Lending operations / GUIDE + WORKSHEET
Build a breach response record for a US mortgage lender
Create an incident record that links detection time, mortgage systems, exposed data, encryption status, consumer counts, vendor actions, and human review.
THE STARTING POINT
Covered US mortgage lenders should open one incident record with discovery time, affected systems, data types, encryption status, consumer-count estimate and source, vendor contacts, containment, and reviewer. Since May 13, 2024, the FTC Safeguards Rule has required notice as soon as possible, no later than 30 days after discovery, for unauthorized acquisition of unencrypted customer information involving 500 or more consumers. Security and counsel determine coverage and whether facts meet the trigger; software assembles evidence but does not decide.
Open a record at the first signal
A mortgage lender should log the first signal when it arrives, even if staff do not yet know whether borrower data was acquired. Record who noticed it, the time, the system or vendor involved, what changed, and who owns the next check. Keep the time the event may have begun separate from the time the lender discovered it; a reviewer can reconcile the timeline later.
- 1Capture signalSave alert, complaint, or vendor notice with its timestamp.Incident intake
- 2Map systemsLink affected CRM, LOS, portal, storage, and service providers.System inventory
- 3Scope with a personSecurity and privacy leads verify data and consumer counts.Review queue
- 4Route required actionCounsel confirms applicable notice and response steps.Incident owner
Map the borrower data and its source
A useful incident record points to the affected mortgage system and the authoritative data it held: applications, identity documents, account details, communications, or servicing records. Record whether the information was encrypted, what evidence supports that status, which vendor or subprocessor was involved, and how many consumers may be affected. Preserve the source export and count method so later changes do not overwrite the first estimate.
- Detection sourceAlert, complaint, audit, or vendor notice
- Mortgage systemCRM, LOS, borrower portal, or document store
- Data scopeTypes, encryption evidence, count source, and time range
- Human reviewSecurity, privacy, and counsel assess next steps
Route the Safeguards Rule trigger to a person
For financial institutions within FTC jurisdiction, the 2023 Safeguards Rule amendment covers a notification event where unencrypted customer information involving 500 or more consumers is acquired without authorization. It requires FTC notice as soon as possible and no later than 30 days after discovery. A system can flag a count approaching 500 or an unknown encryption state, but a designated security or privacy lead must confirm the facts and counsel must check which duties apply.
- System
- Borrower document store · source linked
- Encryption
- Needs attention: Not yet verified
- Consumer count
- Needs attention: Estimate in progress · source owner assigned
- Discovery time
- Recorded from first internal alert
- Next owner
- Blocked: Security lead and counsel review
Keep notice work separate from containment
A lender should track containment, evidence preservation, access changes, vendor requests, consumer impact review, and notice decisions as linked tasks with separate owners. State and contract notice duties may differ from the FTC reporting rule. Preserve a dated copy of each decision and the facts reviewed, including a reason when the team concludes a specific notice rule does not apply. Reconcile actions again when the consumer count or encryption evidence changes.
Single free-text ticket
- Containment and notice steps blur together
- Consumer counts lose their source
- A later update replaces the first decision
Linked incident record
- Each action has an owner and timestamp
- Count and encryption evidence stay linked
- A reviewer can reconstruct the decision path
WORKED EXAMPLE / ILLUSTRATIVE
A fictional mortgage incident log
These fictional entries show how an incident record tracks evidence as scope changes without deciding legal notice obligations.
| Fictional incident | Evidence recorded | Next owner |
|---|---|---|
| IR-26-04 · portal access alert | Borrower document store; encryption unknown; initial count pending | Security lead verifies source logs |
| IR-26-05 · CRM token misuse | Token revoked; 146 consumer records in review; vendor contacted | Privacy lead confirms the count method |
| IR-26-06 · test data only | No customer information found; test environment and evidence retained | Incident owner documents closure |
| IR-26-07 · scope expanded | Unencrypted customer information may involve 500+ consumers | Counsel reviews FTC and state notice duties |
MAKE IT USEFUL
Mortgage incident evidence record
Use one incident ID to link detection, systems, data, people, vendors, and response decisions.
Your notes stay in this page and are not sent to Smithers. Download or copy them before leaving; refreshing clears them.
Before you put it to work
- Confirm which legal entity and regulator own the affected system.
- Preserve the original alert and discovery timestamp.
- Trace affected data to its source system and vendor.
- Keep encryption status and consumer-count evidence with the incident.
- Have security, privacy, and counsel review applicable notices.
The FTC Safeguards Rule applies to financial institutions within FTC jurisdiction; banks and other regulated entities may have different incident-reporting rules. Encryption, discovery timing, consumer counts, state breach laws, and contracts can change the legal analysis. A CRM or incident queue cannot decide coverage or notice duties. This is general information, not legal advice. Confirm requirements with your compliance counsel.
Source notes
These references support the specific product or technical points discussed above. Checked October 12, 2026.
IF THIS LOOKS FAMILIAR
Your tools. Your particular mess.
The worksheet is yours to use. If the difficult part is making it work with the systems you already have, that's the kind of thing we help with.
See the industry context