The Buzz on Cyber Security

Federal Rules Expand the Scope of Your Customer's Data Protection

In case you were wondering about the onslaught of regulator or investor requests for cybersecurity plans, risk assessments, and MFA certifications, it all has to do with FTC regulations passed last year that go into effect December 9, 2022. The FTC has extended the deadline for compliance for 6 months, making the new deadline 6/9/2023.

eCFR :: 16 CFR Part 314 -- Standards for Safeguarding Customer Information

In a nutshell, our customers have all of the tools to meet these requirements in the 2-90 IT Security Plan. These include:

• Employee Training
• Risk Assessment
• Third-Party Vendor Reviews
• Data Breach Response and Remediation

Small companies - responsible individual

For small firms, you should assign a responsible individual who is knowledgeable about the technology aspects of your firm. They do not need to have a degree in cybersecurity. However, they should know all the firm's tech and communications infrastructure and have the capability to completely answer the cybersecurity questionnaire. If the individual is NOT able to answer the questionnaire, you MAY designate a third party, such as an IT consultant. We caution small companies against signing big contracts if the firm's technology consists mostly of leased cloud computing assets, such as LOS, document storage, and email. Even third-party apps, like online 1003s, should come with some tech support, and you can designate a 3rd party (even the vendor) specifically for those types of risks. 

Don't "Build Castles" - Use the Tools you Have

We really try to avoid creating additional work in the form of a separate workflow for compliance-related matters. That's why you should use some of the resources you already have to meet some or all of the requirements. 

• Credit Bureau Audits - If you have the ability to pull credit reports yourself (instead of just through your investor/wholesaler directly) you likely have a credit bureau service provider. This firm is responsible for evaluating your firm (usually annually) and providing a risk assessment based on that evaluation. That should be a foundation. Review their report against the overall questionnaire to see how many items are covered.
  
  • By the way, bureaus are conducting these audits furiously as a part of the new rule's implementation
• State Certifications - keep a copy of any questionnaire you complete to assess your technology. THIS COUNTS AS AN AUDIT or RISK ASSESSMENT
• When you sign up with a tech provider, get their SOC or ISO certification information. Use the vendor's reviews as your own.
• When getting training, make sure you keep a copy
• Read your policies and procedures - if they don't make sense, get a plain English translation!

Speaking of Plain English - here's our summary of the IT/Cyber Security Plan requirements that you can use as a checklist. 

New York Cybersecurity Certification

The Section NYSDFS 500 updates that went around earlier this year include the updates from the FTC's rule. The changes do not represent a departure from current best practices but memorialize the requirements in the FTC's Safeguarding rule.

Remember that the certification only captures information on what you are doing. Policies and procedures should reflect this information; they don't replace your implementation. 

You can request help completing your Cybersecurity Certification here

 

Remote Workplace Setup and Supervision

Remote work is here to stay

As much as we have addressed operations in remote work locations through technology, the simple process of setting someone up remotely means aggregating and amalgamating pieces from a number of different areas of operation - mostly IT security - into something comprehensive. We have amalgamated policies and procedures from across a mortgage operation into a unifying element, and have provided a checklist for setting up that remote worker as a tool.

Key Point - Documentation Transfer

Paper documentation and images, the mortgage industry's lifeblood, represents the single largest risk to customers and the company. Remote workplaces, being dispersed and interconnected with private residences, can be extremely insecure places to store documents. Knowing this, we structure the remote workplace as 100% paperless. Logically, arranging for the delivery of loan file exhibits in a secure manner without paper means a secure, 2-factor authentication upload. Remember - personal email is not secure. 

Key Point - Internet of Things

In an office environment, wired network connections prevail and a smaller number of items get connected to a wireless network. In small-office, home, or remote environments, wireless devices abound. Inventory of these items and their connection to a shared internet connection where you or your employees securely connect can prevent a hacker's back door access by allowing IT departments to identify items that have been exploited. (Watch Mr. Robot to see how they get in.)

Key Point - Expectations for Work Schedule, Supervision and Duties

In a remote environment, employees can often experience "mission creep" where, because of a non-office setting, priorities, and distractions detract from the customer experience. For this reason, clear rules on work hours - logging in and out, accountability for email and phone responses, as well as consequences for time spent on personal items during work hours - get set forth at the outset.

For our customers, we have provided a sample "2-94 Remote Work Policy and Procedure" which you can use as a stand-alone to prove compliance with regulatory requirements, and insert into your 2-90 IT Security Module. This supports pandemic-related remote work, as part of a disaster recovery (see 2-97 Disaster Recovery/Business Continuity) and continuity program, and general network security plan (2-92 IT Security Plan).

Time to Revisit Mortgage Vendor IT Security Reviews

A document management vendor spills files onto the street

It's an accident waiting to happen. Walking down the street through a busy downtown, I witnessed a reminder of the inadvertent problems you can encounter through exposure of customer information. A banker's box of loan files fell off a dolly and crashed into the street spewing customer information onto the roadway. Luckily, for this vendor, the wind was calm, and the driver picked up the materials and returned them to the box without further incident. For me, this highlighted one of the many concerns my clients deal with; information security plans.

Who's Touching Your Clients' Data?

In the image above, it's clear that the driver could have taken the opportunity to capture some information from those loan files. Why weren't the boxes sealed? These are some of the elements that a site inspection of a vendor can reveal. Always review your vendor's procedures.

Today most of our files are transmitted electronically. One client used this as a rationale for not having locked file cabinets in a shared office space. But the reality, upon inspection, revealed "relics" all over her office. Copies of documents she scanned were in shadow files. Other printed material was left in folders on desktops. We overlook that our landlords and cleaning crews have access to the physical space. Always lock your cabinets and leave a clean desk.

Nevada, New York, Pennsylvania and Other Picky Regulators

A slew of requests from Nevada and New York reveal that these regulators have identified the information security weaknesses in our offices. They demand companies have an information security plan, which includes a vendor approval process.

For brokers, particularly, this may seem like overkill, since they don't even have a chance to approve attorneys, appraisers and credit bureaus. They can only use companies previously approved by the investor or wholesaler. However, it makes sense in the context of the level of diligence the lender or broker uses in having the protection of customers' non-public information top-of-mind. Don't send customer information to anyone unless you have ascertained they have received screening from another regulated entity. Better yet, screen them yourself. 

A Vendor Management Information Security Self-Audit Example

You can combine these audits with other elements of your vendor review. For instance, if you have a credit bureau you are reviewing, in addition to their information security plan, you can access their Fair Lending and any other consumer protection policies. Remember that if your vendor is licensed in your state, you can rely on the state's examination of a particular element of the vendor approval.

If you would like a copy of the Vendor Self-Audit Checklist please e-mail me, or like our Facebook page. (Make sure you send me your e-mail address!)