure decision-making, cybersecurity protections and common technology mistakes.

2015 Technology Priorities

Before looking at the specific technology infrastructure components emerging managers should consider before and during the launch phase, let's first cover some large-scale IT priorities for startups in 2015. We've identified three major priorities:

Selecting the right service providers. Whether it's outsourcing IT, administration or another critical function, it's imperative for startups (and successful hedge funds in general) to conduct proper due diligence and forge partnerships with providers that offer flexibility and accountability.
Understanding your firm's vulnerabilities and exposures. Security, security, security. It's the most critical area of focus for hedge funds in 2015. Firms should understand what risks could affect their businesses and the safeguards in place to mitigate those risks.
Employing an infrastructure your firm can grow with. You're a startup, yes. But you can't afford to act like a startup, at least when it comes to your technology. Selecting an infrastructure platform and provider that can grow with your firm and support you 2, 5, 10 years down the road is critical to your success, and will save you money and headaches in the long run.

The Basic IT Checklist

Beyond legally forming your new hedge fund and settling on an investment strategy, you also have to make technology a priority for your new entity. While it is important to select the right provider, one who will grow as the fund grows, there are some things that could be used for comparison across firms.

PCs/laptops/mobile devices
Email, file services, storage
Telecommunications and networking equipment
Voice services and hardware
Disaster recovery and backup
Compliance & archiving systems
Applications (think order management system, portfolio accounting, etc.)

The Cloud Is a No-Brainer

Obviously, in order to support all of these systems and capabilities, you’ll need to first select the type of infrastructure platform you’re going to rely on. In our experience, nearly all new hedge fund and investment firm launches are selecting the cloud to support operations, primarily due to its flexibility, security and low upfront costs. But with any technology decision, do your due diligence here. Vet your service providers thoroughly, and consider the type of infrastructure needed to run operations: public, private or hybrid. Full disclosure: we recommend a private cloud solution to support the unique needs of the financial services industry. In another recent webinar we hosted on The Investor Perspective on the Cloud, the investor we interviewed clearly remarked she did not support the use of public cloud platforms and did not believe they were suitable for enterprise-caliber hedge funds. Just a little food for thought.

Cybersecurity: THE 2015 Priority

Cybersecurity is easily the most talked about topic in the financial services industry right now (and in most other industries as well). When we think about cybersecurity, we think of three key components to any firm's overall security strategy: Technology, Processes and People.

Technology is arguably the easiest to set up and implement, but to protect your firm, you need to employ layers of security across your systems and data, including firewalls, intrusion detection systems and encryption technology, as well as regular penetration tests and audit/logging systems to monitor unauthorized access.
Processes are just as important as the technology side of cybersecurity. Having policies in place to protect your firm before, during and after an incident are critical to reducing the overall impact on your firm in the event a breach does occur. Some vital policies include: written information security plans (WISPs), access control policies, personal information security policies and incident response plans.
People are the last part of the cybersecurity puzzle and can be the greatest weakness of the three. On the flip side, however, is recognizing your employees can also serve as your firm's first line of defense against security risks. Proper training on Internet safety, identity theft and phishing attacks can reduce the likelihood of a breach. Annual cybersecurity training courses and ongoing education may include drills and table top exercises.

Common IT Mistakes

Lastly, here are a few common technology mistakes we see firms make during the lauch process. You can read more about common IT mistakes here.

You want the perfect IT solution.
You are only focused on today and are forgetting about tomorrow.
You underestimate how large of a role technology plays in your day-to-day operations.