Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Mortgage software should be evaluated as a regulated third-party service, not as an ordinary business app. The lender remains responsible for protecting nonpublic personal information and loan data, even when a vendor hosts, processes, or supports the system. A defensible evaluation maps every data flow, rates the sensitivity and criticality of each workflow, examines independent evidence, tests resilience and incident handling, and puts enforceable obligations into the contract. A SOC 2 or ISO 27001 certificate can help, but neither proves that a product is safe for your particular mortgage operation without reviewing scope, testing exceptions, access controls, subprocessors, recovery capabilities, and exit procedures.
What does secure, compliant mortgage software actually mean?
Secure mortgage software protects borrower information throughout its life cycle: collection, underwriting, transmission, storage, use by employees and support staff, sharing with subprocessors, backup, retention, return, and deletion. Compliance is broader than encryption or a certification logo. It means the lender can show that it identified risks, selected controls proportionate to those risks, checked that the controls work, monitored changes, and can respond when something fails.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMortgage platforms commonly handle names, addresses, Social Security numbers, income records, tax documents, bank statements, credit reports, employment data, property records, loan decisions, and communications. A compromise can create identity-theft exposure, privacy violations, missed disclosures, inaccurate underwriting, servicing disruption, or consumer harm. The right question is therefore not simply “Does this vendor have SOC 2?” but “Can this vendor’s controls and contract support our information-security and consumer-compliance obligations for the exact workflows we will run?”
Which laws and supervisory frameworks should guide the review?
Use the following authorities as a control map. They overlap, but each highlights different responsibilities and evidence.
#1 Best Overall
| Authority or framework | What it expects a lender to do |
|---|---|
| Federal Reserve Interagency Guidelines Establishing Information Security Standards | Identify and evaluate threats; assess likelihood and potential damage; determine whether controls are sufficient; mitigate risks; test the program; update it; and contractually require service providers with access to customer information to protect confidentiality and properly dispose of information. |
| FTC Safeguards Rule | Maintain a written information-security program with administrative, technical, and physical safeguards appropriate to the institution’s size, complexity, activities, and data sensitivity. The 2023 amendment added certain breach-reporting duties effective May 2024. |
| CFPB CMS-IT examination procedures | Expect oversight of board and management, the compliance program, service providers, violations of law, consumer harm, and documented examination conclusions. |
| FFIEC Development, Acquisition, and Maintenance booklet (updated September 29, 2024) | Address governance, risk management, secure and resilient business services, and change management when developing, buying, or maintaining technology. |
| NIST SP 800-37 Rev. 2 Risk Management Framework | Categorize systems and information; select and implement controls; assess controls; authorize operation; and continuously monitor. |
| New York Department of Financial Services Part 500 | For New York-regulated entities, maintain risk-based third-party policies covering provider identification, minimum practices, due diligence, periodic assessment, multifactor authentication, encryption, and event notification. |
| NYDFS Guidance on Managing Risks Related to Third-Party Service Providers (October 21, 2025) | Evaluate access, data sensitivity, provider criticality, encryption, segmentation, SOC 2 or ISO 27001 attestations, penetration-test summaries, vulnerability remediation, subcontractors, data location, incident response, continuity, and secure offboarding. |
These frameworks do not transfer accountability to the software company. They require a risk-based program in which management can explain why a vendor is suitable, what safeguards apply, how the lender verifies them, and what happens when the relationship or the technology changes.
How do I build a data and workflow inventory before contacting vendors?
Start with an inventory that follows information rather than product names. A vendor cannot be evaluated accurately until you know what the system will do and which data it will touch.
List each mortgage workflow
- Lead capture, applications, borrower portals, and document collection.
- Credit ordering, income and asset verification, fraud checks, underwriting, and automated decisioning.
- Disclosure generation, e-signature, pricing, closing, post-closing quality control, and servicing handoffs.
- Integrations with loan-origination systems, appraisal and settlement providers, credit bureaus, investor portals, accounting systems, email, and identity services.
- Administrative support, implementation, troubleshooting, analytics, artificial-intelligence features, exports, and data migrations.
Map every data state and recipient
For each workflow, record what is collected, generated, transmitted, stored, cached, logged, printed, exported, backed up, and deleted. Identify the hosting regions, disaster-recovery regions, subprocessors, customer administrators, vendor support personnel, application programming interfaces, and any machine-learning or artificial-intelligence service that receives data. Include whether support staff can view full loan files, whether logs contain personal information, and whether backups remain after production deletion.
