Mortgage lenders and brokers
FTC Safeguards Rule obligations, warehouse lender and investor due diligence, and state regulator questions, often all in the same quarter.
- Home
- Financial services
Your examiner, bank partner, or investor is asking. Be ready.
Security programs for mortgage lenders, fintechs, credit unions, and the service providers that support them, built by a former Deputy CISO of a 50-state mortgage lender.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — Who this is for
Regulated firms with 50 to 1,000 people
You carry bank-grade obligations without a bank-sized security team. These are the situations I see most.
Fintechs and their bank partners
Your sponsor bank has to show its examiners that it oversees you. Its vendor due diligence will ask for a program, a SOC 2 report, or both.
Credit unions and community institutions
Examination findings to close, board reporting to strengthen, and IT general controls your financial auditors will test.
Service providers to financial institutions
Core processors, loan servicers, and software vendors facing their clients’ third-party risk reviews.
02 — Requirements
What applies, in plain terms
Most firms face more than one of these. The control work overlaps, so the program is built once.
GLBA and the FTC Safeguards Rule
A written information security program for non-bank financial institutions, with a Qualified Individual, a written risk assessment, specific required safeguards, and an annual report to the board. How I build it.
NYDFS Part 500
New York’s cybersecurity regulation for DFS-licensed entities: a CISO, a risk assessment, multi-factor authentication, asset inventory, incident notification, and an annual certification of compliance.
FFIEC expectations
The examination standards banks and credit unions are held to, which also reach their technology service providers through vendor management.
IT general controls
Access, change management, and operations controls your financial statement auditors test. Weak ITGCs turn into audit findings.
SOC 2
The report your institutional clients and bank partners ask for when they review you as a vendor. How I build it.
03 — Background
I’ve run the program you’re being asked for
Built and run security programs inside regulated financial services, not just advised them.
- Deputy CISO, 50-state mortgage lenderA lender with $30 billion in loan volume and more than 750,000 customers.
- 70% fewer critical vulnerabilitiesAcross more than 6,000 systems in 12 months.
- Virtual CISO to seven regulated organizationsAt the same time, across GLBA, NIST, SOC 2, and other frameworks.
04 — Fixed fees
What it costs
Start with a fixed-fee Readiness Assessment against the rule that matters most to you, then decide what comes next.
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Gap report against the GLBA Safeguards Rule, NYDFS Part 500, or SOC 2
- Risk summary
- 90-day roadmap
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentVirtual CISO retainer
From $2,000 / month
An accountable security leader without a full-time hire.
- Can serve as your Qualified Individual or CISO
- Prepares board and examiner reporting
- Handles bank-partner and investor due diligence
Need the CISO role filled? Both the FTC Safeguards Rule and NYDFS Part 500 allow the role to be held by a service provider, with your oversight. The Embedded tier includes a named CISO of record.
Next step
Book a discovery call
Thirty minutes. Bring the exam finding, the due diligence request, or the deadline, and we’ll work out what you actually need to do.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com