Cybersecurity compliance for regulated firms in Nevada

Three parts

What a complete answer covers in Nevada

In Nevada, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Nevada. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Nevada mortgage licensing is overseen by the Nevada Department of Business and Industry, Division of Mortgage Lending. Companies servicing Nevada residential mortgage loans need a Mortgage Servicer License from the Division of Mortgage Lending under NRS Chapter 645F (NRS 645F.510), applied for through NMLS (NRS 645F.540). Exemptions cover depository institutions and their subsidiaries and a small-portfolio carve-out for firms servicing ten or fewer residential loans a year (NRS 645F.500). Other licenses are overseen by other regulators and carry conditions of their own.
• What Nevada law says about protecting data. Nevada requires any data collector to implement and maintain reasonable security measures to protect records containing residents' personal information from unauthorized access, acquisition, destruction, use, modification or disclosure (NRS 603A.210), and to take reasonable measures to destroy such records when they are no longer needed (NRS 603A.200).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Nevada: Nevada is one of the few states that writes security standards directly into statute: NRS 603A.215 requires PCI DSS compliance for payment-card data and encryption whenever personal information is transmitted outside a company's secure system or moved on a data storage device beyond its control.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.