Mortgage Companies
Backups and Ransomware Recovery That Keep Loans Closing.
Rate locks expire and closing dates do not move because your files are encrypted. We back up the data your pipeline runs on, keep it off-site and encrypted, and prove it restores.
For mortgage companies that cannot process, underwrite or close a loan without their files and mail.
Backup and Ransomware Recovery for Mortgage Companies
What Should a Mortgage Company Back Up?
The files and mail your pipeline depends on: shared folders with loan documents and disclosures, key workstations, and Microsoft 365 mailboxes and files, where much of each loan's history lives. Your loan origination system and borrower portal are often hosted by the vendor, so we confirm what they back up and cover the rest.
Backups are encrypted and stored off-site, with daily backups as a baseline, so ransomware on the office network does not take the copy with it.
Why Does Encryption of Backups Matter Under the Safeguards Rule?
The rule asks for encryption of customer information at rest and in transit over external networks (16 CFR 314.4(c)(3)), and a backup is customer information too. A stolen backup that was encrypted, with the key kept safe, is also treated differently under the FTC notice rule, which counts information as unencrypted if the key was accessed (16 CFR 314.2).
How Do You Know the Backups Work?
We test them. Restores are tested and recovery procedures validated, so the first restore of a loan folder is not during a closing week emergency. Backup health is part of daily monitoring: a failed or stalled job is a ticket, not a surprise.
What Happens if Ransomware Hits During a Busy Month?
Ransomware protection sits in front of the backups: endpoint detection and response, application allow-listing, patching and staff training make an infection less likely to start or spread. If it happens anyway, the written incident response plan the rule asks for (16 CFR 314.4(h)) tells everyone what to do, we contain it, and we restore from a clean copy.
Ransomware often includes data theft, so the plan also covers working out what left the network, which feeds your decision on the FTC notice.
What Is Included
6 PARTSOff-Site Encrypted Backups
Loan documents and key data encrypted and stored away from the office.
Cloud Mailbox and File Backup
Microsoft 365 mail and files included in the backup plan.
Tested Restores
Restores tested and recovery procedures validated.
Backup Monitoring
Every failed job raises a ticket to our team.
Ransomware Protection
EDR, allow-listing and patching in front of the backups.
Incident Response Plan
A written plan, so the first hour of an incident is not improvised.
Frequently Asked Questions
4 QUESTIONSOur loan origination system is in the cloud. Do we still need backups?
Usually yes. Mail, shared folders and laptops hold loan documents outside the system, and you should confirm in writing what the vendor backs up and for how long.
How often are backups taken?
Daily as a baseline, and more often for systems that change constantly. We scope it around how much work you can afford to lose.
Do you back up Microsoft 365?
Yes. Cloud mailboxes and files are part of the backup plan, because a deleted or encrypted mailbox full of loan correspondence is as much a loss as a server.
Does a written incident response plan apply to small mortgage companies?
Under 16 CFR 314.6, a firm holding customer information on fewer than five thousand consumers is exempt from the written incident response plan requirement. We still recommend one, because the first hour of an incident should not be improvised.
More for Mortgage Companies
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Mortgage Companies
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Mortgage Companies
Managed IT and security for mortgage lenders, brokers and servicers, with the FTC Safeguards Rule in view.
Talk Through Your Backups.
Pick a time. Tell us where your loan files and mail live today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.