Skip to Main Content

Take Charge of Your Cybersecurity

Earn a Level seal you can show your clients, your regulators, and your insurer.

Three score-earned levels. One separate Validated treatment.

Get my gradeTalk to a real person
Veteran OwnedScore-earned LevelsValidated only after review

The Level system

What the H2Cyber Level system is

When you complete the H2Cyber cyber risk assessment, you earn a grade from A to F. If your grade is high enough, you also earn a Level: Level 1, Level 2, or Level 3.

Your score earns the Level. The Level does not by itself say that H2Cyber reviewed your controls or approved your report.

A plain seal records the Level earned by a self-assessment without the Validated band. A Validated seal additionally records H2Cyber review and explicit approval for that report.

You can put the applicable seal on your website, in your email signature, and in your client portal.

The three levels

The three levels, in plain English

Each level maps to your overall score. Level 1 starts at 70%, Level 2 at 80%, and Level 3 at 90%.

  1. Level 1

    70%

    Your basics are covered

    70% overall or better (a grade of C or better)

    Level 1 means your firm has the fundamentals in place. You have answered the 56-control assessment honestly, you have hit a passing threshold on the core Pillars, and you can demonstrate that you have taken cybersecurity seriously.

    For most small financial firms that are just getting started, Level 1 is the first real goal. It says: we assessed ourselves against a structured standard, and we are not operating blind.

    What Level 1 signals to someone looking at your firm:

    • You have completed a structured cyber risk assessment.
    • Your firm scores at or above the baseline required to earn the credential.
    • You have a report to back it up.

    This is the level that satisfies the initial "do you have a cyber risk assessment on file?" question from a regulator or an insurer.

  2. Level 2

    80%

    Your program is solid

    80% overall or better (a grade of B or better)

    Level 2 means more than the basics. Your firm has meaningfully addressed the controls across most of the 10 Pillars. You are not just covering the minimum. You have built something worth showing.

    Level 2 is the level that starts to differentiate you. A client comparing two advisory firms and seeing that yours carries an H2Cyber Level 2 seal has a concrete reason to trust you with their data.

    What Level 2 signals to someone looking at your firm:

    • You have covered your basics and gone further.
    • Your cybersecurity program is solid enough to hold up under scrutiny.
    • You are in the kind of shape that a broker-dealer or an RIA network would expect from a well-run firm.

  3. Level 3

    90%

    You are at the top of the standard

    90% overall (a grade of A)

    Level 3 is the highest credential in the H2Cyber system. It means your firm has done the work across all 10 Pillars, and your overall score reflects a cybersecurity program that is genuinely strong for a firm of your size.

    Most firms will not start here. But firms that work the plan over time, address the gaps their first report uncovered, and come back for a second or third assessment can get here. Level 3 is what you point to when a client, a partner, or a regulator wants to know that your firm takes this seriously.

    What Level 3 signals to someone looking at your firm:

    • Your cybersecurity program is at the top of what the H2Cyber standard measures.
    • You have done the work, and you have the grade to prove it.
    • You are the firm that sets the standard in your peer group.

The seal

The seal

When your score earns a Level, you receive an embeddable plain seal showing that Level.

Level 1: Your basics are covered

70% overall or better (a grade of C or better)

Level 2: Your program is solid

80% overall or better (a grade of B or better)

Level 3: You are at the top of the standard

90% overall (a grade of A)

Where you can display it:

  • Your website: in the footer, on a "Trust and Security" page, or in an advisor bio.
  • Your email signature: next to your credentials.
  • Your client portal: where clients log in to see their accounts.
  • Your pitch deck or marketing materials: when a prospective client asks how you protect their data.

The plain seal summarizes the score-earned Level. A report receives the Validated band only after the designated H2Cyber review and explicit approval. The seal is designed to be re-brandable for future white-label and MSP partners ("powered by H2Cyber").

Earning a seal

How to earn a seal

  1. Take the assessment. Complete all 56 controls in the H2Cyber assessment, either via the self-service wizard or with a cyber expert on the full-service option.

  2. Hit the threshold. Your overall score is the average of your 10 Pillar scores. If it meets the Level 1 threshold, you earn Level 1. If it meets Level 2 or Level 3, you earn those.

  3. Download your seal. Once your assessment is complete and your report is generated, your Level badge is available in your account dashboard. Download it, embed it, or share it.

  4. Keep it current. The H2Cyber system generates a fresh report quarterly. Your Level reflects your most recent assessment. If your grade drops below a threshold, the Level adjusts on your next report. Staying at your Level means the seal stays meaningful.

Get my grade

For regulators

What the seal says to a regulator

Regulators in the financial-services space, including those operating under SEC, FINRA, and state frameworks, want to see that you have completed a structured cyber risk assessment. The H2Cyber report is the evidence. The Level seal is the summary.

When a regulator asks "what is your current cybersecurity posture?" you hand them the report. When they ask for a quick read on where you stand, they see the Level. Both are backed by the same underlying assessment.

A Validated seal additionally means H2Cyber reviewed the framework-designated critical technical controls and explicitly approved the current report. Full-service sessions alone do not confer that band.

For clients

What the seal says to a client

Your clients trust you with their financial lives. They have started asking, in more and more first meetings, what you do to protect their data.

An H2Cyber Level seal gives you a concise summary of the score your completed structured assessment earned. A plain seal does not claim that H2Cyber independently reviewed the answers.

Your report supplies the underlying assessment detail. If the seal carries the Validated band, it also records H2Cyber review and explicit approval for that report.

For insurers

What the seal says to an insurer

Cyber insurance applications are getting stricter. Missing basic controls, like multi-factor authentication, endpoint protection, or encrypted backups, can disqualify a firm from coverage or raise premiums significantly.

A completed H2Cyber assessment tells an insurer you know where you stand. A Level 2 or Level 3 seal shows you have addressed the gaps. Some insurers are beginning to treat structured cyber assessments as a factor in underwriting. Getting your Level now puts you in a better position before the next renewal.

FAQ

Frequently asked questions about the seal

Partners

For MSP and white-label partners

If you are an MSP, a broker-dealer, or a BGA that wants to offer the H2Cyber standard to your member firms under your own brand, the Level seal is designed to be re-brandable. The seal reads "powered by H2Cyber," and the same plain-versus-Validated distinction still applies. Reach out to find out how this works.

Contact usCall 469-715-5255

The seal is earned, not given. Start with your grade.

Take the free assessment and see where you stand, or talk to a real person and we will walk you through it.

Get my grade (free)Talk to a real person

Or call us: 469-715-5255