Brokerages, Title and Settlement
Security for title agents, settlement firms and brokerages
Closings move money and personal financial data through email. Settlement service providers are covered by the FTC Safeguards Rule, and lenders and underwriters ask about your controls. We help firms protect the transaction and document it.
- Federal rule
- FTC Safeguards Rule for settlement services
- Industry standard
- ALTA Best Practices
- Main threat
- Email compromise and wire fraud
- Where to start
- Email security and a written program
At a glance
Title agents and other real estate settlement service providers are financial institutions under the FTC Safeguards Rule, and lenders expect controls aligned with the ALTA Best Practices. CyberAccord helps these firms and the brokerages around them write a security program, protect email against wire fraud, manage devices and test their defenses.
FTC Safeguards Rule, 16 CFR Part 314
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Settlement services fall under the Safeguards Rule
The Safeguards Rule names entities that provide real estate settlement services, and mortgage brokers, as financial institutions. Covered firms need a written information security program with a Qualified Individual, a risk assessment, multi-factor authentication, encryption and oversight of service providers.
Source16 CFR 314.2 (FTC Safeguards Rule) (opens in a new tab)
Some breaches must be reported to the FTC
A covered firm must notify the FTC no later than 30 days after discovering that unencrypted customer information of at least 500 consumers was acquired without authorization. Closing files hold exactly the information this provision is about.
Source16 CFR 314.4(j), Notification to the Commission (opens in a new tab)
Lenders and underwriters expect ALTA Best Practices
The American Land Title Association publishes Best Practices for title and settlement companies, including guidance on a written information security program. Version 5.0 is now available, and lenders and underwriters use the framework when they review the agents they work with.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
- 2 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- 3 · Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
Frameworks that apply
FAQ
Sector questions, answered
How do we stop wire fraud on closings?
Use layered controls: multi-factor authentication and managed protection on every mailbox, a rule that wiring instructions are never changed by email alone, verbal confirmation with a number already on file, and clear warnings to buyers early in the transaction.
Are real estate brokerages covered by the Safeguards Rule?
It depends on the activity. Settlement services and mortgage brokering are named in the rule; a brokerage that only lists and sells property may not be. Either way, brokerages handle financial details and wire instructions, so the same controls are worth having.
What does an underwriter's security review usually ask for?
A written information security program, evidence of staff training, multi-factor authentication, secure handling of nonpublic personal information, and an incident response plan. We help you gather that evidence and close any gaps.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.