Purpose
Identify ways to reduce login friction while preserving security controls.
Explore details →BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS01 / 06
Preliminary observations
A review of authentication controls and potential improvements.
Basis
Public-source review and selected screens from the October 21 UAT recording.
Explore details →Next step
Validate scope, evidence and control ownership after authorized access.
Explore details →The focus
This review identifies opportunities to simplify the login journey while retaining required safeguards. The current production configuration and internal requirements have not been reviewed.
These observations are preliminary. Applicable obligations, current settings, and client commitments require validation.
BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS02 / 06
SEC oversight: controls, not a CAPTCHA mandate
Barings LLC is an SEC-registered adviser; portal and data scope require confirmation.
Regulation S-P
Confirm data scope, safeguards, incident response and service-provider oversight.
Explore details →Annual compliance review
Review policies, annual effectiveness testing and corrective actions under Rule 206(4)-7.
Explore details →FY2027 exam priorities
Review access, account management, cyber recovery and third-party risk. Staff priorities are not new rules.
Explore details →Regulation S-P
Confirm whether the relevant entity and data fall within scope. Covered institutions must maintain safeguards, incident-response procedures and service-provider oversight. Institutional use alone does not settle data coverage.
No CAPTCHA-specific mandate was identified in the reviewed sources. Internal requirements remain unverified.
Sources
- https://www.barings.com/guest/content/terms-and-conditions
- https://www.law.cornell.edu/cfr/text/17/248.30
- https://www.law.cornell.edu/cfr/text/17/248.1
- https://www.law.cornell.edu/cfr/text/17/275.206(4)-7
- https://www.sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf
- https://www.sec.gov/files/2027-exam-priorities.pdf
- https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities
BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS03 / 06
Other jurisdictions: entity scope comes first
Map the operating entity and service, not just the institutional client’s location.
EU / DORA
For in-scope entities, review risk-based internal ICT audit and follow-up of critical findings.
Explore details →UK / FCA
Confirm the firm category and whether independent internal audit is appropriate and proportionate.
Explore details →Singapore / MAS
Review technology-risk guidance and map applicable binding notices. Do not assume bank rules apply.
Explore details →EU / DORA
For relevant in-scope entities other than microenterprises, the ICT risk-management framework is subject to regular internal audit with risk-based frequency and formal follow-up of critical findings. An EU visitor alone does not establish scope.
No universal CAPTCHA mandate was established. Local obligations require compliance mapping.
Sources
- https://www.barings.com/guest/content/terms-and-conditions
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554&from=EN
- https://handbook.fca.org.uk/handbook/SYSC/6/2.html
- https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS04 / 06
Institutional assurance is not one universal audit
Different reviews answer different questions. Report scope and client commitments matter.
Financial and custody
A financial audit is not proof of login controls. SOC 1 addresses financial reporting controls; confirm custody-rule scope.
Explore details →Security assurance
SOC 2 and ISO 27001 address different forms of assurance. Check the scope, controls and exceptions.
Explore details →Client commitments
Review contracts, security commitments and client audit rights using the actual wording.
Explore details →Financial audit and SOC 1
Financial audits and SOC 1 focus on financial reporting. Some IT controls can be in scope, but these reviews do not by themselves demonstrate comprehensive login protection. Custody-rule applicability depends on the actual arrangements.
No Barings portal SOC 2 or ISO scope, or CAPTCHA-specific client commitment, has been verified.
Sources
- https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
- https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-1
- https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
- https://www.iso.org/standard/27001
- https://www.law.cornell.edu/cfr/text/17/275.206(4)-2
BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS05 / 06
Remove the routine puzzle. Preserve the control objective.
Proposed direction: reduce routine CAPTCHA friction while retaining effective protection against automated abuse.
If policy names CAPTCHA
Obtain an approved revision or exception; document the replacement and residual risk.
Explore details →If a prior finding or client commitment relies on it
Review the original remediation and wording, then obtain the required approvals.
Explore details →If the requirement is effective bot protection
Test retained or replacement controls against the objective and record the approval.
Explore details →Policy or baseline names CAPTCHA
Evaluate the replacement, seek the appropriate approved policy revision or exception, and document residual risk. Do not change a policy solely to justify an unsupported removal.
This is not approval to change production. Security and control owners must review and approve a tested change.
Sources
- https://help.okta.com/oie/en-us/content/topics/security/security_general.htm
- https://help.okta.com/oie/en-us/content/topics/itp/bot-protection.htm
- https://help.okta.com/oie/en-us/content/topics/itp/bot-protection-config.htm
- https://auth0.com/docs/secure/attack-protection/bot-detection
- https://pages.nist.gov/800-63-4/sp800-63b.html
- https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
- https://www.sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf
BARINGS × TALENTBRIDGE · PRELIMINARY OBSERVATIONS06 / 06
Enforce bot protection. Guide one MFA setup.
Validate the actual platform, policies and supported flows before choosing a configuration.
Auth0, if it enforces the login
Consider risk-triggered Auth Challenge, brute-force blocking, suspicious-IP throttling and monitored attack events.
Explore details →Okta Identity Engine, if applicable
Consider enforced Okta Challenge, ThreatInsight enforcement and system-log monitoring. Confirm entitlement and supported flows.
Explore details →MFA and recovery
Consider guided authenticator-app enrollment and retain approved recovery. TOTP is not phishing-resistant; preserve any stronger assurance requirement.
Explore details →Auth0: possible configuration
If Auth0 enforces this flow, assess risk-triggered Auth Challenge, brute-force blocking and suspicious-IP throttling, with monitored events. Confirm supported flows, entitlement, configuration and false-positive impact.
The demonstrated screen was optional backup enrollment in UAT. Production parity and the enforcing tenant remain unverified.
Sources
- https://auth0.com/docs/secure/attack-protection/bot-detection
- https://auth0.com/docs/secure/attack-protection/brute-force-protection
- https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling
- https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-otp-notifications-for-mfa
- https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-enrollments-universal-login
- https://help.okta.com/oie/en-us/content/topics/itp/bot-protection.htm
- https://help.okta.com/oie/en-us/content/topics/itp/bot-protection-config.htm
- https://help.okta.com/oie/en-us/content/topics/security/threat-insight/configure-threatinsight.htm
- https://help.okta.com/oie/en-us/content/topics/security/threat-insight/about-threatinsight.htm
- https://pages.nist.gov/800-63-4/sp800-63b.html