Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Evaluate mortgage software as a regulated third-party service, not as an ordinary business app. Before signing, map every borrower and loan data flow, match each workflow’s sensitivity and business criticality to specific safeguards, inspect independent assurance and test evidence, and negotiate enforceable rights for incident notice, audits, resilience, subprocessors, and secure data return or deletion. A SOC 2 or ISO 27001 badge can help, but it is not proof by itself: scope, testing period, exceptions, complementary customer controls, and remediation matter.
The lender remains accountable for its information-security and consumer-compliance program even when a vendor hosts the system. The practical objective is a documented decision showing why the controls, contract, monitoring, and exit plan are adequate for the mortgage data the service handles.
As an Amazon Associate I earn from qualifying purchases.
What data and workflows must you assess first?
Start with an inventory that follows information through the mortgage lifecycle. Classify not only database records, but also files, messages, exports, logs, backups, support sessions, and copies held by subprocessors.
Build a data-flow map
- Collected: applications, identity details, income and employment records, assets, liabilities, credit information, property documents, signatures, and communications.
- Generated: underwriting decisions, eligibility results, disclosures, audit trails, risk scores, task histories, and reports.
- Transmitted: borrower portals, APIs, document exchanges, email or messaging integrations, credit-data connections, and internal interfaces.
- Stored: production databases, object storage, search indexes, caches, logs, snapshots, archives, and disaster-recovery copies.
- Accessed: loan officers, processors, underwriters, administrators, vendor support staff, developers, and automated services.
- Shared: named subprocessors, hosting providers, analytics services, payment or identity providers, and regulators or business partners.
- Retained and deleted: normal retention periods, legal holds, backup expiry, tenant deletion, and copies in support or test environments.
Record the hosting regions and cross-border transfers, the systems that originate or store complete loan files, and the workflows whose interruption could delay disclosures, underwriting, closing, servicing, or required consumer responses.
#1 Best Overall
Rate sensitivity and criticality separately
Sensitivity asks what harm could result from unauthorized disclosure or alteration. Criticality asks what happens if the service is unavailable or produces unreliable results. A document vault may have extreme confidentiality requirements; an underwriting decision engine may also have high integrity and availability requirements. Use both ratings to determine the depth of evidence, testing, contractual protection, and ongoing monitoring.
Which laws and supervisory frameworks shape the review?
No single certification makes a mortgage platform compliant. Your review should show how the vendor supports the institution’s obligations under the frameworks that apply to your charter, products, and geography.
Federal Reserve interagency information-security guidelines
The interagency guidelines require a financial institution to identify and evaluate threats, assess likelihood and potential damage, determine whether controls are sufficient, mitigate risks, test the program, and update it when necessary. They also require contracts with service providers that access customer information to protect confidentiality and properly dispose of information. The lender therefore needs both a vendor assessment and evidence that the vendor’s controls fit the lender’s own risk program.
FTC Safeguards Rule
The FTC Safeguards Rule requires a written information-security program with administrative, technical, and physical safeguards appropriate to the institution’s size, complexity, activities, and the sensitivity of its data. The FTC’s 2023 amendment added breach-reporting duties that took effect in May 2024. Confirm who is responsible for detecting a reportable event, preserving facts, and delivering information quickly enough for the lender to meet its own obligations.
CFPB CMS-IT procedures
The CFPB’s information-technology examination procedures organize attention around board and management oversight, the compliance program, service-provider oversight, violations of law and consumer harm, and examiner conclusions. A security failure, inaccurate automated decision, unavailable disclosure, or unusable records can therefore become a consumer-compliance issue, not merely an IT incident.
FFIEC development, acquisition, and maintenance guidance
The FFIEC update dated September 29, 2024 addresses governance, risk management, secure and resilient business services, and change management. Ask how the vendor approves changes, tests releases, protects production data during development, and proves that recovery arrangements work.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
NIST Risk Management Framework
NIST SP 800-37 Rev. 2 provides a repeatable sequence: categorize systems and information, select and implement controls, assess controls, authorize operation, and continuously monitor. Use the sequence to turn a one-time procurement questionnaire into a lifecycle process with named owners and review dates.
