Skip to content

Solutions / Financial & insurance offices

Protect client data the way your regulator expects.

Mortgage brokers, lenders and many financial advisers fall under the FTC Safeguards Rule, and a growing number of states apply data security laws to insurance agencies. We write the program, put the controls in place and keep the evidence ready.

9elements
The Safeguards Rule expects in every program. We cover all of them.
MFA
Required for anyone who accesses customer information.
500people
A breach this size has to be reported to the FTC within 30 days.
20min
Is all we need from you to get started.

How it works

From first call to a program on file

Most of the work is ours. We need about 20 minutes from you to start, then a few short check-ins.

Your security program

Ready for an examiner or insurer
  1. Week 1

    20-minute call

    Where client data lives: your loan or CRM system, email, shared drives and laptops.

  2. Week 2

    Program written

    Risk assessment and written program, in your words, with your qualified individual named.

  3. Weeks 3–4

    Controls in place

    Two-step login everywhere, encrypted laptops, logging and tested backups.

  4. Every year

    Reviewed and reported

    Staff training, a refreshed risk assessment and the yearly report where it applies.

Questions from financial offices

What owners ask us first

We’re a small office. Does the Safeguards Rule apply?

If you broker or make loans, or offer other financial services to consumers, very likely yes. Firms holding data on fewer than 5,000 consumers are spared a few parts, like the yearly written report, but still need the program and the controls.

I run an insurance agency. Which rules apply to me?

Insurance is regulated by the states, and many have adopted data security laws based on the NAIC model, some with exemptions for small agencies. We work out what applies in your state and build to that.

We’re an SEC-registered adviser.

Then Regulation S-P applies rather than the FTC rule, and it now requires a written incident response program and notifying customers after a breach. We help you put that program in place.

Can you help with fake wiring instructions?

Yes. We make your email much harder to impersonate, watch for suspicious mailbox rules and set up a call-back rule for any change to payment details.