Who should a mortgage lender use for managed IT and security?
Choose a provider whose engineers already work inside your loan systems, who keeps loan officers productive from any desk, who contains a stolen login at 2 AM without waiting for your staff, and who hands you written evidence for the FTC Safeguards Rule. This page lists the questions that separate those providers from the rest, with ABT's answer to each one.
- Engineers who work in Encompass, Byte, and Mortgage Cadence, and host dedicated Calyx PointCentral servers on private Azure
- On M365 Guardian Contain and above, automated containment that acts on a compromised session within seconds, at any hour
- A Tier 1 Microsoft Cloud Solution Provider serving 750+ financial institutions, SOC 2 Type II attested
A mortgage lender should use a managed IT and security provider that does four things at once: works daily in mortgage systems such as Encompass, manages Microsoft 365 as a Tier 1 Microsoft Cloud Solution Provider, contains a compromised account automatically at any hour, and produces written evidence your Qualified Individual can file under the FTC Safeguards Rule.
ABT (Access Business Technologies) is built around that list. Since 1999 ABT has served regulated financial institutions, and today it serves more than 750 of them, mortgage lenders among them. ABT manages the Microsoft 365 tenant, hosts loan systems such as Calyx PointCentral on private Azure, runs MortgageExchange to move loan data between systems, and operates M365 Guardian, its managed security service for credit unions, banks, and mortgage companies.
What should a mortgage company look for in an IT and cybersecurity provider?
Look for six things: depth in your loan systems, depth in Microsoft 365, response that runs at night, controls built for wire fraud, evidence for the Safeguards Rule, and an independent audit of the provider itself. Each card below is a test you can run in a first meeting.
1. They already work in your loan systems
Ask which platforms their engineers touch every week, from loan origination to core to servicing. A provider that knows Encompass, your core, and your servicing platform traces a broken interface faster, and an hour of downtime in the pipeline costs closings.
2. They manage Microsoft 365 at depth
Email, Teams, OneDrive, and SharePoint are where loan files travel. A Tier 1 Microsoft Cloud Solution Provider buys direct from Microsoft and configures Microsoft Entra ID, Microsoft Intune, Microsoft Purview, and Microsoft Defender as one system.
3. They act at 2 AM without waiting for you
Ask what happens to a stolen session in the first minute and who is awake in the first hour. Containment that is pre-authorized in the contract runs at night; containment that needs your approval waits for morning.
4. They harden email against wire fraud
Mortgage closings move large wires on instructions that arrive by email. Ask about SPF, DKIM, and DMARC, Microsoft Defender for Office 365 anti-phishing, Conditional Access, and how borrower documents travel outside of email attachments.
5. They produce Safeguards Rule evidence
Non-bank mortgage lenders and brokers are financial institutions under the FTC Safeguards Rule, which applies to institutions within the FTC's jurisdiction. Ask for a written map of their controls to 16 CFR 314.4 and for the reports your Qualified Individual will hand the board each year.
6. They are audited themselves
Your provider holds the keys to your tenant, so the Safeguards Rule asks you to oversee it. Ask for a current SOC 2 Type II report from an independent CPA firm and read the period, the criteria, and the opinion.
What questions should you ask, and how does ABT answer them?
These are the questions mortgage executives ask when they shortlist managed IT and security providers. The middle column is what a strong answer contains from any provider. The right column is ABT's answer, stated in full.
