Insurance, real estate, and mortgage
Offices that move money and personal data, set up so the answers are true.
Agencies, brokerages, and mortgage shops hold driver's license numbers, bank details, and closing dates for every client. Carriers ask what protects that data, and for mortgage brokers a federal rule spells it out. We put the controls in place and keep the proof.
What each kind of office gets asked
Mortgage brokers and lenders that are not banks fall under the FTC Safeguards Rule, the same rule that covers tax preparers and most dealers that arrange financing. It asks for one named person responsible for customer data, two-step login, encryption, access controls, and staff training. Firms with records on 5,000 or more people also need a written risk assessment, an incident plan, and a yearly report. Our compliance point person add-on, which would hold that named role in writing, is paused for new sign-ups while we finish reviewing its terms. Until then we help with the technical work while someone at your firm holds the role.
Independent insurance agencies answer the same technical questions twice, once in carrier agreements and once on their own cyber insurance application. Is two-step login on for email and the agency management system. Are backups kept off-site and tested. Is staff trained to spot fake emails. Are former producers shut off the day they leave. A yes that is not true is a problem on the day a claim is filed.
Real estate brokerages carry the wire fraud risk. Someone who gets into one agent's email can watch a deal for weeks, then send changed wiring instructions the day before closing. Two-step login on every account, filtering that flags lookalike senders, and a rule that wiring instructions are confirmed by phone make that scheme much harder to pull off.
What we put in place
In plain words, and written down so you can show it.
Two-step login everywhere a client record lives
Email, the agency management or loan software, carrier portals, and the MLS.
Fake-email filtering and a wire fraud session
Lookalike senders flagged, and staff who know to confirm wiring changes by phone.
Encrypted laptops for producers and agents on the road
A lost laptop stays a hardware loss.
Backups with a test restore
Client files and email copied off-site and restored on a schedule you can show.
A proof folder and a named person responsible
Screenshots and settings that back every yes on the application, and the Safeguards paperwork for mortgage shops.
How we usually help
Pick one project or let us look after all of it every month.
Who we fit, and who we don't
Honest on purpose, so nobody wastes a call.
We fit
- Independent agencies, brokerages, and mortgage shops, with larger offices reviewed before we quote
- Offices on Microsoft 365 and cloud agency, loan, or transaction software
- Owners who want the application to be true, not just signed
We don't fit
- Firms that want their in-house IT team replaced without a review. We can take on defined work alongside that team instead.
- Insurance, lending, or legal advice. You know your business. We make sure the controls behind it are real.
Questions owners ask
Does the Safeguards Rule really apply to a small mortgage broker?
The FTC lists mortgage brokers as financial institutions under the rule, whatever their size. What changes with size is the paperwork. Under 5,000 customer records, the written risk assessment, incident plan, and yearly report are not required, but the controls still are. Our Safeguards Rule checklist is written for tax firms and walks through the same nine elements.
Who can be the named person responsible?
Anyone you designate, including someone outside the firm, as long as your firm keeps responsibility and a senior person oversees it. The compliance point person add-on is paused for new sign-ups while we finish reviewing its terms. Until then we do the technical work behind the role while someone at your firm holds it.
We are an insurance agency. Why would we need help with a cyber application?
Because the application asks technical questions in insurance language, and the answers have to be true on the day of a claim. We check each one against what is actually in place.
Our agents are independent and use their own laptops. Can you still help?
Yes. The office accounts, email, Wi-Fi, cameras, and doors are the brokerage's. For agent laptops we offer the same setup and the password manager, and the training covers everyone.
What is the single most important fix for wire fraud?
Two rules together. Two-step login on email, which blocks most password break-ins, and a call-back rule that confirms every wiring change on a number already on file. See email fraud protection.
What does it cost?
Cyber insurance readiness from $1,500, Microsoft 365 setup and hardening from $1,200 for up to 10 people, and staff training $150 remote or $250 on-site. Everything is on the pricing page.
Ask a quick question, get a straight answer
Three fields. You hear back the same business day by text or email, whichever you give us.
Stop being your own IT person.
Tell us what's bugging you. In 15 minutes you'll know what it takes to fix and roughly what it costs.