Cybersecurity compliance for regulated firms in Alabama

Three parts

What a complete answer covers in Alabama

In Alabama, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Alabama. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Alabama mortgage licensing is overseen by the Alabama State Banking Department. Alabama has no standalone mortgage-servicer license. Servicing falls under the Alabama Consumer Credit Act (the 'Mini-Code'), which requires a Consumer Credit License from the State Banking Department's Bureau of Loans for making consumer loans or taking assignments of consumer credit contracts (Ala. Code §5-19-22), with banks, thrifts and credit unions exempt. Companies whose activity involves credit secured by residential real estate apply for and renew that license through NMLS. Other licenses are overseen by other regulators and carry conditions of their own.
• What Alabama law says about protecting data. Alabama's breach statute also serves as a security mandate. Every covered entity must implement and maintain reasonable security measures to protect sensitive personally identifying information, including designating an employee to coordinate security, identifying internal and external risks, adopting and assessing safeguards, and requiring service providers by contract to maintain appropriate safeguards (Ala. Code §8-38-3).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Alabama: Alabama was the last state to enact a breach-notification law (2018), and the law is demanding: a 45-day notice deadline, notice to the Attorney General when more than 1,000 residents are affected, and civil penalties for notification failures of up to $5,000 per day, capped at $500,000 per breach.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.