| The question | What a strong answer contains | ABT's answer |
|---|---|---|
| Which loan systems do your engineers work in? | Named platforms, named interfaces, and examples of fixing them. Ask about your exact stack: LOS, POS, pricing engine, MERS, core, servicing. | ABT engineers work directly against Encompass, Byte, and Mortgage Cadence on the origination side and Jack Henry and Fiserv on the core side. ABT hosts dedicated Calyx PointCentral servers on private Azure, runs Encompass on virtual desktops on private Azure, and builds interfaces through MortgageExchange. For any other system in your stack, ask us and we will say exactly what we have done with it. |
| Can you isolate a device or shut down an account without waiting for our staff? | Actions that are pre-authorized in the contract, a list of what the automation does on its own, and a timing commitment for each. | For a compromised account, yes. At Guardian Contain and above, critical risk detections trigger pre-authorized containment that starts revoking the user's sessions within seconds at any hour, with no human in the loop, and the user must pass multifactor authentication or reset the password at the next sign-in. Further actions on a device or account are taken by ABT engineers on covered incidents at Respond and Resolve. |
| Is monitoring 24/7, or business hours with an answering service? | A plain description of what runs overnight, who is on call, how many people deep, and where they sit. | Automated detection and containment run 24 hours a day, 365 days a year. Engineers investigate and remediate covered incidents Monday to Friday, 5 AM to 5 PM Pacific. After hours, a two-deep on-call rotation in the United States takes over, and Guardian Resolve puts a human on the incident at any hour. |
| How do you stop business email compromise and wire fraud? | Email authentication, anti-phishing, sign-in policy, session control, and a documented call-back step for every wire instruction. | Guardian configures SPF, DKIM, and DMARC, Microsoft Defender for Office 365 anti-phishing, and Conditional Access rules that block risky sign-ins. Tokenator, ABT's automated response engine, starts revoking compromised sessions when it sees suspicious token behavior. Borrower documents travel through DocumentGuardian links. |
| How do you control laptops for remote loan officers? | Device compliance enforced at sign-in, disk encryption, and the ability to cut off a lost laptop. | Microsoft Intune compliance policies, BitLocker encryption, operating system security baselines, and Conditional Access gates that can require a compliant device before a user reaches company data. |
| What evidence do we get for the FTC Safeguards Rule? | A control-by-control map to 16 CFR 314.4 and reports your Qualified Individual can put in front of the board. | ABT has mapped 62 Guardian security policies to the ten top-level requirements of 16 CFR 314.4, each with its evidence and whether that evidence comes from tenant data or management attestation. Guardian onboarding ends with examiner-ready documentation. |
| Are our backups immutable, and when was the last restore test? | Where the backup copy lives, who can delete it before retention ends, and the date and result of the last restore test. | ABT's own SOC 2 Type II examination tests an annual restoration of backed-up data to a non-production environment. For your environment, ABT puts the backup engine, the storage location, the people who hold delete rights, and the restore-test schedule in writing during the assessment. |
| Do you have a SOC 2 Type II report? | A current report from an independent CPA firm, with the period, the criteria, and the opinion stated. | Yes. An independent CPA firm examined ABT against the AICPA Security criteria for May 1 through September 30, 2026. The opinion is unqualified. ABT provides the report under a mutual non-disclosure agreement through DocumentGuardian. |
| Who works on our account, and where? | Named teams, staff location, and whether any work moves offshore after hours. | Every member of ABT's delivery organization works from the United States, including after hours and holidays. |
| Can we start small before we sign? | A scoped first engagement with written findings you keep either way. | Start with ABT's free security assessment: about two weeks, a written report with specific findings and risk ratings, and a 90-day hardening roadmap. |
Capability wording in the right column comes from ABT's published M365 Guardian service description and ABT's SOC 2 Type II report. Detection is Microsoft's; the automated response and the operating discipline are ABT's.
Get the answers for your own tenant
ABT's free security assessment reads your Microsoft 365 environment across identity, email, data, devices, sharing, and compliance, then hands you a written report with findings, risk ratings, and a 90-day hardening roadmap. The report is yours whichever provider you choose.
Which IT providers help mortgage companies comply with the FTC Safeguards Rule?
The providers that help are the ones that operate the controls 16 CFR 314.4 names, document them control by control, and give your Qualified Individual the evidence to report to the board. The rule keeps compliance with the lender: a provider can run the program and even supply the Qualified Individual, and the regulation still says you retain responsibility for compliance. So the useful question is which provider leaves you holding the best evidence.
The rule reaches mortgage companies directly. Its definitions list mortgage lenders and mortgage brokers among the financial institutions it covers, and they state that a mortgage broker is a financial institution because brokering loans is a financial activity. If you originate, broker, or service loans and the FTC is your regulator under the Gramm-Leach-Bliley Act, this rule is your information security standard. Our guide to the FTC Safeguards Rule and Microsoft 365 for mortgage lenders walks through the configuration in more depth.
The main elements 16 CFR 314.4 asks you to have in place
- A Qualified Individual who oversees the program. That person can work for you, an affiliate, or a service provider. When it is a provider, you designate a senior person on your own staff to direct and oversee them, and you require the provider to maintain a program that protects you.
- A written risk assessment, with criteria for rating risks and a plan for how each risk is mitigated or accepted.
- Access controls that limit each user to the customer information their job requires.
- Encryption of customer information both in transit over external networks and at rest.
- Multifactor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing.
- Secure disposal of customer information no later than two years after its last use, with the stated exceptions, and periodic review of retention.
- Change management, and monitoring and logging of what authorized users do.
- Testing: continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
- Oversight of service providers, including contract terms that require them to maintain safeguards and periodic reassessment.
- A written incident response plan and a written report from the Qualified Individual to the board at least once a year.
