Mortgage Brokers and Lenders
Cybersecurity and IT solutions to protect customer data and maintain FTC Safeguards Rule compliance.
Is Your Company Prepared for the FTC Rule Changes?
Changes to an important Federal Trade Commission (FTC) Rule shine a light at the information security practices of mortgage brokers, lenders, and agents. Protecting customer information is at the core of the FTC Standards for Safeguarding Customer Information – aka the Safeguards Rule. The FTC amended the 2003 Rule in 2021 to keep pace with current technology. The revised Rule provides updated, concrete guidance for businesses and requires companies covered by the Rule to implement important security measures to keep customer data secure. Airiam assists the mortgage industry with compliance. Here’s what you need to know.
Is My Company Required to Comply with The Safeguards Rule?
According to Section 314.1(b), a mortgage brokers, lenders, and agents is considered a financial institution. The Act goes on to say that “a mortgage broker is a financial institution because brokering loans is a financial activity.”
What Actions Should We Take to be Compliant?
The Safeguards Rule requires your company to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards designed to protect your customers’ information. Brokers that don’t comply by December 2022 face up to $46,517 per consent order violation. The FTC can take an expansive view of a violation, depending on the circumstances, particularly if there are issues involving multiple customer records.
The three main objectives of your information security plan are:
- Ensuring the security and confidentiality of customer information;
- Protecting against anticipated threats or hazards to the security or integrity of that information; and
- Protecting against unauthorized access to that information that could substantially harm or inconvenience to any customer.
Customer information refers to any record containing nonpublic personal information about a financial institution or customer, whether in paper, electronic, or another form, that you or your affiliates handle or maintain.
The size and complexity of your company, the nature and scope of your activities, and the type of data and information you collect will determine what must be included in your information security program.
Nine Elements of The Safeguards Rule
The Safeguards Rule identifies nine elements that your company’s information security program must include. Airiam has solutions to help with all or any combination of your company’s needs to ensure compliance.
The components of the Rule and Airiam’s solution to meet the requirements involve:
1. Designating a qualified Individual to implement and supervise your company’s information security program. The Qualified Individual can be an employee of your company, or a senior team member can work with an affiliate or service provider like Airiam.
2. Conducting a risk assessment. Your risk assessment must be written and include criteria for evaluating those risks and threats. Because the risks to information constantly morph and mutate, the Safeguards Rule requires companies to conduct periodic reassessments as operations change, and new threats emerge.
3. Designing and implementing safeguards to control risks identified through your risk assessment. Requirements include:
Our experts provide all your IT services with IT Managed Services (MSP). We’ll be your team to keep your company in compliance and make sure servers, networks, and workstations are up and running so you can focus on running your business.
4. Regularly monitoring and testing the effectiveness of your safeguards either through continuous monitoring of your system or annual penetration testing, as well as vulnerability assessments. When your organization takes the opportunity to see your security posture through the eyes of your most significant threat, you prevent them from taking over your infrastructure. Our expert auditing helps you discover exploitable flaws in your security through our vulnerability scanning, assessment, ransomware simulation, and penetration testing options.
5. Training your staff. Your company’s security program is only as effective as its least vigilant staff member, and it’s critical to train your team to spot risks and safeguard customer data.
6. Monitoring your service providers. Your contracts must spell out your security expectations, build ways to monitor your service provider’s work and provide periodic reassessments of their suitability for the job. Airiam will work with your company to cover all the bases, so your contracts with us are compliant.
7. Keeping your information security program current. Security requirements change, and security programs must be flexible enough to accommodate necessary modifications. Airiam offers support services for IT management, monitoring, and cybersecurity, bundled for complete infrastructure management. AirAssure™ is a cybersecurity insurance tool set to keep your business compliant.
8. Creating a written incident response plan that includes:
9. Requiring your Qualified Individual to report to your Board of Directors or governing body in writing, at least annually. If your company doesn’t have a Board or equivalent, the report must go to a senior officer responsible for your information security program.
The report should address:
Airiam will assist with all your reporting requirements based on the AirProducts your company requires to stay compliant.
Don’t wait to protect your company and your customers from cybercrime.
The importance of cybersecurity goes beyond the Rule. Cyber incidents like ransomware or data breaches can cause bring a mortgage broker’s computers offline, making business-as-usual impossible. If a customer’s data is breached, they could be at risk for identity theft and other scams.
December will be here before you know it. You can learn more about the Safeguards Rule and general guidance on data security on the FTC’s website. Reach out to Airiam with your compliance questions and learn how our suite of products and expert team can protect your business. We are offering a free assessment of mortgage brokers, lenders, and agents as a starting point.