Industries / Mortgage Brokers and Lenders
Mortgage Brokers and Lenders
Cybersecurity and IT solutions to protect customer data and maintain FTC Safeguards Rule compliance.
Is Your Company Prepared for the FTC Rule Changes?
Changes to an important Federal Trade Commission (FTC) Rule shine a light at the information security practices of mortgage brokers, lenders, and agents. Protecting customer information is at the core of the FTC Standards for Safeguarding Customer Information – aka the Safeguards Rule. The FTC amended the 2003 Rule in 2021 to keep pace with current technology. The revised Rule provides updated, concrete guidance for businesses and requires companies covered by the Rule to implement important security measures to keep customer data secure. Airiam assists the mortgage industry with compliance. Here’s what you need to know.
Is My Company Required to Comply with The Safeguards Rule?
According to Section 314.1(b), a mortgage brokers, lenders, and agents is considered a financial institution. The Act goes on to say that “a mortgage broker is a financial institution because brokering loans is a financial activity.”
What Actions Should We Take to be Compliant?
The Safeguards Rule requires your company to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards designed to protect your customers’ information. Brokers that don’t comply by December 2022 face up to $46,517 per consent order violation. The FTC can take an expansive view of a violation, depending on the circumstances, particularly if there are issues involving multiple customer records.
The three main objectives of your information security plan are:
- Ensuring the security and confidentiality of customer information;
- Protecting against anticipated threats or hazards to the security or integrity of that information; and
- Protecting against unauthorized access to that information that could substantially harm or inconvenience to any customer.
Customer information refers to any record containing nonpublic personal information about a financial institution or customer, whether in paper, electronic, or another form, that you or your affiliates handle or maintain.
The size and complexity of your company, the nature and scope of your activities, and the type of data and information you collect will determine what must be included in your information security program.
Nine Elements of The Safeguards Rule
The Safeguards Rule identifies nine elements that your company’s information security program must include. Airiam has solutions to help with all or any combination of your company’s needs to ensure compliance.
The components of the Rule and Airiam’s solution to meet the requirements involve:
1. Designating a qualified Individual to implement and supervise your company’s information security program. The Qualified Individual can be an employee of your company, or a senior team member can work with an affiliate or service provider like Airiam.
2. Conducting a risk assessment. Your risk assessment must be written and include criteria for evaluating those risks and threats. Because the risks to information constantly morph and mutate, the Safeguards Rule requires companies to conduct periodic reassessments as operations change, and new threats emerge.
3. Designing and implementing safeguards to control risks identified through your risk assessment. Requirements include:
- Reviewing access controls
- Conducting a periodic inventory of data, noting where it’s collected, stored, or transmitted
- Keeping an accurate list of all systems, devices, platforms, and personnel
- Design your safeguards to respond with resilience
- Encrypting customer information on your system and when it’s in transit
- Assessing the security of apps that store, access, or transmit customer information, including third-party apps and implementing procedures for evaluating their security
- Implementing multi-factor authentication for anyone accessing customer information on your system
- Disposing of customer information securely
- Anticipating and evaluating changes to your information system or network
- Maintaining a log of authorized users’ activity and keeping an eye out for unauthorized access.
Our experts provide all your IT services with IT Managed Services (MSP). We’ll be your team to keep your company in compliance and make sure servers, networks, and workstations are up and running so you can focus on running your business.
4. Regularly monitoring and testing the effectiveness of your safeguards either through continuous monitoring of your system or annual penetration testing, as well as vulnerability assessments. When your organization takes the opportunity to see your security posture through the eyes of your most significant threat, you prevent them from taking over your infrastructure. Our expert auditing helps you discover exploitable flaws in your security through our vulnerability scanning, assessment, ransomware simulation, and penetration testing options.
5. Training your staff. Your company’s security program is only as effective as its least vigilant staff member, and it’s critical to train your team to spot risks and safeguard customer data.
6. Monitoring your service providers. Your contracts must spell out your security expectations, build ways to monitor your service provider’s work and provide periodic reassessments of their suitability for the job. Airiam will work with your company to cover all the bases, so your contracts with us are compliant.
7. Keeping your information security program current. Security requirements change, and security programs must be flexible enough to accommodate necessary modifications. Airiam offers support services for IT management, monitoring, and cybersecurity, bundled for complete infrastructure management. AirAssure™ is a cybersecurity insurance tool set to keep your business compliant.
8. Creating a written incident response plan that includes:
- Internal processes your company will activate in response to a security event
- Clearly defined roles, responsibilities, and levels of decision-making authority
- How communications and information are shared inside and outside the company
- The process to fix identified weaknesses in your systems and controls
- Procedures for documenting and reporting security events and your response
- How an incident will be reviewed, and how you’ll revise your incident response plan and information security program based on what was discovered
9. Requiring your Qualified Individual to report to your Board of Directors or governing body in writing, at least annually. If your company doesn’t have a Board or equivalent, the report must go to a senior officer responsible for your information security program.
The report should address:
- An overall assessment of your company’s compliance with its information security program.
- Specific topics related to the program such as risk assessment, risk management and control decisions, service provider arrangements, test results, security events and how management responded, and recommendations for changes in the information security program.
Airiam will assist with all your reporting requirements based on the AirProducts your company requires to stay compliant.
Don’t wait to protect your company and your customers from cybercrime.
The importance of cybersecurity goes beyond the Rule. Cyber incidents like ransomware or data breaches can cause bring a mortgage broker’s computers offline, making business-as-usual impossible. If a customer’s data is breached, they could be at risk for identity theft and other scams.
December will be here before you know it. You can learn more about the Safeguards Rule and general guidance on data security on the FTC’s website. Reach out to Airiam with your compliance questions and learn how our suite of products and expert team can protect your business. We are offering a free assessment of mortgage brokers, lenders, and agents as a starting point.