- Notice to the FTC as soon as possible and no later than 30 days after discovering a notification event involving the information of at least 500 consumers. The rule defines a notification event as unauthorized acquisition of unencrypted customer information. Encrypted information counts as unencrypted when the encryption key was also accessed, and unauthorized access is presumed to be acquisition unless you have reliable evidence that it was not. That requirement took effect May 13, 2024.
- The rest of the program: an inventory of data and systems, secure development practices for in-house applications, security awareness training for staff, and regular evaluation and adjustment of the program as your business changes.
Smaller shops get relief on four items. Under 16 CFR 314.6, an institution that maintains customer information on fewer than 5,000 consumers is exempt from the written risk assessment requirement, the penetration testing and vulnerability assessment requirement, the written incident response plan, and the annual board report. Everything else still applies, MFA and encryption included. Our article on which businesses the FTC treats as financial institutions covers the edges of the definition.
How ABT supports a mortgage lender's Safeguards program
ABT has completed a structured mapping of its Guardian security policies to the subsections of 16 CFR 314.4: 62 policies mapped across the ten top-level requirements. Each mapping names the evidencing policy, explains why it is relevant, and classifies whether the evidence can be read automatically from tenant data or requires a management attestation. In practice that means MFA through Microsoft Entra ID Conditional Access, device encryption through Microsoft Intune and BitLocker, data loss prevention and sensitivity labels through Microsoft Purview, and email authentication and anti-phishing through Microsoft Defender for Office 365, each configured by ABT and each documented for your Qualified Individual.
The decisions that the rule assigns to you stay with you: who your Qualified Individual is, what your risk tolerance is, and whether an event requires notice to the FTC or to borrowers. ABT supplies the technical facts and the written incident timeline. You, your counsel, and your insurance carrier make the call.
We are a lender with 200 loan officers. What should managed IT and security cover?
At 200 loan officers, managed IT and security should cover five things: the loan systems your officers live in, the Microsoft 365 tenant where files and email travel, every laptop and phone that touches borrower data, automated response that runs at night, and the evidence your Qualified Individual reports to the board. Lenders this size usually run a lean internal IT team, remote and hybrid loan officers across several states, and a pipeline where an hour of downtime delays closings.
Keep loan officers productive from any desk
Remote loan officers need the same speed at a kitchen table as at a branch. ABT runs ICE Mortgage Technology Encompass from virtual desktops on private Azure, with access tied to Microsoft Entra ID identities, so an officer signs in once and works from anywhere. ABT hosts dedicated Calyx PointCentral servers in a private Azure subscription with your company's name on it. MortgageExchange moves loan data automatically between your LOS, your core, and your servicing platform, which ends re-keying when loans board after closing. Microsoft 365 Copilot can then work inside the same tenant, on the same files, under the same permissions.
Protect that productivity on every device
Two hundred officers means two hundred laptops, two hundred phones, and two hundred inboxes that attackers target with wire-instruction fraud. Guardian configures Microsoft Intune compliance, BitLocker encryption, and Conditional Access gates that can require a compliant device before a user reaches company data. Purview DLP policies and sensitivity labels follow borrower data across Exchange, SharePoint, OneDrive, and Teams. On Contain and above, when a critical risk detection fires, automated containment starts revoking the session within seconds.
Close with governance you can hand to the board
Your Qualified Individual reports in writing to the board at least once a year. Guardian Security Insights reports your posture monthly, and Guardian onboarding finishes with examiner-ready documentation. Freddie Mac also expects its Seller/Servicers to maintain an information security program and review it every year, so the same evidence serves both audiences.
What it costs at that size
M365 Guardian is priced per user per month, and Microsoft licensing is always its own line at Microsoft's price. Here is the arithmetic for 250 users, roughly 200 loan officers plus processors, underwriters, and closers, at the rates that apply when Microsoft licensing runs through ABT:
| Guardian rung | What it adds | Per user per month | 250 users per month |
|---|---|---|---|
| Foundation | Hardens the tenant and reports posture through Guardian Security Insights. Self-managed with best-effort support. | Included with Microsoft licensing through ABT | $0 |
| Contain | Round-the-clock detection across identity, endpoint, email, and cloud apps on Microsoft Defender XDR signals, plus pre-authorized automated containment that acts within seconds at any hour. | $18 ($21 standard) | $4,500 |
| Respond | ABT security engineers investigate and remediate covered incidents during business hours and produce a written incident timeline for an examiner or insurer. | $27 ($32 standard) | $6,750 |
| Resolve | After-hours escalation: a human on the incident at any hour. | $37 ($42 standard) | $9,250 |
Arithmetic: 250 users multiplied by the per-user rate. Standard rates apply when Microsoft licensing is bought elsewhere. Each paid rung carries a 50-user monthly floor. Current pricing and rung detail live on the M365 Guardian page.
