Texas SML announced stand-alone cybersecurity exams in October 2026
FTC Safeguards compliance for independent mortgage companies
We put your written security program, staff training and testing in place, so you can hand your examiner what they ask for.
120+
Mortgage brokers our team has worked with since 2017
State exam rules built in
Fixed
One annual price, no surprises
15 min
Free Exam-Ready Check call
Why mortgage companies call us
Most independent mortgage companies first hear about the Safeguards Rule when someone asks them for paperwork.
An exam letter arrives
Your state examiner asks for your written security program, risk assessment and training records.
Loan officers work from home
Florida and Texas both have security rules for remote work, and examiners check them.
A lender asks questions
Lenders now send due diligence forms asking about your policies and your last security test.
Everything your security program needs
Each package covers up to 20 users for one year, all in one client portal.
Security policies
A full Safeguards Rule policy set your staff acknowledge in the portal.
Staff training
A course every quarter and a short security video every week.
Phishing tests
Realistic test emails every quarter to see who clicks and who reports.
Security testing
An automated penetration test and a domain security report, with results explained.
Vendor oversight
A vendor list and review log for the companies that handle borrower data.
Qualified Individual
We help you name the right person and set out what they are responsible for.
Two packages, one fixed price
Billed once a year by card, ACH or emailed invoice. Over 20 users? Book a call for a quote.
Self-Guided
You use our tools and templates and do the work yourself.
$900 a year
Founding price through Dec 31, 2026
$1,500 a year from January 1, 2027
What’s included
- Client portal
- Quarterly training, weekly videos and phishing tests
- Safeguards Rule policy templates
- Self-guided risk assessment
- Automated penetration test and domain report
- Dark web and infostealer monitoring
- Vendor list and incident response templates
Recommended
Done With You
We sit down with you and build the program together.
$3,000 a year
Founding price through Dec 31, 2026
$4,800 a year from January 1, 2027
Everything in Self-Guided, plus
- Risk assessment interview and gap analysis
- Policies customized with you
- Vulnerability assessment
- A call to walk through your test results
- Vendor list and incident response plan built with you
- Qualified Individual coaching and year-end report template
Fixing what the tests find is done by your IT provider, or by us at an hourly rate if you would like help.
How it works
From first call to exam-ready
Four steps. We walk each one with you.
Book a call
We learn about your office, your state and your next exam.
Get set up
We open your portal, load your users and start your training.
Build your program
Policies, risk assessment, testing and your vendor list.
Stay ready all year
Quarterly training and phishing tests, monitoring and a year-end report.
Rules for your state
Free checklists for your team
Three short checklists you can work through with your team today. Pick the one that fits your office.
Florida remote work checklist
What Florida requires before a loan officer works from home.
Get the Florida checklist
FAQ
Questions brokers ask
These come up on almost every first call.
Don’t see your question?
Book a 15-minute call and ask us directly.
Not ready to talk yet? Start with our free checklists.
Do I need this if I only have a few employees?
Yes. The rule applies at any size. Firms that keep information on fewer than 5,000 consumers can skip a few formal requirements, but not the written program, training or vendor oversight.
Do you replace my IT company?
No. We work alongside them. They handle the technology; we give you the program, the training and the testing.
Are you my Qualified Individual?
No. We help you choose the right person on your team and show them what the role involves.
Will this guarantee I pass my exam?
No one can promise that. We make sure you have the documents and records examiners ask for.
What is an automated penetration test?
Software that runs attacker-style checks against your internet-facing systems, such as your website and email, and reports what it finds.
How much of my time does this take?
Some. You answer a risk assessment questionnaire, review the policies so they match how your office works, and your staff complete training through the year. Done With You cuts it down to a few working sessions.
Who we are
Great White Cyber helps small, regulated businesses meet their security and compliance requirements without hiring a security team. Our team has worked with more than 120 mortgage brokers on compliance since 2017, and our consultants hold CISSP and CISA credentials.
Amy Lawson, Director, has worked on compliance for financial services firms since 2017, including the annual cybersecurity certifications those firms file with their state regulator.
Not sure where you stand?
Book a 15-minute call and we will tell you what your examiner is likely to ask for.