Small advisers struggle with cybersecurity demands of regulators