A Part 500 cybersecurity audit from people who know mortgage banking.
New York requires larger licensees to get independent audits of their cybersecurity program, and most covered companies must file an annual certification of compliance or an acknowledgment of noncompliance. Garrett, McAuley & Co. leads the audit, works with an information security firm whose auditors hold the ISACA CISA certification, and writes a report your board can act on.
- Advising lenders since
- 2003
- Mortgage companies served
- 600+
- Banks and thrifts served
- 120+
- Reviews a year
- 40 to 60
What the audit covers
- Board oversight: the written program, board approval, and the CISO's authority and annual report
- Risk assessment, and whether it actually drives the program
- Vendor management for key vendors such as the loan origination system, subservicer, and cloud providers
- Access controls, multi-factor authentication, and asset inventory
- Monitoring, encryption, vulnerability management, and penetration test follow-up
- Incident response, business continuity, and the DFS notice and certification deadlines
- Related Fannie Mae, Freddie Mac, and FTC Safeguards Rule requirements
What the rules require
Class A companies must design and conduct independent audits of their cybersecurity program. How often depends on their risk assessment.
Every covered company that is not fully exempt must file an annual certification of material compliance, or an acknowledgment of noncompliance, by April 15.
Class A status depends on gross revenue and employee count over the last two fiscal years. Only affiliates that share information systems, cybersecurity resources, or part of the cybersecurity program count.
These summaries are general information, not legal advice. See the cited rule for the full text.
How it works
- 1A 30-minute call about your New York business, your affiliates, and your last audit.
- 2We scope the audit from your own risk assessment and request your policies, plans, and recent test results.
- 3Interviews with your CISO and key staff, while our ISACA CISA-certified partner reviews technical controls.
- 4A written audit report with findings ranked by risk and a summary for your board.
Talk with us about what you need.
A 30-minute call is the fastest way to see whether we are a fit. No cost, no obligation.
What you receive
- An independent audit report scoped from your own risk assessment
- Findings ranked by risk with practical fixes
- A documented basis for your CEO and CISO annual certification
Why Garrett, McAuley
- Independent: we did not design, build, or run your systems
- Mortgage-specific: vendor, subservicer, and agency requirements are part of the scope
- One firm accountable for the audit and the report
Who you will work with
Joe Garrett
Co-Founder & Principal
Joe Garrett has worked in banking and mortgage banking since 1977, mostly in FDIC-insured and OCC-regulated banks. He served on the boards of four banking institutions and as Chairman and CEO of two of them.
LinkedIn
Michael D. McAuley
Co-Founder & Principal
Michael D. McAuley became a commercial banker in 1984, specializing in mortgage warehouse lending and commercial lending. He managed the warehouse lending business for Washington Mutual and JPMorgan Chase, and he has helped commercial banks set up, assess, and improve their warehouse lending operations.
LinkedIn
Steve Stone
Managing Director
Steve Stone has spent his career in independent mortgage banking, as an entrepreneur and as a senior operating executive. He founded and later sold an independent mortgage banking company, and he has managed loan production, servicing, secondary marketing, MSR strategy, and technology.
LinkedIn
Common questions
- Does Part 500 apply to mortgage bankers and servicers?
- Yes, if you hold a New York mortgage banker license or mortgage loan servicer registration under the Banking Law. Smaller companies may qualify for limited exemptions under section 500.19.
- Who needs an independent Part 500 audit?
- Class A companies must have independent audits, on a schedule their risk assessment supports. A Class A company has at least $20 million in gross annual revenue in each of the last two fiscal years. That total counts all of its own business plus the New York business of its affiliates. It also has more than 2,000 employees, averaged over the last two fiscal years, or more than $1 billion in gross annual revenue in each of those years. Only affiliates that share information systems, cybersecurity resources, or part of the cybersecurity program count toward these totals.
- We are not Class A. Is an audit still useful?
- Yes. Most covered companies must file a certification of compliance, or an acknowledgment of noncompliance, each April 15. An independent audit gives the CEO and CISO a documented basis for that filing.
- Does the audit include penetration testing?
- The audit reviews your most recent penetration test and vulnerability scans, and whether your team fixed the findings on time. If you need a new test, we can recommend specialist firms.
- How long does the audit take?
- Most audits take several weeks from kickoff to final report, depending on your size and how current your documentation is.
- Do you need access to our systems?
- No. Your team shows us the evidence through reports, screenshots, and screen-share walkthroughs. We also check what anyone can see from the internet, such as your public websites and email security settings.