How Cyera helped a mortgage lender secure and manage sensitive data

The publicly traded financial services organization is a leading mortgage lender and services provider committed to strong corporate governance and compliance with GLBA. The company uses a highly scalable mortgage platform to manage data for millions of homeowners, therefore the leadership team is committed to corporate governance, compliance, and risk management. To process and manage mortgage applications and ongoing accounts, the organization must manage vast stores of consumer data, including social security numbers, bank account numbers, loan information, credit history, and other sensitive data.

‍

As a financial services organization, the company must comply with GLBA, which requires the Federal Trade Commission (FTC) and other government agencies that regulate financial institutions to implement regulations to carry out the Act's financial privacy provisions. The Act requires financial institutions (such as companies that offer financial products or services to consumers, including loans, financial or investment advice, or insurance) “to explain their information-sharing practices to their customers and to safeguard sensitive data.”

‍

Sensitive data collection is critical to making lending decisions, which is one reason the organization gathers and stores increasing amounts of consumer data. Further adding to the complexity and quantity of data is the servicing aspect of the organization, which necessitates that they maintain visibility and control over the data generated by millions of loans. Unfortunately, the company’s existing tools have required time-consuming manual discovery that was inaccurate and incomplete. With a wealth of consumer financial data to protect, the security team must have continuous visibility into constantly changing sensitive data stores and apply robust classification rules to that data. This creates new challenges for the financial service organization’s security teams to govern data access and minimize the risk of data exposure and regulatory fines.