The standard moved. Did your firm?
What counted as reasonable protection two years ago may not count today. Noftek keeps BVI law firms, trust companies, insurers and registered agents at today's standard of care, and backs it with evidence you can show a regulator.
Built for firms that can't afford to guess
BVI law firms and financial services firms hold some of the most sensitive data in the region and answer to some of its strictest scrutiny. We work only with firms like yours, so every recommendation is built around what your regulator, your clients and your board expect to see.
We secure your Microsoft 365 tenant first. If you also run servers, file shares or an office network, we protect those too.
- Law firms & insolvency practice Legal & restructuring
- Trust & fiduciary Trust companies
- Insurance Insurers & managers
- Registered agents Company formation
Compliance is a standard, not a snapshot
The BVI Data Protection Act 2021 asks firms to take practical steps to keep personal data safe. Practical is judged against today's threats and today's tools. A policy written once and filed away shows that a firm was aware of the standard and then stopped keeping up with it.
The bar keeps rising
Attackers now steal sign-in sessions, bypass basic two-step codes and hide in mailbox rules. Controls that were enough in 2021 often miss all three.
Evidence beats intention
Regulators, insurers and clients ask what you can prove. We keep dated, specific records of what is in place and when it was last tested.
Measured every quarter
We rescan your environment on a schedule, confirm fixes took effect and update the standard as threats change, so you stay current without starting over.
Five things to protect, in the order an attacker reaches them
Every attack follows the same path: a person is tricked, an account is taken, a device is used, the network is crossed and data is reached. We secure each step so one failure doesn't become a breach.
User
Staff who can spot and report a phishing attempt before it lands.
Identity
Accounts that a stolen password alone can't open, watched around the clock.
Device
Desktops, laptops and servers monitored, patched and able to be isolated in minutes.
Network
An office network and internet presence with no open doors.
Data
Client files encrypted, backed up and restorable on a tested schedule.
Each of the five is secured across all four layers. The framework maps back to the NIST Cybersecurity Framework 2.0 and CIS Controls, so it holds up when an auditor, insurer or regulator asks where it came from.
Where does your firm stand today?
Eleven plain questions across the five areas above. Your reading updates as you answer. Nothing is sent anywhere unless you choose to email it to us.
See what an outsider can see
The standard-of-care check shows how your firm looks from the inside. The outside view shows how it looks from the internet, the way an attacker or a regulator would see it, so you can close the gaps first.
With your permission we scan your public footprint and your Microsoft 365 configuration against the CIS and CISA baselines. You get the findings ranked by how likely each one is to be exploited, with no 200-page report and no obligation.
- HighLegacy sign-in still allowed on 3 mailboxes, which skips two-step verification
- HighStaff password found in a 2024 public breach
- MediumEmail domain can be spoofed (no enforced DMARC)
- MediumRemote access port open to the internet
- LowExternal sharing allowed by default in SharePoint
Example findings, for illustration only
Three levels of the same standard
Each tier covers all five areas. Higher tiers add depth for firms with an office network, more exposure or a regulator to answer to.
Core
The baseline every firm should have today.
Includes- 24/7 Microsoft 365 account threat detection and response
- 24/7 managed detection and response on every computer
- Security awareness training with phishing simulations
- Email, collaboration and browser threat protection
- Admin rights granted only when needed, then removed
- Email domain protection against spoofing
- Two-step sign-in for every account
- Laptop disk encryption
- Patching and remote management
- Microsoft 365 and server backup
Plus
For firms with an office network or higher exposure.
Everything in Core, plus- Continuous Microsoft 365 hardening that corrects drift
- Computer and server hardening against CIS benchmarks
- 24/7 security event monitoring across all systems
- Managed firewall with threat filtering
- Network configuration backups
- Advanced Microsoft 365 security licensing
Regulated
For firms that answer to a regulator, board or insurer.
Everything in Plus, plus- File encryption that stays with documents wherever they go
- Virtual CISO: policies, risk register and board reporting
- Compliance evidence mapped to NIST CSF 2.0 and the BVI DPA
- Quarterly evidence review with your leadership
Pricing follows the evidence. We scope every engagement from what your outside view finds, so a clean environment gets a lighter plan and every added control has a finding behind it.
From where you stand to a plan you can defend
Check
Take the self-check above, or skip straight to the outside view.
Evidence
We scan, then narrow the results to the findings that are actually exploitable.
Plan
Each finding is matched to the control that closes it, inside the tier that fits.
Verify
We rescan to confirm each fix took effect, then repeat every quarter.
What our clients say
As a registered agent specializing in company, ship, and investment registration and management in the British Virgin Islands, we have had the pleasure of working with Jackson since 2006. His professionalism, reliability, and knowledge of data protection have made him a valuable asset to our business. His expertise has been particularly useful in implementing our current system, which includes a True Data Loss Prevention Solution (DLP) to safeguard both our company and client data. After almost 40 years in this industry, I can confidently say that Jackson is one of the best in the field.
Since SABALS commenced its law practice in 2013, we have relied on Jackson to keep our clients' data safe. After the major hurricane in 2017, our office sustained damage and, as a result, we had to relocate. During that time, Jackson assisted tirelessly with this transition to ensure that our system was working in an effort to continue being of service to our clients. He is passionate about IT security, has a wealth of knowledge, and is always accessible. We never worry about cyber security with Jackson on our team.
In the past, my law firm struggled with major IT issues due to poor system configuration. Jackson provided a much-needed solution — he analyzed the problem and installed better equipment that met our needs. As our IT consultant, he is proactive in anticipating issues before they arise and reactive in providing prompt assistance when needed. When I moved to a new law firm, I made sure to bring Jackson with me, and he also manages the IT for an affiliated company. His reliable and effective work gives me peace of mind.
Start with the evidence
Tell us where your firm stands, or send your check results. We'll reply with what the evidence says you need next, and what you don't.