What happens when a loan officer's account is stolen at 2 AM?
This is the scenario to walk through with any provider, because it shows who acts, how fast, and on whose authority. Here is how it runs with ABT.
Microsoft flags the risk
A phished loan officer's credentials are used from an unfamiliar location. Microsoft Defender and Microsoft Entra ID Protection raise the risk signal. Detection is Microsoft's.
On Contain and above, ABT's automation acts within seconds
Guardian's pre-authorized response calls Microsoft Graph to revoke the user's sessions and refresh tokens. Microsoft notes the revocation can take a few minutes to take effect, Continuous Access Evaluation shortens that in apps that support it, and apps that issue their own session tokens are signed out separately. Conditional Access then requires multifactor authentication or a password reset at the next sign-in. Nobody had to be woken up for this step.
A human engages, on Resolve
On Guardian Resolve, when automation does not finish the job, ABT's on-call engineer engages immediately, day or night. The rotation is two engineers deep, a named primary and a documented secondary, both in the United States.
Business-hours investigation
On Respond and Resolve, ABT security engineers investigate the covered incident, check for mailbox rules and other persistence an attacker leaves behind, remediate, and write the incident timeline during ABT's business hours, Monday to Friday from 5 AM Pacific. On Resolve the on-call engineer keeps working the incident outside those hours.
You decide on notice, with the facts in hand
The written timeline goes to you, your counsel, and your carrier. If the event touched Freddie Mac or Fannie Mae loans, their reporting clocks apply: Freddie Mac asks for most incidents no later than 36 hours, and that clock counts weekend hours, so name who on your team decides on notice when an incident lands on a Friday night. If it was unauthorized acquisition of unencrypted information on 500 or more consumers, the FTC's 30-day clock applies.
The question behind "is it 24/7?" ABT runs automated detection and containment around the clock and staffs an on-call rotation after hours. Ask every provider on your shortlist to describe their overnight coverage in those same terms: what the automation does on its own, and how many people are on call.
How do you stop wire fraud and keep borrower documents safe at a mortgage company?
You stop wire fraud with layers: authenticate your domain, filter phishing, block risky sign-ins, revoke stolen sessions fast, and verify every wire instruction by phone at a number you already have on file. Business email compromise works because a closing involves many parties trading instructions by email under deadline. The technology layers make the fake email harder to send and the stolen mailbox shorter-lived; the call-back step catches what gets through.
The controls ABT configures in the tenant
- Domain authentication: SPF, DKIM, and DMARC on your sending domains, which makes your domain harder to spoof to title companies and borrowers.
- Anti-phishing: Microsoft Defender for Office 365 anti-phishing policies and quarantine management.
- Sign-in policy: Microsoft Entra ID Conditional Access rules that block risky sign-ins.
- Session control: Tokenator, ABT's automated response engine, detects suspicious OAuth token behavior and starts revoking the affected sessions right away. Some apps hold their own session tokens, so the engineer on the incident confirms each app is closed off.
- Data loss prevention: Microsoft Purview DLP policies and sensitivity labels across Exchange, SharePoint, OneDrive, and Teams.
Two process checks belong in your own procedures and in every provider conversation: who watches for lookalike domains registered against your brand, and who on your team confirms wire instructions by phone. Our article on email security against wire fraud and BEC covers the controls in more detail.
Borrower documents travel by secure link
Pay stubs, bank statements, and tax returns are exactly the customer information the Safeguards Rule protects. ABT's DocumentGuardian sends and receives them through a secure link or portal: every file encrypted in transit and at rest with AES-256, stored in Microsoft Azure data centers and then automatically purged, with a full audit trail. Borrowers receive encrypted files with one click, and loan officers share a personal DocumentGuardian link in their email signature. Email stays the place for conversation; the documents move through DocumentGuardian.
Backups and restore tests: what to ask
Microsoft keeps Microsoft 365 running; your data still needs its own backup plan. Three questions sort providers quickly. Where does the backup copy live? Who can delete it before its retention period ends? Immutable means nobody can, the provider's own administrators included, so ask the provider to show you that setting in writing. And when was the last restore test, what was restored, and how long did it take? ABT's own SOC 2 Type II examination tests an annual restoration of backed-up data to a non-production environment, and ABT answers all three questions in writing for your environment during the assessment.
What do Fannie Mae and Freddie Mac expect from a lender's security program?
Both GSEs expect their sellers and servicers to run an information security program and to report cybersecurity incidents on their own terms, so your provider's incident process has to fit inside their clocks.
