Cybersecurity compliance for regulated firms in Massachusetts

Three parts

What a complete answer covers in Massachusetts

In Massachusetts, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Massachusetts. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Massachusetts mortgage licensing is overseen by the Massachusetts Division of Banks (Office of Consumer Affairs and Business Regulation). Massachusetts issues no mortgage-servicer license as such. A company that services loans owned by others must instead register with the Division of Banks as a Third Party Loan Servicer under Mass. Gen. Laws ch. 93, §24A (filings run through NMLS) and follow the servicing conduct rules in 209 CMR 18.00. Firms that also lend or broker on residential property need a separate Mortgage Lender or Mortgage Broker License under Mass. Gen. Laws ch. 255E. Banks and credit unions are exempt from the servicer registration. Other licenses are overseen by other regulators and carry conditions of their own.
• What Massachusetts law says about protecting data. Massachusetts has one of the most detailed state safeguards rules. Every person that owns or licenses personal information about a Massachusetts resident must develop, implement and maintain a comprehensive written information security program (WISP) with administrative, technical and physical safeguards (201 CMR 17.00, issued under Mass. Gen. Laws ch. 93H, §2).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Massachusetts: Massachusetts breach notices are unusual in what they must omit: the letter to residents may not describe the nature of the breach or the number of people affected. If Social Security numbers are involved, the company must offer at least 18 months of free credit monitoring (Mass. Gen. Laws ch. 93H, §§3, 3A).

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.