New York requirements
For New York-regulated entities, Part 500 requires risk-based third-party policies covering provider identification, minimum practices, due diligence, periodic assessment, multifactor authentication, encryption, and event notification. New York’s Department of Financial Services guidance issued October 21, 2025 recommends examining access, data sensitivity, provider criticality, encryption, segmentation, SOC 2 or ISO 27001 attestations, penetration-test summaries, vulnerability remediation, subcontractors, data location, incident response, continuity, and secure offboarding.
How do you perform a mortgage-software security assessment?
Use a gated process. Do not let a polished demonstration substitute for evidence or a signed contract.
- Define the service boundary. List every module, integration, mobile or browser client, administrative console, support channel, hosting region, and subprocessor. Identify which components can view, change, export, or delete borrower information.
- Assign data and workflow ratings. Mark confidentiality, integrity, availability, legal, and consumer-impact consequences for each workflow. Systems that originate, store, or transmit complete loan files or underwriting decisions deserve the strongest requirements.
- Request an evidence package. Ask for the latest independent assurance report, architecture and data-flow diagrams, control descriptions, penetration-test summary, vulnerability metrics, recovery-test results, incident procedures, subprocessor list, retention schedule, and sample deletion certification.
- Read assurance reports critically. Check the report’s scope, covered products and environments, control period, testing exceptions, complementary user-entity controls, management response, and remediation plan. A logo without those details is insufficient.
- Test the operating model. Interview security, engineering, privacy, support, and continuity owners. Walk through a joiner, mover, leaver; a privileged-access review; a support session; a critical vulnerability; a suspected breach; and a restoration from backup.
- Map gaps to risk. For every exception, document affected data, exploitability, consumer impact, compensating controls, owner, due date, and whether the risk is accepted, mitigated, transferred, or grounds for rejection.
- Negotiate before approval. Put security, notification, audit, subprocessor, resilience, and exit obligations in the master agreement and applicable service schedules. Do not rely on a changeable web policy for material protections.
- Authorize and monitor. Record the decision, residual risk, required customer-side controls, review cadence, and triggers for reassessment such as a major architecture change, new subprocessor, incident, merger, or material control exception.
What evidence should a vendor provide?
Independent assurance and scope
Prefer a current SOC 2 Type II report or ISO 27001 evidence when available, then examine what it actually covers. Verify whether the report includes the production service, relevant regions, support operations, identity systems, backups, and subprocessors. Note the testing period and the date of the opinion; an old period may not represent the environment you are buying. Read every exception and management response, and track promised remediation to closure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Identity, privilege, and tenant isolation
- Least-privilege role design and separation of administrative duties.
- Joiner, mover, and leaver procedures with timely deprovisioning.
- Periodic privileged-access and customer-administrator reviews.
- Multifactor authentication for workforce, administrator, support, and other sensitive access.
- Controls preventing one tenant from querying another tenant’s records.
- Support-session approval, recording or logging, time limits, and customer visibility.
- Service-account ownership, credential rotation, secrets management, and disabled dormant accounts.
Ask for evidence that these controls operate in the exact product and identity architecture proposed for your institution, rather than in a separate corporate system.
Encryption and key management
Confirm encryption in transit and at rest, including databases, object storage, backups, exports, logs, and temporary files. Ask who owns and administers keys, how keys are separated by environment or tenant, how they rotate, how access is logged, and what happens if a key is revoked. Clarify whether customer-managed keys are supported and what operational burden they create. Include paper records and downloaded files in the handling standard; encryption of the main database does not protect an unencrypted export.
Secure engineering and vulnerability management
Request secure-development lifecycle documentation, code-review and change-approval practices, dependency and container scanning, penetration-test summaries, severity definitions, patch service-level targets, and evidence that critical findings are remediated. Ask how the vendor handles a newly disclosed vulnerability in an internet-facing component, how customers are notified when action is required, and how emergency changes are reviewed afterward.
