Cybersecurity compliance for regulated firms in Vermont

Three parts

What a complete answer covers in Vermont

In Vermont, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Vermont. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Vermont mortgage licensing is overseen by the Vermont Department of Financial Regulation. Vermont has a standalone servicer regime. No person may act as a third-party loan servicer, directly or indirectly, for a loan to a Vermont borrower without a Loan Servicer License from the Department of Financial Regulation under 8 V.S.A. § 2901 (Chapter 85), obtained through NMLS. Exemptions cover depository institutions and Vermont-licensed lenders that retain servicing rights on loans originally closed in their own name. Other licenses are overseen by other regulators and carry conditions of their own.
• What Vermont law says about protecting data. Vermont's Document Safe Destruction Act requires businesses to take all reasonable steps to destroy customer records containing personal information, by shredding, erasing or otherwise making them unreadable, once the records are no longer retained (9 V.S.A. § 2445). GLBA-regulated financial institutions supervised by federal regulators or DFR are exempt.
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Vermont: Vermont's Security Breach Notice Act sets two deadlines. A preliminary description of the breach is due to the Attorney General within 14 business days of discovery, one of the fastest regulator-notice deadlines in the country, and consumer notice is due within 45 days. DFR-regulated firms such as licensed loan servicers send their notices to the Department of Financial Regulation instead of the Attorney General.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.