Why the Safeguards Rule belongs with management
Ask a nonbank lender or servicer who handles the Safeguards Rule, and the answer is usually the name of its IT company. It is an understandable answer. It is also how many Safeguards findings begin.
What the rule requires
The amended Safeguards Rule (16 CFR 314) contains technical requirements: encryption, multi-factor authentication, access controls, monitoring and secure disposal of data (§314.4(c)). An IT provider can implement most of them, and a good one already has.
The elements that give the rule its structure are another matter:
- A qualified individual responsible for the program (§314.4(a)). This is a management appointment, and the accountability that comes with it cannot be outsourced.
- A written risk assessment with defined criteria (§314.4(b)). It is a judgment about your business and where it is exposed. An outside IT firm cannot write it for you, because it does not know how your loans are boarded, who your subservicers are or which vendors you depend on.
- Selection and oversight of service providers (§314.4(f)). Read closely, this requires someone inside the firm to oversee the IT provider itself. A provider cannot oversee its own work.
- A written incident response plan (§314.4(h)) that contains business decisions: who calls the regulator, who calls the client, and who decides to take a system offline during month-end remittance.
- An annual written report to the board or senior officers (§314.4(i)), which is governance by definition.
The structural point: at least four of the rule's core elements require someone outside the technology function to assess that function and report on it. Assigning the whole rule to the technology function leaves it overseeing itself.
How the problem appears
The pattern is a familiar one. The firm's technology is sound: patched, backed up and protected by multi-factor authentication. The program around it does not exist. There is no qualified individual, no written risk assessment, no vendor oversight file and no board report. When an examiner or a client's risk team asks its first four questions, all four fall into the missing half.
That is why "our IT company handles it" fails due diligence even when the IT company is excellent. The questionnaire is not asking whether the firewall works. It is asking who governs the program, on what evidence, and where the records are kept.
What works
The arrangement that works is a clear division of labor. The IT provider runs the infrastructure and implements the controls. A qualified individual, on staff or engaged from outside, owns the risk assessment, the policies, vendor oversight, the business decisions in the incident plan and the board report. Each side produces records the other cannot: technical records from one, governance records from the other. Together they answer the whole questionnaire.
The rule was amended to require exactly this arrangement. Firms that adopt it stop treating the Safeguards Rule as an annual scramble, because the program keeps its own records as it runs.
Crucible Cybersecurity Compliance provides security and compliance services and does not provide legal advice. Regulatory citations are provided for reference; consult counsel on legal questions.