Over 40 Years in BusinessISO 27001 compliantPublic sector: GSA · CMAS & TESMA (CA)
LA 562-298-5000 · Chicagoland 312-432-5300 · Phoenix 602-733-6807 · Client Support
Over 40 Years in BusinessISO 27001 compliantPublic sector: GSA · CMAS & TESMA (CA)
LA 562-298-5000 · Chicagoland 312-432-5300 · Phoenix 602-733-6807 · Client Support
Mortgage lenders, title agents, tax preparers, insurance agencies, RIAs, consumer lenders, fintechs and collection agencies all hold the data criminals want: Social Security numbers, income records, account details and wire instructions. Attackers know many of these firms are lean, and they time phishing and payment fraud for closings, month-end and tax season. Under the Gramm-Leach-Bliley Act (GLBA) and the rules built on it, regulators expect a written, working security program. BTI builds that program, runs it 24/7 and keeps the evidence ready.
This page is part of BTI's connected technology solutions and advisory services for financial services firms.
Get a Free Cybersecurity AssessmentBook an AI Opportunity AssessmentCall 800-435-7284
The GLBA Safeguards Rule covers non-depository financial institutions under FTC jurisdiction, including mortgage lenders and brokers, finance companies, tax preparers, collection agencies and many fintechs. It requires a qualified individual, a written risk assessment, access controls, encryption, MFA, monitoring or testing, training, vendor oversight and an incident response plan. The 2023 amendment, effective May 13, 2024, requires notifying the FTC within 30 days of discovering a notification event involving 500 or more consumers.
The GLBA privacy rule, Regulation P (12 CFR Part 1016), governs privacy notices and limits on sharing nonpublic personal information. BTI aligns access, retention and vendor controls with your notices.
For RIAs and broker-dealers, the 2024 Reg S-P amendments require a written incident response program, service provider oversight and customer notice within 30 days of a breach of sensitive customer information. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026.
Broker-dealers can map controls to FINRA's cybersecurity guidance on branch controls, vendor management and account takeover.
Licensed lenders, mortgage companies and insurers regulated by New York DFS fall under 23 NYCRR Part 500, with MFA, asset inventory, annual certification and 72-hour incident notice. BTI supports the controls and evidence.
Many states have adopted laws based on NAIC Model Law #668, requiring insurance licensees to maintain a security program, oversee third parties and notify regulators of cybersecurity events.
Title and escrow companies follow ALTA Best Practices; Pillar 3 calls for a written privacy and information security program to protect nonpublic personal information. BTI builds it and pairs it with wire fraud controls.
Approved seller/servicers must report cybersecurity incidents to Fannie Mae no later than 36 hours after identification, and to Freddie Mac within 36 hours of discovery, or immediately if origination or servicing systems are shut down. BTI builds those clocks into your incident response plan.
Publication 4557 explains how tax professionals safeguard taxpayer data and keep a written information security plan.
Impersonation detection, DMARC enforcement, out-of-band call-back verification for any wire or payment change, secure client portals for delivering instructions, and staff training based on FBI IC3 guidance.
A written program and risk assessment mapped to the rules that apply to you, and a virtual CISO who can serve as or support your qualified individual. → Cybersecurity assessment · vCISO · Governance, risk & compliance
BTI's 24/7 NOC/SOC partner backed by a SOC 2 audited operations center monitors endpoints, identity, email and network traffic: 10,000+ alerts handled, zero missed.
MFA everywhere, role-based access to the LOS and portals, e-signature and file-sharing controls, encryption and access reviews.
Immutable backups, tested restores and a plan aligned to CISA #StopRansomware, with every regulator and investor notice clock built in.
Evidence packages for regulators, examiners, cyber insurers, investors and client questionnaires. Our clients pass 94% of audits on the first attempt.
Your team sees AI in chat tools. They don't see the AI virtual workforce correlating alerts and spotting account takeover in real time. BTI is your Guided Automation Partner: AI-assisted monitoring, client data kept out of public AI tools, policy aligned to the NIST AI RMF. Guided Automation advisory services are included in all managed IT plans at no extra cost. AI tools are optional add-ons.
BTI supports many CPA, accounting and insurance firms and other financial services businesses.
GLBA requires a written information security program under the FTC Safeguards Rule, with a qualified individual, risk assessment, MFA, encryption, vendor oversight and incident response, plus privacy notices and sharing limits under Regulation P.
Yes. Non-depository mortgage lenders and brokers, finance companies, tax preparers and collection agencies are generally covered, and must report notification events involving 500 or more consumers to the FTC within 30 days.
A written privacy and information security program under ALTA Best Practices Pillar 3, plus wire fraud controls such as call-back verification, secure portals and email authentication.
The 2024 amendments require an incident response program, service provider oversight and customer notice within 30 days of a breach of sensitive customer information.
Yes. Seller/servicers must report cybersecurity incidents within 36 hours, and Freddie Mac requires immediate notice if origination or servicing systems are shut down.
It applies to many New York licensed lenders, mortgage companies and insurers. BTI helps confirm scope and supports the controls and annual certification.
Email authentication, impersonation detection, secure portals for wire instructions, mandatory call-back verification to known numbers and staff training.
Tell us about your sites and systems. An engineer replies within one business day on new design and technical sales inquiries.