Solutions / Financial & insurance offices
Protect client data the way your regulator expects.
Mortgage brokers, lenders and many financial advisers fall under the FTC Safeguards Rule, and a growing number of states apply data security laws to insurance agencies. We write the program, put the controls in place and keep the evidence ready.
- 9elements
- The Safeguards Rule expects in every program. We cover all of them.
- MFA
- Required for anyone who accesses customer information.
- 500people
- A breach this size has to be reported to the FTC within 30 days.
- 20min
- Is all we need from you to get started.
How it works
From first call to a program on file
Most of the work is ours. We need about 20 minutes from you to start, then a few short check-ins.
Your security program
Ready for an examiner or insurerWeek 1
20-minute call
Where client data lives: your loan or CRM system, email, shared drives and laptops.
Week 2
Program written
Risk assessment and written program, in your words, with your qualified individual named.
Weeks 3–4
Controls in place
Two-step login everywhere, encrypted laptops, logging and tested backups.
Every year
Reviewed and reported
Staff training, a refreshed risk assessment and the yearly report where it applies.
Questions from financial offices
What owners ask us first
We’re a small office. Does the Safeguards Rule apply?
If you broker or make loans, or offer other financial services to consumers, very likely yes. Firms holding data on fewer than 5,000 consumers are spared a few parts, like the yearly written report, but still need the program and the controls.
I run an insurance agency. Which rules apply to me?
Insurance is regulated by the states, and many have adopted data security laws based on the NAIC model, some with exemptions for small agencies. We work out what applies in your state and build to that.
We’re an SEC-registered adviser.
Then Regulation S-P applies rather than the FTC rule, and it now requires a written incident response program and notifying customers after a breach. We help you put that program in place.
Can you help with fake wiring instructions?
Yes. We make your email much harder to impersonate, watch for suspicious mailbox rules and set up a call-back rule for any change to payment details.
Other businesses we look after
- Tax preparers & CPA firmsFTC Safeguards Rule
- Medical & dental practicesHIPAA Security Rule
- Contractors & home servicesWebsite leads and payment fraud
- Manufacturers & distributorsRansomware and supplier requirements
- Retail shopsPCI DSS for card payments
- Restaurants & cafésPCI DSS for card payments
- Consultants & agenciesClient security questionnaires
- Salons, spas & gymsBooking and payment data
- Auto dealers & repair shopsFTC Safeguards Rule for dealers
- Nonprofits, schools & childcareDonor, family and student data
- Real estateWire fraud at closing
- Law firmsDuty of client confidentiality