Financial institutions, and the firms that serve them
Regulators examine financial institutions on their security programs, and those institutions are required to oversee the vendors that handle their customers' information. We work on both sides of that relationship: for the institutions themselves, and for the law firms, technology providers and other vendors they rely on.
Banks, credit unions, lenders, servicers and other regulated financial firms
Few businesses carry as many regulatory obligations per employee, and everyone who deals with them knows it.
The situation
Each state license comes with its own security and breach-notification conditions, and no two states wrote them alike. At the federal level, the FTC Safeguards Rule (16 CFR 314) requires the firms it reaches to keep a written program, name a qualified individual responsible for it, and report to the board each year; investment advisers answer to the SEC's own safeguards and privacy rules. New York's regulation (23 NYCRR 500) goes further and requires a senior officer to certify compliance each year. Banks and credit unions answer to their prudential regulators instead: the interagency information-security guidelines, examined on the regulator's own schedule, with the board accountable for the program and for the third parties the institution relies on. Investors, warehouse lenders, subservicing partners and institutional clients send questionnaires of their own, and credit lines and contracts are renewed on the answers.
Examiners keep their own schedule. Telling one that the IT company handles security has never been a satisfactory answer.
What we do
- A state-by-state record of what you must do, with the rule behind each item
- Part 500 programs and annual certification, with evidence behind the signature
- The Safeguards Rule program: the risk assessment, the qualified individual's duties, and board reporting on schedule
- For banks and credit unions, the information-security program, board reporting and third-party oversight records in the form examiners expect
- Questionnaire and examination responses drawn from a maintained file
- Oversight of your own vendors, tiered and scheduled
Banks and credit unions
Examined on information security by your prudential regulator, with the board answerable for the program and for the vendors you rely on. We build the program, the board reporting and the third-party oversight records, and we answer the examiner's follow-up questions with you.
Mortgage lenders and servicers
Licensed in several states, examined by each of them, and reviewed by investors, warehouse lenders and subservicing partners. The area where most of our work lies.
Consumer lenders and finance companies
Federal security rules and your state licenses both apply. We establish which requirements reach your firm and build the program that meets them.
Investment advisers
Custodians, clients and examiners expect a documented program behind your safeguards and privacy obligations. We build it and keep it current.
Insurance agencies and brokers
State insurance data-security laws now require a written program, an incident plan and annual certification in many states. We run that program for you.
Payment, money-services and fintech firms
Licensed by the states, reviewed by bank partners and sponsors, and expected to show a program that matches the data you hold.
Collection, title and other licensed financial businesses
You hold consumer financial data in volume, your licenses carry security conditions, and your clients audit you. The work is the same: establish what applies, close what is missing, keep the records current.
Law firms, across practice areas
Clients now review their outside counsel the way they review any vendor that holds their confidential information. We help firms answer those reviews, and run the security program that stands behind the answers.
Practices that face client security reviews
- Banking and financial regulation
- Creditors' rights
- Default servicing and foreclosure
- Bankruptcy
- Collections
- Real estate
- Title and closing
- Consumer-finance compliance
- Litigation
- Corporate and M&A
- Securities
- Insurance
- Employment
- Trusts and estates
- Healthcare
- Privacy and data protection
And any other firm that holds client confidential information and is asked to show how it protects it.
The situation
Banks, lenders, insurers, healthcare organizations and corporate clients manage their law firms as vendors. That means security questionnaires of a hundred questions or more, outside-counsel guidelines with security terms, requests for named policies, annual reviews, and follow-up items with deadlines attached. Your matter files hold what those clients most want protected: customer and borrower data, deal documents, medical and employment records, family and estate papers.
An IT provider can keep the firm's systems running, but it is not equipped to answer a client's risk team. An unsatisfactory review can cost a firm a panel seat or a mandate.
What we do
- Answer client questionnaires and annual reviews from a file we keep current
- Build a security program suited to a law practice and its duties of client confidentiality
- Prepare incident-response plans that respect privilege and notification obligations
- Join the calls your clients' security teams request
- Report to the firm's leadership in plain terms
The other firms financial institutions rely on
Any firm that handles customer information for a financial institution will be asked to show how it protects that information. When your clients are regulated, their due diligence effectively becomes your compliance program. We build the records their questionnaires ask for.
Software, data and technology providers
Your clients' regulators hold them responsible for the systems you run. Their vendor reviews ask how you protect the data, and they expect evidence rather than assurances.
Title and settlement agents
Closing files contain the personal and financial data the privacy rules protect. Underwriters and lenders both check how you handle it.
Appraisal management and valuation firms
Lenders send you borrower and property data and expect it to be protected to their standard. Their vendor reviews will ask how you do it.
Property inspection and preservation firms
Work orders, photographs and borrower details pass through your systems, and servicers review the vendors who hold that information.
Outsourced servicing and processing firms
Call centers, document processors and fulfillment providers handle customer data at volume, and the institutions that outsource to you remain answerable for it.
Accounting, consulting and other professional firms
Any professional firm inside a financial institution's vendor-management program faces the same review. We prepare you for it and keep you prepared.
The firms we work best with
Large enough to be reviewed
Firms that are examined by their regulators, whose institutional clients audit their vendors, or that hold licenses in several states. The obligations arrived with growth. The security function often did not.
Facing a date
A questionnaire, an examination, a certification or a new client's review, with a deadline attached.
Serious about the result
Leaders who want a program that holds up when it is tested, and who regard paperwork without practice as a liability.
Tell us what is on your desk
A thirty-minute call. If your situation falls outside what we do well, we will say so.