How a Cincinnati-area mortgage lender can move from break-fix to managed IT and meet the FTC Safeguards Rule (worked example)
Last checked: November 8, 2026
Schedule a consultationThis is a worked example, not a client story. The lender is hypothetical. The regulatory points are public FTC rules. When a client approves a published result, it replaces the "Result" section below.
The short answer
Non-bank mortgage lenders fall under the FTC Safeguards Rule, which requires a written information security program with specific controls, a named Qualified Individual and an incident response plan. A break-fix IT model fixes problems after they happen and does not produce that program. Moving to managed IT puts the controls, monitoring and documentation on a schedule, while the lender keeps ownership of the program.
The company (hypothetical)
Mortgage lender, about 40 employees across two Greater Cincinnati offices
Loan officers work from the office and from home
Microsoft 365 for email and files, a loan origination system, scanned borrower documents on a shared drive
IT handled break-fix: a local tech is called when something breaks and billed by the hour
The problem
Mortgage lenders and brokers are "financial institutions" under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies. Since the amended rule took full effect in 2023, covered firms need, among other things:
A Qualified Individual who oversees the information security program
A written risk assessment
Access controls, and encryption of customer information in transit and at rest
Multi-factor authentication for anyone who accesses customer information systems
Monitoring and logging of user activity
Security awareness training for staff
Oversight of service providers
A written incident response plan
A written report to the board or senior leadership at least once a year
Since May 13, 2024, a covered firm must also notify the FTC within 30 days after it discovers a security event that involves the unencrypted information of at least 500 consumers.
A break-fix arrangement does none of this on a schedule. Nobody owns patching, nobody reviews logs, and the "program" lives in one technician's head. Firms that hold information on fewer than 5,000 consumers are exempt from some written requirements, but not from the core controls.
The mechanics: what changes with managed IT
| Area | Break-fix today | Managed IT |
|---|---|---|
| Accountability | Whoever answers the phone | A dedicated account manager |
| Patching and updates | When someone remembers | Critical patches within 30 days of release, all others monthly |
| Multi-factor authentication | Partial or none | Enforced for every user who touches borrower data |
| Backups | Unknown or untested | Daily backups kept for 30 days, plus an offsite copy |
| Staff training | None | Security awareness training for every employee |
| Incident response | Call the tech and hope | A written plan, plus ransomware recovery support |
| Documentation | None | Records the lender can use for its risk assessment and annual report |
Two points stay with the lender. The rule lets a service provider's employee act as the Qualified Individual, but the lender keeps responsibility and must name a senior person to direct and oversee that work. And the lender owns its risk assessment and its annual report; managed IT supplies the evidence for both.
The timeline
Onboarding takes about 2 to 3 weeks for a company with 20 to 200 employees.
| Phase | What happens |
|---|---|
| 1. Assessment | Inventory of devices, accounts, data locations and current controls |
| 2. Handover | Admin credentials, domain and DNS, licenses and documentation moved from the old provider |
| 3. Baseline | Multi-factor authentication, the patching schedule and daily backups put in place |
| 4. Paperwork | Risk assessment inputs, incident response plan draft, staff training scheduled |
| 5. Steady state | Monthly service, regular reviews, annual report inputs (ongoing) |
Result
No client result is published yet. When a client approves it, this section will report what changed, with the client's own figures.
Why Networx
Networx IT Solutions has served Greater Cincinnati businesses since 2006 from West Chester Township. Every client gets a dedicated account manager, and Networx has never been acquired. Services include managed IT, break-fix support, ransomware recovery, employee security training, and hosting with a 99.9% uptime SLA.
Managed IT services in Cincinnati · All Networx IT services · (513) 393-9679 · Read Is your Cincinnati financial firm compliant with the FTC Safeguards Rule? · Managed IT, switching and ransomware FAQ
Frequently asked questions
Does the FTC Safeguards Rule apply to mortgage lenders?
Yes. Non-bank mortgage lenders and brokers are financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies to them.
Can our IT provider be our Qualified Individual?
The rule allows an employee of a service provider to serve as the Qualified Individual. The lender keeps responsibility and must name a senior person to direct and oversee that work.
Do we have to report a breach to the FTC?
Since May 13, 2024, yes, if a security event involves the unencrypted information of at least 500 consumers. The notice is due within 30 days after discovery.
Is break-fix enough for a mortgage company?
Not on its own. Break-fix fixes problems after they happen. The Safeguards Rule requires ongoing controls, monitoring, training and a written program, which a managed IT agreement keeps on a schedule.
Can we keep some IT in-house?
Yes. A managed provider can run the day-to-day controls while your own staff keep ownership of the program and the annual report.