Rate sensitivity and criticality
Classify the information by sensitivity (for example, identity data, financial records, credit data, authentication secrets, or public information) and the workflow by business criticality. A portal holding complete borrower files and an underwriting decision deserves more stringent controls and recovery commitments than a low-risk marketing form. Record the effect of confidentiality, integrity, or availability failure on borrowers, regulatory deadlines, funding, and fair-lending or disclosure processes.
How should I turn the inventory into a documented risk assessment?
Use a repeatable method instead of a one-time questionnaire. NIST’s framework provides a practical sequence, while the Federal Reserve guidance requires the institution to connect threats, potential damage, controls, testing, and updates.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
- Categorize. Assign each system and information set a sensitivity and criticality level. Note dependencies such as identity providers, APIs, document storage, and telecommunications.
- Identify threats and failure modes. Consider credential theft, excessive employee access, ransomware, malicious insiders, exposed APIs, vulnerable dependencies, cloud-region outages, bad releases, subprocessor incidents, and accidental deletion.
- Estimate likelihood and impact. Evaluate the plausible frequency of each event and the effect on confidentiality, integrity, availability, consumers, legal obligations, and business continuity.
- Select controls. Choose preventive, detective, corrective, and compensating controls that match the rating. Document why a control is sufficient or why a residual risk is accepted.
- Assess evidence. Review independent reports, configuration evidence, test results, policies, and contract language. Record exceptions, management responses, remediation owners, and due dates.
- Authorize the use. Obtain approval from the responsible business, security, compliance, and risk owners before production use. Approval should state the service, data, environment, conditions, and unresolved risks.
- Monitor and update. Reassess on a defined schedule and after material changes such as a new subprocessor, major feature, acquisition, incident, control exception, or change in the data handled.
What security evidence should a mortgage-software vendor provide?
Ask for evidence that is specific to the service and its current operating environment. A polished questionnaire or a certification badge is not a substitute for scope, dates, exceptions, and control ownership.
Architecture and data-flow evidence
- A current architecture diagram and written data-flow description.
- Types of borrower and loan data processed, storage and processing regions, backup locations, and retention periods.
- All subprocessors, their functions, locations, access paths, and change-notification process.
- Isolation design for tenants, environments, databases, object storage, queues, and logs.
Independent assurance reports
Obtain the latest SOC 2 Type II report or ISO 27001 evidence where available. Read the report’s service scope, control period, testing exceptions, complementary user-entity controls, management response, and remediation plan. Confirm that the report covers the product, hosting environment, support operation, and regions your lender will use; a parent-company certificate or a logo on a sales page may cover something else.
Identity and access controls
- Least-privilege roles, separation of duties, privileged-access approval, and periodic access reviews.
- Joiner, mover, and leaver procedures, including rapid revocation for terminated or transferred staff.
- Multifactor authentication for workforce, administrator, support, and remote access. The FTC Safeguards Rule and NYDFS Part 500 materials specifically identify MFA or equivalent protection for access to customer information.
- Customer-administrator controls, session timeouts, password and authentication policy, service-account restrictions, and support-session logging.
Encryption and key management
Confirm encryption in transit and at rest, including exports, backups, logs, and temporary files. Ask who owns and administers keys, how keys are rotated and revoked, how secrets are stored, and whether one tenant can ever use another tenant’s key or storage path. Clarify how paper records and downloaded files are protected because encryption of the hosted application does not secure an employee’s local copy.
Secure engineering and vulnerability management
- Secure-development lifecycle requirements, code review, dependency inventory, and software-supply-chain controls.
- Penetration-test summary, test scope and date, material findings, and remediation status.
- Vulnerability scanning, severity definitions, patch service-level agreements, emergency-change procedures, and evidence that critical findings are closed.
- Production-change approvals, separation of development and production, rollback procedures, and customer notice for material changes.
Monitoring and incident response
Review monitoring coverage for authentication, privilege changes, data access, exports, administrative actions, API abuse, and infrastructure events. Request alert-triage procedures, incident playbooks, forensic-preservation practices, customer and regulator notification timelines, investigation cooperation commitments, and results from tabletop or recovery exercises. Notice obligations should cover incidents at the vendor and relevant subprocessors, not only events confirmed by the vendor’s own employees.
