As mortgage lenders and servicers try to shore up their own systems against data security breaches, a new regulatory focus on the security practices of third-party vendors could be even more daunting.
A panel at the Mortgage Bankers Association's Mortgage Servicing conference examined the data security threats servicers need to address, and one glaring area of weakness was these vendor relationships. Specifically, the panel pointed to the guidelines from the New York Department of Financial Services on this issue that are voluntary now, but are likely — even highly likely — to be required in the near future.
"We talk to regulators every day and they have made very clear that they are looking at the security of these vendors," said Richard Hill, vice president of industry technology at the MBA and moderator of the panel.
Indeed, the NYDFS caused ripples of anxiety last April when they made it known that one in three banks don't even require their vendors to notify them of data security breaches, opening a potential "back door" into the banks' systems. The report revealed the dirty secret that has been keeping executives up at night for years — many lenders have no effective system in place to monitor their vendors' cybersecurity, nor any idea how to even start.
The panel's discussion acknowledged the complexity of monitoring vendors at such a micro level when many servicers (and one assumes, lenders) have multiple vendors covering various systems. Even those who are implementing programs with new vendors have to contend with a host of legacy vendors that may or may not still be connected to their systems.
The NYDFS has taken on this issue, issuing a proposal in November 2015 that outlines steps for an effective cybersecurity framework. From that proposal:
Second, third-party service providers often have access to sensitive data and to a financial institution’s information technology systems, providing a potential point of entry for hackers. A company may have the most sophisticated cyber security protections in the industry, but if its third-party service providers have weak systems or controls, those protections will be ineffective. Finally, the scale and breadth of the most recent breaches and incidents demonstrate that cyber security is a global concern that affects every industry at all levels.
There is a demonstrated need for robust regulatory action in the cyber security space, and the Department is now considering a new cyber security regulation for financial institutions.
The MBA panel encouraged servicers to pay very close attention to these "guidelines," which clearly lay the foundation for future regulation. Among the recommendations are a requirement to develop policies and procedures that address 12 areas, including vendor and third-party management. Within that area, the NYDFS outlines six specifics:
The policies and procedures would be required to include internal requirements for minimum preferred terms to be included in contracts with third-party service providers, including provisions requiring:
(1) the use of multi-factor authentication to limit access to sensitive data and systems;
(2) the use of encryption to protect sensitive data in transit and at rest;
(3) notice to be provided in the event of a cyber security incident;
(4) the indemnification of the entity in the event of a cyber security incident that results in loss;
(5) the ability of the entity or its agents to perform cyber security audits of the third party vendor; and
(6) representations and warranties by the third-party vendors concerning information security.
The guidelines also call for every financial company to designate a chief information security officer who would be required to submit annual reports to the NYDFS, and for companies to conduct annual penetration testing and quarterly vulnerability assessments.
It's not hard to see why servicers and lenders should pay attention to these sweeping "guidelines." The experts on the MBA panel urged servicers to do something — anything — to address these issues and offered several concrete ways to get started. The panel also warned that these types of checklist guidelines, while helping to keep servicers compliant, shouldn't be confused for an actual cybersecurity plan.
The members of the panel, which included Thomas Clerici, information security officer at Freedom Mortgage, Joseph Dombrowski, director, product manager and chief mortgage strategist at Fiserv, and Kevin Hayes, senior principal at the Promontory Financial Group, acknowledged that security breaches are more a matter of when, not if, and emphasized that the steps servicers take to follow these vendor guidelines before a breach could be a significant factor as regulatory bodies judge their safety.
