Cybersecurity compliance for regulated firms in Delaware

Three parts

What a complete answer covers in Delaware

In Delaware, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Delaware. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Delaware mortgage licensing is overseen by the Office of the State Bank Commissioner. The Office of the State Bank Commissioner licenses mortgage loan brokers (5 Del. C. ch. 21) and lenders under the Licensed Lenders law (5 Del. C. ch. 22, triggered by transacting 'the business of lending money'), both administered through NMLS. Servicing is not among the activities those chapters name. Servicing firms still answer to federal servicing and safeguards rules, and to Delaware's breach and data-security statute. Other licenses are overseen by other regulators and carry conditions of their own.
• What Delaware law says about protecting data. Delaware places the duty directly in its breach chapter. Any person who conducts business in the state and owns, licenses or maintains Delaware residents' personal information must implement and maintain reasonable procedures and practices to prevent its unauthorized acquisition, use, modification, disclosure or destruction (6 Del. C. §12B-100).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Delaware: Delaware's breach statute sets several requirements: notice to residents within 60 days of determining that a breach occurred, notice to the Attorney General whenever more than 500 Delaware residents are affected, and a full year of free credit monitoring for each resident whose Social Security number was exposed (6 Del. C. §12B-102).

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.