Mortgage lenders and servicers

Documents to review

• WISPDraft wording checks available
• Information security programDraft wording checks available
• Incident response planDraft wording checks available
• Risk assessmentDraft wording checks available
• Retention disposal policyDraft wording checks available
• Identity theft prevention programDraft wording checks available
• Servicing policyResearch document type
• Complaint procedureResearch document type

Scope questions

Industry alone does not establish legal applicability. Confirm location, activities, role, data and relevant thresholds.

• Card issuer

  Whether the organization issues debit or credit cards within § 681.2.

• Consumer information held for business purpose

  Whether the organization maintains or possesses consumer information, as defined in § 682.1, for a business purpose.

• Consumers represented in maintained customer information

  Number of consumers whose customer information the institution maintains; used only for the limited 16 CFR 314.6 exceptions.

• Covered accounts

  Whether the organization offers or maintains one or more covered accounts after the required risk assessment.

• Covered-account service providers

  Whether service-provider arrangements involve covered-account activity.

• Develops covered applications in house

  Whether the institution develops applications used to transmit, access, or store customer information.

• Effective continuous monitoring

  Whether effective continuous monitoring or equivalent ongoing detection covers information-system vulnerability changes.

• FTC FCRA enforcement

  Whether the organization is a financial institution or creditor subject to FTC administrative enforcement under the cited FCRA provision. Human legal confirmation is required.

• FTC jurisdiction

  Whether the organization is a person over which the FTC has jurisdiction. This legal conclusion requires human confirmation.

• Qualified Individual arrangement

  One of INTERNAL, AFFILIATE, or SERVICE_PROVIDER.

• Subject to FTC Safeguards Rule

  Whether Part 314 applies to the organization.

• Uses covered externally developed applications

  Whether externally developed applications transmit, access, or store customer information.

Unknown answers stay unresolved. Document detection does not answer these questions for you.