Mortgage Companies
Managed IT and Security for Mortgage Lenders, Brokers and Servicers.
We understand security and regulated businesses. A loan file holds a borrower's Social Security number, income, bank statements and credit report, and every closing moves money by wire. We run the IT and the security around both, and the documentation that shows it.
Non-bank mortgage lenders, mortgage brokers, loan servicers and the loan officers and processors who work with them.
What a Mortgage Company Needs From an MSP
Does the FTC Safeguards Rule Apply to Mortgage Companies?
For most non-bank mortgage companies, yes. The rule, 16 CFR Part 314, implements the Gramm-Leach-Bliley Act and names mortgage lenders, mortgage brokers and account servicers among the financial institutions it covers (16 CFR 314.1(b)). Lenders owned by a bank usually answer to their banking regulator instead, so confirm which applies to you with your counsel.
The rule asks for a written information security program with administrative, technical and physical safeguards. We run the technical parts; formal compliance engagements are delivered by our Compliance Division, Capital Cyber Compliance.
How Do You Stop Wire Fraud at Closing?
Closing wire fraud usually starts with a compromised or spoofed email account: an attacker reads the thread, waits for the closing date and sends new wiring instructions that look like they came from you, the title company or the agent. It is business email compromise aimed at the largest payment most borrowers ever make.
We layer multi-factor authentication on every mailbox, email filtering and anti-spoofing for your domain, monitoring for suspicious sign-ins and mailbox rules, staff training, and a written procedure for verifying any change to wiring instructions by phone at a known number.
What Must We Tell the FTC After a Breach?
Since May 13, 2024, a covered firm must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information on at least 500 consumers is acquired without authorization (16 CFR 314.4(j) and 314.5). Information counts as unencrypted if the encryption key was also accessed.
Encryption, monitoring and a written incident response plan are what make that 30 day clock manageable. State breach notice laws and your investors may ask for more, so confirm your full set of obligations with your counsel.
How Do You Protect the Loan Origination System and Borrower Portal?
Loan officers, processors and underwriters all work in the loan origination system, and borrowers upload pay stubs and bank statements through a portal. The rule asks for access limited to what each person needs and multi-factor authentication for anyone accessing an information system (16 CFR 314.4(c)(1) and (c)(5)).
We set up individual accounts, multi-factor authentication and least privilege on the systems we manage, keep the devices staff use to reach them patched and protected, and work with your software vendors on the parts they control.
Who Should Be Our Qualified Individual?
The rule requires one Qualified Individual to oversee the program, and that person may work for you or for a service provider. If it is a service provider, you keep responsibility for compliance and name a senior person at the firm to oversee them (16 CFR 314.4(a)). A virtual CISO is one way to fill the oversight role; how it is set up for your firm is part of the compliance scope.
Are We Also Under New York's Cybersecurity Regulation?
If you hold a license from the New York State Department of Financial Services, such as a mortgage banker license, its cybersecurity regulation, 23 NYCRR Part 500, applies to licensed entities under the Banking Law, and the department has enforced it against a licensed mortgage banker. Other states have their own rules for licensees. Confirm which apply to you with your counsel.
Can You Support Us On-Site in Northern Virginia?
Yes. We are based in Leesburg, Virginia, and work on-site across Northern Virginia. Support is remote first, which suits loan officers who work from home and on the road.
How We Cover It
6 SERVICESManaged IT and Help Desk
Loan officers and processors supported, with access to loan systems kept current.
Microsoft 365 and Email Security
Mailboxes protected against takeover and fake wiring instructions.
Managed Security Monitoring
Sign-ins, devices and mailbox rules watched around the clock.
Backup and Ransomware Recovery
Loan files and mail backed up, encrypted and tested.
Virtual CISO
Program oversight, incident response planning and the annual report to leadership.
Security Awareness Training
Staff trained to spot wire fraud and phishing.
Our Services for Mortgage Companies
5 SERVICESManaged IT and Help Desk
When a processor cannot reach the loan origination system or a loan officer is locked out before a closing, the loan stalls. We support your people and keep the systems they rely on maintained and secure.
Microsoft 365 and Email Security
Loan files, pre-approvals and closing instructions travel by email, and that is where wire fraud starts. We run your Microsoft 365 tenant and the protection around every mailbox.
Managed Security Monitoring (MDR and SOC)
A takeover of one loan officer's mailbox can sit quietly for weeks. Our managed detection and response watches your accounts, devices and cloud around the clock and acts on what it finds.
Managed Security Monitoring (MDR and SOC) for Mortgage Companies
Backup and Ransomware Recovery
Rate locks expire and closing dates do not move because your files are encrypted. We back up the data your pipeline runs on, keep it off-site and encrypted, and prove it restores.
Virtual CISO (vCISO)
The FTC Safeguards Rule asks someone to oversee your security program and report on it every year. A virtual CISO does that part time, with our team running the controls behind them.
Compliance
Formal Compliance Work Is Delivered by Our Compliance Division.
We run the technical safeguards the FTC Safeguards Rule asks for and keep the evidence that they run. The written program, the risk assessment and formal compliance engagements are delivered by our Compliance Division, Capital Cyber Compliance. Firms that want independent proof of their program can also look at CyberCert SMB1001 certification.
FTC Safeguards Rule Requirements · Start With Capital Cyber Compliance · CyberCert SMB1001 Certification
Frequently Asked Questions
5 QUESTIONSDoes the FTC Safeguards Rule cover mortgage brokers?
Yes. The rule names mortgage brokers and mortgage lenders among the financial institutions under the FTC's jurisdiction, in 16 CFR 314.1(b). Lenders owned by a bank usually answer to their banking regulator instead. Confirm your own status with your counsel.
Do small mortgage companies get any exceptions?
Some. A firm that holds customer information on fewer than five thousand consumers is exempt from the written risk assessment, the continuous monitoring or testing requirement, the written incident response plan and the annual report (16 CFR 314.6). The written program, multi-factor authentication, encryption and training still apply.
Can you stop wire fraud at closing?
No one can promise that. Multi-factor authentication, email filtering and anti-spoofing, account monitoring, staff training and a written procedure to verify wiring instruction changes by phone are the parts of a program that make it much harder.
Do you support loan origination software?
We support the computers, accounts, network and security your loan origination system and borrower portal depend on, and work with the vendor's support when the problem is on their side.
How is it priced?
Managed IT and security are a fixed monthly cost scoped to your company. We give you the number on the call.
Services for This Industry
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Talk Through Your Company's Security.
Pick a time. Tell us how many loan officers you have and what systems your loans run through.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.