Cybersecurity compliance for regulated firms in Colorado

Three parts

What a complete answer covers in Colorado

In Colorado, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Colorado. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Colorado mortgage licensing is overseen by the Colorado Department of Law (Attorney General's Office), Consumer Credit Unit. Colorado regulates servicers through notification rather than licensing. The Colorado Nonbank Mortgage Servicers Act (Colo. Rev. Stat. §5-21-101 et seq.) requires servicers to file a notification with the Administrator in the Attorney General's office within 30 days of beginning to service Colorado residential mortgage loans, to renew it by January 31 each year, and to file annual reports. On the origination side, companies register with the Division of Real Estate as mortgage companies through NMLS, and their individual loan originators hold licenses. Other licenses are overseen by other regulators and carry conditions of their own.
• What Colorado law says about protecting data. Colorado requires every covered business to implement and maintain reasonable security procedures and practices appropriate to the personal information it holds, to impose the same duty on third-party service providers by contract, and to keep a written policy for destroying records containing personal information once they are no longer needed (Colo. Rev. Stat. §6-1-713.5, §6-1-713).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Colorado: Colorado's breach deadline is one of the shortest in the country: notice to residents, and to the Attorney General for breaches affecting 500 or more Coloradans, within 30 days. The Attorney General's office takes the position that federally regulated entities must also meet Colorado's shorter deadline when timelines conflict.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.