Adam Constantine on MLK Jr.’s impact on housing equality

During the interview, Constantine explains why the industry needs to focus on evoking intentional change rather than launching lackluster initiatives.

Navigating capacity concerns amidst record-high volumes

High loan volumes continues to loom large in the new year, making the “one-stop-shop” approach to the servicing and lending process even more appealing.

How servicers continue to protect neighborhoods amid COVID

We spoke with MCS CEO Caroline Reaves about self-service technology, the shift to virtual and how servicers can prepare for post-COVID success by improving processes today.

How student loan debt impact homeownership

Student loan expert Catalina Kaiyoorawongs shares her practical and tangible advice for people who feel overwhelmed by their student loan debt.

Mortgage

Get ready: Regulators are looking hard at cybersecurity of third-party vendors

What's voluntary today is going to be required tomorrow

As mortgage lenders and servicers try to shore up their own systems against data security breaches, a new regulatory focus on the security practices of third-party vendors could be even more daunting.

A panel at the Mortgage Bankers Association's Mortgage Servicing conference examined the data security threats servicers need to address, and one glaring area of weakness was these vendor relationships. Specifically, the panel pointed to the guidelines from the New York Department of Financial Services on this issue that are voluntary now, but are likely — even highly likely — to be required in the near future.

"We talk to regulators every day and they have made very clear that they are looking at the security of these vendors," said Richard Hill, vice president of industry technology at the MBA and moderator of the panel. 

Indeed, the NYDFS caused ripples of anxiety last April when they made it known that one in three banks don't even require their vendors to notify them of data security breaches, opening a potential "back door" into the banks' systems. The report revealed the dirty secret that has been keeping executives up at night for years — many lenders have no effective system in place to monitor their vendors' cybersecurity, nor any idea how to even start.

The panel's discussion acknowledged the complexity of monitoring vendors at such a micro level when many servicers (and one assumes, lenders) have multiple vendors covering various systems. Even those who are implementing programs with new vendors have to contend with a host of legacy vendors that may or may not still be connected to their systems. 

The NYDFS has taken on this issue, issuing a proposal in November 2015 that outlines steps for an effective cybersecurity framework. From that proposal:

Second, third-party service providers often have access to sensitive data and to a financial institution’s information technology systems, providing a potential point of entry for hackers. A company may have the most sophisticated cyber security protections in the industry, but if its third-party service providers have weak systems or controls, those protections will be ineffective. Finally, the scale and breadth of the most recent breaches and incidents demonstrate that cyber security is a global concern that affects every industry at all levels.

There is a demonstrated need for robust regulatory action in the cyber security space, and the Department is now considering a new cyber security regulation for financial institutions. 

The MBA panel encouraged servicers to pay very close attention to these "guidelines," which clearly lay the foundation for future regulation. Among the recommendations are a requirement to develop policies and procedures that address 12 areas, including vendor and third-party management. Within that area, the NYDFS outlines six specifics:

The policies and procedures would be required to include internal requirements for minimum preferred terms to be included in contracts with third-party service providers, including provisions requiring:

(1) the use of multi-factor authentication to limit access to sensitive data and systems;

(2) the use of encryption to protect sensitive data in transit and at rest;

(3) notice to be provided in the event of a cyber security incident;

(4) the indemnification of the entity in the event of a cyber security incident that results in loss;

(5) the ability of the entity or its agents to perform cyber security audits of the third party vendor; and

(6) representations and warranties by the third-party vendors concerning information security.

The guidelines also call for every financial company to designate a chief information security officer who would be required to submit annual reports to the NYDFS, and for companies to conduct annual penetration testing and quarterly vulnerability assessments.

It's not hard to see why servicers and lenders should pay attention to these sweeping "guidelines." The experts on the MBA panel urged servicers to do something — anything — to address these issues and offered several concrete ways to get started. The panel also warned that these types of checklist guidelines, while helping to keep servicers compliant, shouldn't be confused for an actual cybersecurity plan.

The members of the panel, which included Thomas Clerici, information security officer at Freedom Mortgage, Joseph Dombrowski, director, product manager and chief mortgage strategist at Fiserv, and Kevin Hayes, senior principal at the Promontory Financial Group, acknowledged that security breaches are more a matter of when, not if, and emphasized that the steps servicers take to follow these vendor guidelines before a breach could be a significant factor as regulatory bodies judge their safety. 

Most Popular Articles

CFPB Director Kathy Kraninger resigns at Biden’s request

Consumer Financial Protection Bureau Director Kathy Kraninger announced Wednesday she is resigning from her post at the request of President Joe Biden’s administration.

Jan 20, 2021 By

Latest Articles

HousingWire Lead Analyst featured on Bloomberg Radio

Logan Mohtashami doesn’t think rising home prices will lead to a market crash. Listen to his interview on Bloomberg Radio hosted by Paul Sweeney and Vonnie Quinn.

Jan 23, 2021 By
3d rendering of a row of luxury townhouses along a street

Log In

Forgot Password?

Don't have an account? Please