Resilience and continuity
Compare the vendor’s stated availability, recovery-time objective, and recovery-point objective with the mortgage workflow’s deadlines and funding consequences. Examine backup immutability, geographic redundancy, restoration testing, disaster-recovery test results, dependency mapping, and manual fallback procedures. A backup that has never been restored, or a recovery promise that excludes a critical subprocessor, is not an adequate continuity plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which contract terms make the controls enforceable?
Policies describe intentions; the agreement determines what the lender can require, verify, and recover. Security language should match the vendor’s actual environment and the data map rather than promise an undefined “industry standard.”
- Security representations: Identify the controls the vendor will maintain, the environments covered, and the standards or policies used.
- MFA and encryption: Specify covered users and systems, encryption requirements, key-management responsibilities, and treatment of backups, exports, and logs.
- Incident notice: Set a deadline, required contents, update cadence, evidence preservation, regulator and law-enforcement cooperation, and assistance with borrower communications. Include relevant subprocessor incidents.
- Audit and assurance: Give the lender and its regulators access to current SOC 2 or ISO 27001 evidence, penetration-test summaries, remediation updates, and reasonable audit rights when risk warrants.
- Subprocessors: Require disclosure, security obligations flowing down, advance notice of material changes, and an approval or objection process.
- Data location and transfers: Identify storage and processing regions, cross-border transfer restrictions, and notice before a material location change.
- Service levels and recovery: Define availability, support response, recovery-time and recovery-point commitments, maintenance notice, service credits or other remedies, and testing obligations.
- Vulnerability remediation: Set severity-based correction deadlines, emergency patch procedures, disclosure of material findings, and cooperation with the lender’s risk assessments.
- Insurance: Request evidence of cyber-insurance coverage where appropriate, while recognizing that insurance does not replace controls or notification duties.
- Use, retention, and artificial intelligence: Limit permitted uses, prohibit training or secondary use of borrower data unless expressly authorized, define legal holds, and state retention schedules.
- Exit: Specify a usable return or migration format, assistance and timing, deletion of production and backup copies, certificate of deletion, access revocation, and treatment of data held by subprocessors.
How do I compare two or more mortgage-software vendors?
Use one scoring model for every finalist, but weight the categories according to the workflow. A system that originates, stores, or transmits complete loan files or underwriting decisions should receive heavier security and resilience weighting than a peripheral tool.
| Evaluation axis | Evidence to score |
|---|---|
| Assurance scope and exceptions | Current SOC 2 Type II or ISO 27001 evidence, covered service and period, testing exceptions, complementary user-entity controls, and remediation. |
| Identity and tenant isolation | Role design, privileged-access reviews, MFA, support access, session logs, and technical separation between customers. |
| Encryption and key control | Transit and rest coverage, key ownership and rotation, secrets management, backups, exports, and logs. |
| Secure development and patching | Lifecycle documentation, dependency management, penetration-test findings, patch deadlines, and change approvals. |
| Incident response | Detection coverage, triage, forensics, notification deadline, subprocessor handling, exercises, and regulator cooperation. |
| Recovery and resilience | Availability, recovery-time and recovery-point objectives, immutable backups, redundancy, restoration tests, and manual fallback. |
| Privacy and data location | Permitted uses, AI restrictions, retention, legal holds, processing regions, transfer controls, and deletion practices. |
| Subprocessor governance | Complete inventory, security flow-down, notice, approval or objection rights, and oversight evidence. |
| Integration and least privilege | API scopes, service accounts, token rotation, inbound and outbound data minimization, and administrative boundaries. |
| Auditability | Logs, exportable evidence, report access, audit rights, and support for regulatory examinations. |
| Contract flexibility | Ability to negotiate security, notification, recovery, location, subprocessor, audit, and exit terms. |
| Implementation effort and total cost | Migration, configuration, training, integration, ongoing assurance, and exit costs considered alongside risk. |
| Exit portability | Documented export format, migration assistance, deletion certification, backup treatment, and termination access controls. |
Score evidence quality separately from a vendor’s written promise. For example, a tested control with a recent report should outrank an unverified assertion, even if both vendors describe the same control in a questionnaire. Keep the scoring rationale and unresolved risks with the approval record so a later reviewer can understand the decision.