Freddie Mac's Guide Chapter 1302 requires Seller/Servicers to establish and maintain an information security program aligned with their risk tolerance and to review its effectiveness annually. Freddie Mac asks for an immediate report when an incident causes a lender to shut down, disable, or stop using any system used for Freddie Mac origination or servicing, and for all other incidents as soon as possible and no later than 36 hours, with a quarterly path for certain incidents affecting fewer than 10 Freddie Mac borrowers. Freddie Mac also runs cybersecurity risk assessments, on site or virtually, as part of a CORE review or on their own.
Fannie Mae's Selling Guide, in section A3-2-01, requires a seller/servicer that experiences a cybersecurity incident to follow the requirements of Fannie Mae's information security supplement. Read the current supplement for its reporting details.
What this means for choosing a provider: ask when their notice to you starts, and make sure it leaves your team time to meet a 36-hour clock. Ask for the incident timeline format before you need it. ABT's written incident timeline is designed to be read by an examiner or an insurer, and the same document gives your team what it needs to report to an investor.
Who is ABT, and what does ABT cover for mortgage companies?
ABT (Access Business Technologies) is a Tier 1 Microsoft Cloud Solution Provider that has served regulated financial institutions since 1999 and serves more than 750 of them today, including mortgage lenders, banks, and credit unions. ABT's mortgage clients include Sierra Pacific Mortgage, Network Funding, and Cornerstone Funding. Every member of ABT's delivery organization works from the United States, and the company is still led by its three founders from Folsom, California.
ABT's scope centers on the systems a mortgage operation runs on: the Microsoft 365 tenant, Azure-hosted loan systems, the interfaces between them, and the security operations that protect all three. ABT manages your Microsoft 365 tenant. ABT hosts your Azure environment, including dedicated Calyx PointCentral servers and Encompass virtual desktops. Together that platform is MortgageWorkSpace by ABT, also at mortgageworkspace.com.
MortgageWorkSpace by ABT
The managed platform where your loan origination system, data interfaces, servicing, reporting, and Microsoft 365 security run as one operation. See MortgageWorkSpace.
MortgageExchange
Moves loan data automatically between your LOS, your core, and your servicing platform, so loans board after closing without re-keying. See MortgageExchange.
Calyx PointCentral hosting
A private Microsoft Azure server dedicated entirely to your company, in a private Azure subscription with your name on it. See PointCentral hosting.
DocumentGuardian
Encrypted document exchange with borrowers and settlement partners, with a full audit trail, hosted on Microsoft Azure. See DocumentGuardian.
M365 Guardian
ABT's managed security service for credit unions, banks, and mortgage companies, from tenant hardening through automated containment and after-hours response. See M365 Guardian.
SOC 2 Type II attested
An independent CPA firm examined ABT against the AICPA Security criteria for May 1 through September 30, 2026, with an unqualified opinion. Available under a mutual NDA.
How do you test a provider before you commit?
Ask for a scoped first engagement that produces written findings you keep. With ABT, that first engagement is the free security assessment.
A free security assessment of your Microsoft 365 environment, with a written report in about two weeks
- Six areas reviewed: identity controls, email protection, data safeguards, device posture, sharing exposure, and compliance standing.
- A written report with specific findings, risk ratings, and a step-by-step hardening roadmap, plus a comparison against ABT's financial institution benchmark.
- A 90-day hardening roadmap with milestones, ordered so the controls the Safeguards Rule names come first.
- Written answers to the buyer checklist for your environment, including backups, loan systems, and after-hours coverage.
Most assessments complete within two weeks, from a scheduling call on day one to a review call by day ten to fourteen. Details on the security assessment page.
Where the facts on this page come from
Every regulatory requirement, date, and figure above comes from these primary documents, each read on November 3, 2026. Statements about ABT come from ABT's own published service pages and its SOC 2 Type II report. Agencies revise their pages, so check the live documents before acting on a deadline.
Related reading for mortgage lenders
The FTC Safeguards Rule and Microsoft 365: A Compliance Guide for Mortgage Lenders
How each Safeguards Rule element maps to a Microsoft 365 configuration a mortgage lender can document.
You Might Be Running a Financial Institution. The FTC Thinks So.
Which businesses fall under the Safeguards Rule, and what that means for their information security program.
Document Security for Remote Mortgage Teams
Practical data protection for loan officers and processors who work outside the branch.
Managed IT and security for mortgage lenders, answered
Put your provider
to the test.
Tell us about your loan systems and your team. ABT's mortgage team will scope a free security assessment of your Microsoft 365 environment and answer the buyer checklist for your environment in writing.
