Mortgage Companies
A Virtual CISO for Mortgage Companies, to Own the Security Program.
The FTC Safeguards Rule asks someone to oversee your security program and report on it every year. A virtual CISO does that part time, with our team running the controls behind them.
For mortgage lenders, brokers and servicers that need security leadership and governance but not a full-time executive.
Virtual CISO (vCISO) for Mortgage Companies
Can a Virtual CISO Be Our Qualified Individual?
The rule allows the Qualified Individual to be employed by you, an affiliate or a service provider. If a service provider fills the role, you keep responsibility for compliance, designate a senior member of your staff to direct and oversee them, and require the provider to maintain a program that protects you (16 CFR 314.4(a)).
How that role is filled for your firm is part of the compliance scope, delivered by our Compliance Division, Capital Cyber Compliance.
What Goes in the Annual Report to Leadership?
The rule requires the Qualified Individual to report in writing, at least annually, to your board or, if there is none, to a senior officer: the overall status of the program and your compliance, and material matters such as risk decisions, service provider arrangements, testing results, security events and recommended changes (16 CFR 314.4(i)).
A vCISO writes that report in plain language, so leadership knows where the risk is and what is being done about it.
How Do We Oversee Our Software and Settlement Vendors?
A mortgage company shares borrower data with its loan origination system vendor, credit reporting, document and e-signature platforms, and title and settlement partners. The rule asks you to select providers that can protect that data, require safeguards by contract, and periodically assess them (16 CFR 314.4(f)).
A vCISO keeps the vendor list, reviews what each one holds, and helps with the security questionnaires you send and the ones your investors and partners send you.
Who Writes the Incident Response Plan and the Wiring Procedure?
A vCISO does, with you. The incident response plan sets roles, decision authority, communications and how the FTC notice decision is made (16 CFR 314.4(h)). The wiring procedure says how instructions are given to borrowers and how changes are verified. Both are tested so people know their part before closing week, not during it.
What Is Included
6 PARTSTechnology Roadmap
Your goals lined up with the right technology, in order.
Governance and Policy
A cybersecurity policy and the procedures under it.
Incident Response Planning
A written plan, tested so people know their part.
Program Oversight
Security program management and regulatory oversight.
Questionnaires and Reviews
Help with investor, partner, vendor and insurer security questionnaires.
Leadership Reporting
Risk explained in plain language to the people who decide.
Frequently Asked Questions
4 QUESTIONSDoes a vCISO make us compliant with the Safeguards Rule?
No one person does. A vCISO oversees the program and reports on it, our team runs the technical safeguards, and formal compliance engagements are delivered by our Compliance Division, Capital Cyber Compliance. Confirm your obligations with your counsel.
Who is responsible if the Qualified Individual is a service provider?
You are. Under 16 CFR 314.4(a), a firm that uses a service provider for the role retains responsibility for compliance and designates a senior member of its staff to oversee that person.
Do we need an annual report if we are small?
A firm holding customer information on fewer than five thousand consumers is exempt from the annual report requirement under 16 CFR 314.6. Many still want one, because it is how leadership sees the risk.
How much time does a vCISO spend with us?
It is scoped to what you need, from a regular cadence of meetings to deeper involvement during an exam, an audit or an incident. We set it on the call.
More for Mortgage Companies
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Mortgage Companies
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Mortgage Companies
Managed IT and security for mortgage lenders, brokers and servicers, with the FTC Safeguards Rule in view.
Talk Through Security Leadership.
Pick a time. Tell us who oversees your security program today and who asks about it.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.