Ron and I are concerned many real estate agents do not understand the responsibly they take on when helping a client with their short sale submission package. In the normal course of our duties we do not handle a client's personal information such as SS#'s, bank statements, and tax returns. However, if a real estate agent helps a client assemble and submit a short sale package they likely have access and or possession of private information. The question is, "Are you compliant with regulations covering these actions?"
Below is a piece our friend Doug Farnam at Thomson Conant PLC, a Phoenix based law firm, wrote to help real estate agents performing this task.
_________________________________________________________________________________________
Short Sales and the Security Nightmare: Are You in Compliance?
Doug Farnam, Thomson Conant, PLC
Did you know that there are compliance regulations that now apply to you and your business as a result of collecting financial information to short sell a property?
Did you know that there is no limit on damages in a lawsuit relating to improper handling of confidential data?
Most loan originators that started offering loan modifications and short sale negotiations have come from a business environment that is highly regulated. Even though some mortgage lenders are not in compliance, they are aware of the rules associated with accepting sensitive client information. Most real estate professionals, however, have not had to deal with compliance regulation and processes such as DSS (Data Security Standard), DLP (Data Loss Prevention) and ILM (Information Lifecycle Management). These are more than just fancy terms. These processes apply to who has access to client information, for how long, how data is stored and disposed of, and can you show logs and security measures to establish compliance.
If ID theft is linked back to a leak at your company, are you prepared to establish how you have followed all required regulations? Can you produce a policies and procedures document and logs to show these regulations were followed? Before you tell yourself this could never happen at your business, think about this; cyber crime is growing at record pace and becoming more sophisticated each day. Even the largest companies with the biggest security budgets have been infiltrated. Although the economic return from hacking your computer may be small by comparison, your computer is an easy target. A hacker will always go after the low-hanging fruit first.
There is no way to guarantee your computer or office has not, or will not be compromised. Compliance is about minimizing that risk and being able to show that you did your due diligence to secure the data in the event of a breach.
Some things to consider even if you don’t store client information on your computer:
Email is not secure. Do not accept information by email. Additionally, if your email syncs to your phone you have just extended the endpoints of your data network and these devices should be encrypted. It is possible to have data stolen from your phone through a blue tooth connection without your knowledge and of course there is always the possibility of losing your phone.
Chat (messaging) programs are also not secure, they store a chat log on your computer, and are a common method hackers use to gain access to, or upload malware to your computer that will monitor of your activity.
Many lenders require information be entered into an online system (i.e. Equator). If your computer is compromised this data could be captured by hackers and sold to the highest bidder.
Required Regulations:
There are many regulations that apply when you start accepting sensitive client data. Most of these contain overlapping requirements. For many companies, following the PCI (Payment Card Industry) requirements covers the minimum requirements for many other regulations. Even if you do not accept or process credit cards, PCI is a well accepted standard and is very clear in its definitions. It is also well supported by numerous software programs for testing and report generation. As an alternative to PCI, ISO27001 is becoming an accepted standard. Because the data collected by a client relate to mortgage origination there are parts of SOX (Sarbanes Oxley) and GLBA (Gramm-Leach-Bliley Act) that could apply. But these last two are not as well defined as PCI or ISO27001 and are somewhat vague as to DSS requirements. FISMA is a government standard released by NIST (National Institute of Standards and Technology) that seems to have some teeth as far as enforcement and penalties.
Some states are adopting their own requirements, such as Massachusetts in the case of MA201. These state regulations can apply not only to companies based in that state, but to data stored relating to any consumers based in that state. There are also companies that can test and certify your company for compliance to any of these regulations.
In general these regulations cover requirements for properly configured firewalls, endpoint security, properly maintained anti-virus and anti-malware software, password minimum requirements, keycard access to rooms hosting computers and paper records, policies and procedures for ILM, logging requirements, all applications on the network must be tested to meet OWASP and SANS standards and wireless security.
You are responsible for the security of the data you receive from a client, even if you have a third party handle the negotiations and processing. It is imperative that you confirm that any software you use to process or any third party used to process this data meet these requirements.
Here are some links to help you with tracking and compliance:
PCI (Payment Card Industry) Compliance
Policies and Procedures Template for PCI
GLBA (Gramm-Leach-Bliley Act)
FISMA
ISO27001
MA201
MediationNet (Short sale software for attorneys and processors.)
After reading this, is there any wonder why The Urban Team has clients work directly with an attorney to prepare and submit the short sale package?
Gene Urban
The Urban Team at Realty Executives
602-234-5777
For more information about short sales in the Greater Phoenix area, visit our web site: www.Short-Sale-Phoenix.com
____________________________________________________________________________________________
The information in this post was provided by Thomson Conant, PLC. All opinions and advice are those of Thomson Conant PLC. They may be reached at 602-326-6552