Detection and incident response
Review monitoring coverage for authentication, privilege changes, data exports, administrative actions, API abuse, malware, and anomalous support activity. Examine alert triage, escalation, forensic preservation, customer notification, regulator cooperation, and communications ownership. Request results from tabletop exercises or recovery tests. Contractual notice should cover incidents at the vendor and relevant subprocessors, not only confirmed breaches of the vendor’s primary production database.
Free tools Windows power users keep installed
One-click scans. No signup required.
Resilience and continuity
Compare stated availability, recovery-time objectives, recovery-point objectives, backup immutability, geographic redundancy, disaster-recovery test results, and manual fallback procedures with the mortgage workflow’s criticality. Ask how the service handles a regional outage, ransomware, identity-provider failure, corrupted data, and a failed release. Obtain evidence that restorations are tested, not merely that backups exist.
Privacy, retention, and use restrictions
Document permitted uses of borrower information, limits on analytics or model training, data-location commitments, retention schedules, legal-hold handling, deletion from primary and backup systems, and access revocation. If the product includes artificial-intelligence features, state whether customer content can be used to train shared models, whether human reviewers can see prompts or documents, and how those settings are controlled and audited.
Which contract terms should you negotiate?
Translate the control review into obligations that survive product changes and incidents. The agreement should include:
- Security representations tied to the vendor’s actual control environment and the defined service scope.
- Multifactor authentication, encryption, key-management, logging, vulnerability-remediation, and secure-development duties.
- Incident notice deadlines, required facts, update cadence, evidence preservation, investigation cooperation, and regulator support.
- Audit and regulator-access rights, including receipt of assurance reports, penetration-test summaries, and remediation updates.
- Subprocessor disclosure, security-flow-down requirements, location transparency, and approval or objection rights for material changes.
- Service levels, recovery-time and recovery-point commitments, maintenance notice, continuity testing, and service credits or other remedies where appropriate.
- Cyber-insurance evidence when proportionate to the exposure.
- Permitted-use, confidentiality, retention, legal-hold, and no-unauthorized-training provisions.
- Return or migration in a documented, usable format; assistance during transition; deletion from production, replicas, backups, and support systems; written certification; and access revocation at termination.
NYDFS guidance specifically recommends considering SOC 2 or ISO 27001 evidence, penetration-test summaries, vulnerability updates, subcontractor controls, data-transfer restrictions, and deletion or migration obligations. Make those deliverables recurring where risk justifies it, rather than one-time promises at onboarding.
Rank #4
How should you compare mortgage-software vendors?
Use the same evidence requests, demonstrations, and contract checklist for every finalist. Score each axis against the sensitivity and criticality of the workflows it would handle; weight security and resilience more heavily for complete loan files and underwriting decisions.
| Evaluation axis | Questions to ask | Evidence or decision signal |
|---|---|---|
| Assurance scope and exceptions | Does independent testing cover the proposed service, period, regions, and subprocessors? | Report scope, exceptions, management responses, and remediation dates. |
| Identity and tenant isolation | Can the vendor enforce least privilege, MFA, separation of duties, and isolation? | Role matrix, access-review samples, support controls, and architecture walkthrough. |
| Encryption and key control | Are data, exports, backups, and logs protected, and who controls keys? | Technical design, rotation process, key-access logs, and customer-key options. |
| Secure development and patching | How are changes, dependencies, tests, and critical vulnerabilities managed? | Lifecycle documentation, test summaries, patch targets, and closure evidence. |
| Incident response | How quickly can the vendor detect, preserve evidence, notify, and cooperate? | Playbooks, exercise results, notification clause, and escalation contacts. |
| Recovery and resilience | Can the service restore accurate records within the workflow’s tolerance? | Recovery objectives, immutable backups, geographic design, and test results. |
| Privacy and data location | Where is information processed, how long is it kept, and may it be reused? | Data map, subprocessor register, retention schedule, and use restrictions. |
| Auditability and integration | Can you monitor actions and limit API or integration privileges? | Exportable logs, API scopes, alerting, and customer-admin controls. |
| Contract flexibility | Will the vendor accept material security, notice, audit, and exit terms? | Redlined agreement and service schedules, not verbal assurances. |
| Implementation, cost, and exit effort | What customer controls, staffing, migration work, and ongoing reviews are required? | Implementation plan, total-cost model, migration test, and exit runbook. |
What happens if the vendor is breached or unavailable?
