For VC, private equity, hedge funds, and family offices, cybersecurity has moved from an IT detail to a fundraising and operational due diligence issue. Here's what questionnaires actually ask — and how a small firm answers credibly.
Why allocators now ask about your IT before they wire money
Operational due diligence (ODD) questionnaires for venture capital, private equity, and hedge funds now routinely include a cybersecurity section — often ten to thirty questions deep. Institutional LPs, fund-of-funds, consultants, and insurers all ask, and a weak answer set doesn't just create awkward follow-up calls; it can stall a close or raise your cyber insurance premium.
The reason is simple: investment firms concentrate exactly what attackers want. Wire instructions and capital call processes. Material non-public deal information. Personal data on high-net-worth individuals. And most firms under fifty people have no internal IT or security staff — which attackers also know.
The pattern across fraud cases involving funds is remarkably consistent: a compromised or convincingly spoofed email account, a payment instruction that looked routine, and a wire that left before anyone made a phone call. Capital calls are the favorite vehicle, because LPs expect them, they're large, and they're time-pressured by design.
The questions that show up on nearly every ODD questionnaire
Across LP questionnaires, insurer applications, and standardized formats like the AITEC and ILPA templates, the same core questions repeat. If you can answer these well, you can answer most of the document:
Is multi-factor authentication enforced on all email and remote access? Not "available" — enforced, for every user, with no legacy protocols that bypass it. This is the first question because it's the control whose absence explains most incidents.
How do you verify payment instructions and capital call changes? The expected answer is a documented callback procedure: any new or changed wire instruction is verified by phone to a known number before funds move. Email confirmation alone is not an answer.
Are firm devices managed and encrypted? Partners checking deal email on personal laptops is the norm at small firms and a red flag on questionnaires. Device management (Intune or equivalent), full-disk encryption, and the ability to wipe a lost device are the baseline.
Who has access to what, and when was that last reviewed? Departed analysts, former assistants, consultants from two deals ago — access accumulates. A quarterly access review with a written record is the expected practice.
Do you have an incident response plan, and has anything happened? Honesty matters here; a disclosed phishing incident with a clean response story reads better than a blank "no incidents" from a firm with no ability to detect one.
What regulators add on top
For SEC-registered advisers — most PE and hedge fund managers, and a growing share of venture firms — examiner expectations layer on top of LP expectations. SEC examinations and enforcement actions have focused on exactly the small-firm gaps: MFA not enforced, vendor access never reviewed, incidents detected by outsiders, and policies that exist on paper but not in practice.
Family offices typically sit outside SEC registration, but face the same scrutiny from a different direction: banks, custodians, and insurers increasingly condition relationships and coverage on demonstrated controls. And the threat profile is arguably worse — principals and family members are targeted personally, across personal email, home networks, and household staff who handle payments.
The practical takeaway is the same for all four firm types: the controls that satisfy an LP questionnaire, an SEC examiner, and a cyber insurer are about 90% identical. Build once, answer everyone.
The 90-day baseline for a firm with no internal IT
A realistic sequence for a ten-to-fifty-person firm, ordered by risk reduction per unit of disruption:
Weeks 1–4: Identity. Enforce MFA tenant-wide with no exceptions, disable legacy authentication, apply Conditional Access policies that restrict access by device and location, and separate admin accounts from daily-driver accounts. This is where most of the risk lives.
Weeks 4–8: Email and payments. SPF, DKIM, and DMARC at enforcement on your sending domain; anti-phishing and impersonation protection configured in Microsoft 365; external sender tagging; mailbox forwarding rules audited and alerting enabled. Document the wire verification callback procedure and train everyone who touches payments.
Weeks 8–12: Devices and access. Enroll firm devices in Intune, enforce encryption and screen lock, decide explicitly what unmanaged personal devices may access (ideally: nothing sensitive). Run the first access review — every account, every vendor, every shared mailbox — and write down what you removed.
With that baseline in place, a security questionnaire stops being a scramble. The answers are simply true, and the documentation already exists.
How Intragreat works with investment firms
Intragreat Consulting provides this work as a practical engagement: a cybersecurity review mapped to the questions LPs, examiners, and insurers actually ask, followed by remediation through Microsoft 365 security hardening, email security, and endpoint management — delivered remotely for firms anywhere in the United States, with local support in Northern California and Nevada.
We're deliberate about claims: a review is not a guarantee, an audit, or a compliance certification. It's an honest assessment of your controls, a prioritized fix list, and help executing it — so that when the next due diligence questionnaire arrives, your answers are short, true, and documented.
If you're preparing for a raise, an examination, or an insurance renewal, our free security review is a sensible first step.