Having two of the largest banks in the world headquartered in the same city creates an unusual effect: the entire professional services ecosystem that serves them operates at a financial compliance level that's unusual for a non-coastal market. Law firms, accounting practices, technology companies, and even real estate and construction firms that service BofA and Wells need SOC 2 compliance, financial-grade security programs, and in some cases vendor risk management certifications that are typically only required in New York or San Francisco.
The financial compliance culture has spread beyond the direct banking supply chain. Charlotte's insurance sector — several major insurance carriers have substantial Charlotte presences — adds state insurance department cybersecurity requirements on top of GLBA. The RIA and wealth management community adds FINRA and SEC obligations.
Duke Energy's headquarters adds NERC CIP complexity for the utility supply chain, and the company's vendor security requirements have set a high bar for what it means to be a "secure vendor" in the Charlotte market.
Questions to ask any Charlotte MSP
- How many financial services clients do you serve, and can you describe your GLBA compliance program?
- Have you worked with clients under SOX or FINRA examination? What did that look like?
- Are you familiar with NERC CIP requirements for utility-adjacent clients?
- What's your vendor risk management capability — can you complete a SOC 2 Type II audit if your financial services clients require it?