How to Move a Small RIA From VPN to Zero Trust Access

Most small RIAs still reach their office file server, scanned account forms and remote desktops through a VPN. That VPN gives a remote user, or anyone holding that user's password, broad access to the office network, and the VPN appliance itself is one of the most attacked devices a firm owns. This guide explains zero trust vs VPN in plain terms, shows how a registered investment adviser with a handful of offices or a fully remote team can move to zero trust network access (ZTNA), and covers how to document the change for Regulation S-P.

Why are RIAs moving off VPNs?

RIAs are moving off VPNs because a VPN places a remote user on the internal network, and the appliance at the network edge has become a favorite target. A stolen adviser password plus a VPN login can reach far more client data than that adviser needs.

The appliances keep making news. In January 2024, CISA issued Emergency Directive 24-01 after widespread exploitation of Ivanti Connect Secure and Policy Secure gateways. A year later, on January 8, 2025, CISA added another Ivanti Connect Secure flaw, CVE-2025-0282, to its catalog of vulnerabilities known to be exploited. In June 2024, CISA, the FBI and partner agencies published Modern Approaches to Network Access Security, which describes the weaknesses of traditional VPNs and urges organizations of every size to move toward zero trust and cloud-delivered access models, which the guidance calls Security Service Edge (SSE) and Secure Access Service Edge (SASE).

What does Regulation S-P expect of remote access?

Regulation S-P does not name a remote access technology. It requires written policies and procedures that protect customer information, including against unauthorized access, and a response program that can work out what an intruder touched.

Under amended 17 CFR 248.30(a), those policies must be reasonably designed to "protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer." The incident response program must include procedures to assess the nature and scope of an incident and "identify the customer information systems and types of customer information that may have been accessed or used without authorization." According to the SEC's small entity compliance guide, larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so every adviser is now examined against the amended rule.

The SEC's fiscal year 2026 examination priorities say cybersecurity reviews will pay particular attention to data loss prevention, access controls and account management, and that Regulation S-P reviews will look at oversight of third-party vendors. A remote access design that records who reached which system, from which device, speaks directly to those areas. For what the priorities mean for the year ahead, see what the SEC's 2026 exam priorities signal for RIAs.

Zero trust vs VPN: what is the difference for an RIA?

The difference is scope: a VPN connects a remote user to the office network, while zero trust network access (ZTNA) connects a verified user on a checked device to one specific application and nothing else. NIST SP 800-207 describes the premise as "no implicit trust granted to assets or user accounts based solely on their physical or network location."

Most ZTNA services work the same way. A small agent runs on the laptop. A cloud broker checks the user's identity, the health of the device and the user's role before each session. A connector inside the office or cloud environment makes an outbound link to the broker, so the office no longer needs an inbound port open to the internet. An operations associate reaches the shared drive and the scanner folder. An adviser reaches the shared drive and a remote desktop. Neither can browse the rest of the network.

For many small RIAs, the CRM, custodian platforms and portfolio management system already run in the cloud. Those stay behind single sign-on and conditional access in your identity provider. ZTNA covers what is left on premises or in a private cloud: file shares, legacy desktop applications and remote desktops.

How do you migrate a small RIA from VPN to ZTNA, step by step?

Move in stages: build an inventory, fix identity, pilot with a small group, then run both systems side by side until the new path is proven.

1. List everything the VPN reaches today: file shares holding client statements and account forms, any on-premises application, remote desktops and printers.
2. Map each role to what it needs: advisers, operations and client service, the CCO, and any outside compliance consultant.
3. Fix identity first. Require multifactor authentication on every account, phishing-resistant methods for administrators, and encryption and device management on every firm laptop.
4. Choose a ZTNA service with per-application policies, device health checks, single sign-on with your identity provider and logs you can export and keep.
5. Run vendor due diligence. A ZTNA provider sits in the path of customer information, so check it against your service provider procedures under Rule 248.30(a)(5), including the requirement that a service provider notify you within 72 hours of a breach affecting customer information systems it maintains. Make sure the contract says so (how to update vendor contracts for the 72-hour notice).
6. Pilot with the operations team and one adviser who travels.
7. Publish applications one at a time and confirm each works before moving on.
8. Run the VPN and ZTNA in parallel for a set period, then disable VPN accounts group by group.
9. Retire the VPN: close the inbound ports, take the appliance off the internet, and update your network diagram.
10. Update your written policies, customer information data map and incident response program to describe the new access path.

What evidence will an examiner want to see?

An examiner will want to see that the written policy matches what the technology does. Keep a short file that shows each of these:

• The written remote access policy, with the date it changed from VPN to ZTNA.
• A list of roles and the applications each role can reach.
• A sample of access logs showing user, device, application and time.
• The ZTNA provider's due diligence file and breach notice commitment.
• Proof that the VPN appliance was removed from the internet.
• The quarterly review of who has access and the changes made.

Rule 204-2(a)(25) under the Advisers Act requires advisers to keep records of their Regulation S-P policies and procedures, and this file fits naturally beside them. For a broader approach, see how to build an exam evidence binder from your MSP's reports.

What should an RIA do this quarter?

Start with the steps that reduce risk before any new tool arrives.

• Confirm your VPN appliance is on a supported version and fully patched.
• Close any multifactor authentication gaps, including shared and service accounts.
• Build the resource and role inventory from steps 1 and 2.
• Ask your IT provider which applications could move first and set a target date to retire the VPN.
• Add remote access to the agenda for your next annual compliance review.

How can s90 help your firm move off its VPN?

s90 designs and runs Zero Trust Network Access for registered investment advisers, from the first inventory through the pilot, the parallel run and the day the VPN comes down. We tie access to your identity provider and device health, keep the logs your Regulation S-P response program depends on, and document the design for your compliance file. Our agreements include 72-hour breach notification and 24-hour evidence production commitments. If you are weighing a VPN replacement, we are glad to walk through what it would look like for your firm.