Your incident plan should assume that a vendor may be the first party to discover a problem, while the lender remains responsible for consumer and regulatory decisions. Maintain named contacts, an escalation tree, alternate communication channels, and a list of affected workflows and data elements.
During a suspected security incident
- Confirm the event through the contractual escalation path and record the time, systems, tenants, and data categories involved.
- Require containment without destroying evidence; preserve logs, images, access records, and relevant communications.
- Assess whether borrower information was accessed, altered, exfiltrated, or made unavailable, including subprocessor involvement.
- Coordinate legal, compliance, privacy, information-security, communications, and business owners before notifying consumers or regulators.
- Require frequent factual updates, corrective actions, and a post-incident report that identifies root cause and control changes.
During an outage or data-integrity event
Activate the documented fallback for applications, disclosures, underwriting, closing, and servicing. Reconcile records after restoration, validate calculations and timestamps, and document any consumer impact. Recovery is not complete until the lender confirms that restored data is complete, accurate, access-controlled, and usable by downstream systems.
How do you plan a secure exit?
Exit planning belongs in procurement because a rushed migration can expose more data than normal operations. Specify the export format, included metadata and audit history, transfer encryption, test migrations, assistance hours, retention of legal holds, and the deadline for disabling vendor and subprocessor access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Run a sample migration before production termination. Reconcile counts and hashes where practical, verify that documents open correctly, test downstream integrations, obtain deletion evidence for primary and replicated environments, and retain the certificate with the termination record. Define what happens if the vendor becomes insolvent or stops supporting the product, including access to data and cooperation with an appointed administrator.
How often should the assessment be refreshed?
Set a periodic review based on risk, then refresh sooner after a major architecture or ownership change, new subprocessor, material assurance exception, serious vulnerability, incident, regulatory change, or recovery-test failure. Continuous monitoring can include assurance-report updates, security notifications, uptime and recovery results, access-review attestations, vulnerability metrics, subprocessor changes, and evidence that agreed remediation is closed.
Keep a decision record that links each requirement to an owner, evidence location, review date, residual risk, and customer-side control. That record demonstrates an ongoing risk-management process rather than a questionnaire completed once at purchase.
Frequently Asked Questions
Is a SOC 2 report enough to approve mortgage software?
No. A SOC 2 report is useful only after you verify its service scope, testing period, exceptions, complementary controls, and remediation. It also does not replace your own assessment of data location, tenant isolation, resilience, contract terms, or customer-configured controls.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What if a vendor will not share its penetration-test report?
Request a dated executive summary, testing scope, severity definitions, unresolved findings, remediation status, and an independent assurance report instead. If the vendor provides no credible substitute, record the uncertainty as residual risk and consider limiting the data or rejecting the service.
Should borrower data be hosted only in the United States?
That depends on your legal, contractual, and operational requirements. Require the vendor to identify every processing and backup location, explain cross-border transfers, and disclose changes so your privacy, regulator, and customer-notice analysis remains accurate.
What customer controls are commonly missed during implementation?
Institutions often overlook administrator MFA, role design, API scopes, export permissions, log retention, support-session approvals, and timely removal of departed employees. Document these as complementary user-entity controls and test them after go-live.
How can a small lender handle a vendor review without a large security team?
Use a risk-tiered checklist, require standardized evidence, and focus specialist effort on systems holding complete loan files or making underwriting decisions. Obtain independent assurance, contract for recurring reports and notice, and use an external assessor for targeted gaps rather than treating a generic questionnaire as the whole review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