What is different for a New York-regulated lender?
New York-regulated entities must apply the risk-based third-party requirements in Part 500, including provider identification, minimum security practices, due diligence, periodic assessment, MFA, encryption, and event notification. The NYDFS third-party guidance issued October 21, 2025 adds practical review areas: access, data sensitivity, provider criticality, segmentation, attestations, penetration-test summaries, vulnerability remediation, subcontractors, data location, incident response, continuity, and secure offboarding.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThose requirements do not make a certification automatically sufficient. The covered entity still has to evaluate and mitigate cybersecurity risks relevant to its own business, document the reasoning, and ensure its contract and oversight program address the actual service and data involved.
Rank #4
What should happen after the vendor is approved?
Approval is the start of oversight, not the end. Assign an accountable owner and maintain a review calendar tied to the service’s criticality.
- Review assurance reports and material exceptions when issued, not only at renewal.
- Track open vulnerabilities, remediation deadlines, incidents, changes in subprocessors, hosting regions, and artificial-intelligence features.
- Revalidate user roles, privileged access, MFA coverage, API permissions, and support-session records.
- Test restoration, business continuity, manual fallback, and contact trees at a frequency appropriate to the workflow.
- Reassess after a significant incident, acquisition, architecture change, new data type, major release, or regulatory change.
- Report material risk, exceptions, and consumer impact to the appropriate management or board committee.
What are the most common evaluation mistakes?
Relying on a badge
A certification can be real and still omit the product, region, support team, or period you use. Read the scope and exceptions before treating it as evidence.
Ignoring support and subprocessors
Borrower data may be exposed through troubleshooting tools, call centers, analytics, email delivery, document services, or cloud providers. Include those paths in the data map and contract.
Checking prevention but not recovery
Strong access controls do not prevent every outage or destructive attack. Without tested restoration, defined recovery objectives, and a workable manual process, a security event can become a missed disclosure, funding, or servicing problem.
Leaving exit terms vague
“Data will be returned on request” does not define format, timing, backup deletion, migration assistance, or certification. Negotiate those details before the first loan file enters the platform.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Failing to connect security to consumer compliance
CFPB CMS-IT procedures direct attention to service-provider oversight, violations of law, and consumer harm. A vendor outage or inaccurate system change can therefore require compliance escalation even when no data was stolen.
What should a practical approval file contain?
Maintain a single record that lets management, internal audit, and examiners reconstruct the decision. It should contain the workflow and data inventory, risk rating, completed questionnaire, architecture and data-flow documents, assurance reports, exceptions and remediation, test results, subprocessor list, contract and negotiated addendum, approval conditions, monitoring schedule, incident contacts, continuity evidence, and exit plan. Record who approved the residual risk and when the next review is due.
Free tools Windows power users keep installed
One-click scans. No signup required.
The result should be an evidence-backed decision: approved, approved with conditions and a remediation deadline, or rejected until specified gaps are closed. That discipline is more valuable than selecting a vendor solely because it advertises a familiar compliance term.
Frequently Asked Questions
Does a SOC 2 report prove that mortgage software meets GLBA requirements?
No. SOC 2 describes controls tested against the report’s scope and period, while GLBA safeguards obligations apply to the lender’s own information-security program. Use the report as evidence, then verify complementary lender controls, product coverage, exceptions, and contract duties.
How often should a lender reassess a mortgage-software provider?
Set a periodic review interval based on data sensitivity and workflow criticality, and trigger an out-of-cycle review after an incident, material architecture or subprocessor change, major release, acquisition, or new data use. High-criticality systems generally warrant more frequent evidence and recovery testing than peripheral tools.
What if a small vendor cannot provide a SOC 2 or ISO 27001 report?
Ask for equivalent evidence: an independent penetration-test summary, security policies, access and MFA records, vulnerability metrics, incident exercises, recovery-test results, architecture and subprocessor details, and management’s remediation commitments. The absence of a certification increases the importance of validating controls directly and documenting any accepted residual risk.
Recommended Free Tools
What format should mortgage data be returned in when a contract ends?
Specify a documented, machine-readable format that preserves borrower files, metadata, audit history, relationships, and timestamps needed for operations and legal records. Also define migration assistance, retrieval deadlines, backup and subprocessor deletion, a deletion certificate, and the point at which vendor and support access is revoked.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
