Cybersecurity compliance for regulated firms in Virginia
Sooner or later someone asks your firm to demonstrate its security program: an examiner, an investor, a warehouse lender, an institutional client, or a buyer conducting due diligence. In Virginia, a complete answer has three parts.
What a complete answer covers in Virginia
In Virginia, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.
- The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
- What a license adds in Virginia. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Virginia mortgage licensing is overseen by the Virginia State Corporation Commission, Bureau of Financial Institutions. Virginia licenses mortgage lenders and mortgage brokers through NMLS under its Mortgage Lender and Broker Act (Va. Code §6.2-1600 et seq.), overseen by the State Corporation Commission's Bureau of Financial Institutions. The Act reaches making and brokering loans; servicing is not among the activities it names. Other licenses are overseen by other regulators and carry conditions of their own.
- What Virginia law says about protecting data. Virginia's Consumer Data Protection Act requires businesses to establish and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data (Va. Code §59.1-578(A)(3)). Financial institutions and data subject to the Gramm-Leach-Bliley Act are exempt from the Act at the entity level.
- Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.
General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.
When firms call us
Usually a regulated firm without a security function of its own.
- A client's security questionnaire has arrived with a deadline
- A renewal or examination is approaching, and the records are thin
- The firm needs a security program but not a $250,000 hire
How we help
Assess. Two weeks, for a fixed fee. We establish what your firm must have in place and where it falls short, and cite the source of each finding.
Remediate. We close the gaps in order of importance: policies written for how you operate, protections put in place, and vendors brought under oversight.
Operate. We then run the program throughout the year as your security and compliance function, for a monthly retainer.
Nearby: Delaware · Florida · Georgia · Maryland · North Carolina · all fifty states
Speak with the principal who would lead your engagement
A thirty-minute call. We reply within one business day, or the same day if you face a deadline.