Written Cybersecurity Policies
An owner-approved policy set covering the areas DFS lists — sized for a small brokerage, not a 200-page template written for a bank.
NYDFS 23 NYCRR 500 · For mortgage brokers
Cybersecurity Built for Mortgage Brokers.
We create the documentation New York's Department of Financial Services expects to see — policies, risk assessment, asset inventory, access reviews and your annual filing. Built with agentic AI. Reviewed line by line by Microsoft experts.
- New York focus · All 50 states
- Human-reviewed AI
- Microsoft tenant specialists
We work with independent mortgage brokers. Not banks, not retail or wholesale lenders — just brokers.
The small-business exemption
Fewer than 20 people? This service is for you.
New York's cybersecurity regulation was written with large institutions in mind. But DFS carved out a limited exemption for small covered entities — and most independent mortgage brokers qualify. You qualify if you meet any one of these tests:
- <20Fewer than 20 employees and independent contractors, counting your affiliates.
- <$7.5MLess than $7.5 million in gross annual revenue in each of your last three fiscal years.
- <$15MLess than $15 million in year-end total assets, including affiliates.
Qualifying isn't automatic. You must file a Notice of Exemption with DFS within 30 days of determining you qualify — and you still file an annual compliance certification (or acknowledgment of noncompliance) by April 15 every year.
Source: 23 NYCRR 500.19(a). Eligibility depends on your specific facts, including affiliates — we'll walk through it with you. This is general information, not legal advice.
What the regulation doesn't require of you
- Penetration testing and vulnerability assessments 500.5
- Appointing a Chief Information Security Officer 500.4
- Audit trail systems 500.6
- Application security program 500.8
- Dedicated cybersecurity personnel 500.10
- User-activity monitoring and web/email filtering mandates 500.14(a)(1)–(2)
- Encryption of nonpublic information 500.15
- A formal written incident response plan 500.16
What you still need — and what we document
- Cybersecurity program and written policies 500.2 · 500.3
- Annual risk assessment 500.9
- User access privilege reviews 500.7
- Asset inventory and data disposal 500.13
- Third-party service provider policy 500.11
- MFA for remote access, cloud apps with borrower data, and all admin accounts 500.12
- Annual awareness training 500.14(a)(3)
- 72-hour incident notice and April 15 filing 500.17
- Notice of Exemption 500.19(f)
Not required doesn't always mean not worth doing. We'll tell you plainly which of the optional items are worth it for your brokerage — and which aren't.
What we deliver
Audit-ready documentation, built around your Microsoft tenant.
Examiners don't grade effort. They grade evidence. We produce the written program and the proof behind it, so when DFS asks, you hand it over.
Risk Assessment
A documented assessment of your real systems, vendors and data flows. Updated every year and whenever something material changes.
Asset Inventory
Every laptop, phone, mailbox and cloud app that touches borrower data — pulled straight from your Microsoft tenant, not guessed on a spreadsheet.
Access Reviews
Who can see what, reviewed and signed off. Includes onboarding and offboarding procedures so departing staff lose access the same day.
Vendor (TPSP) Policy
A third-party service provider policy and due-diligence records for every vendor that touches your nonpublic information.
MFA Evidence
Multi-factor authentication and Conditional Access configured correctly in Microsoft 365 — with exports an examiner can actually read.
Training Records
Annual cybersecurity awareness training, including social engineering, with completion records for your file.
Incident Notification Procedure
A one-page, plain-English procedure for the 72-hour notice to DFS: who calls whom, and what gets reported.
Annual Filing Support
Your Notice of Exemption and your April 15 certification or acknowledgment — prepared with you and ready to submit.
Why Microsoft
Your Microsoft tenant is the heart of your brokerage.
Email, files, Teams, identities, devices — for most brokers, nearly every piece of borrower data passes through Microsoft 365. That means your security posture is mostly your tenant's configuration.
The problem: Microsoft never stops changing. New policies, new security features, new licensing, and new names for old things. No human IT team could keep up, so most brokers are paying for security they already own and have never turned on.
Agentic AI changed that. AI agents can read a tenant's configuration, compare it to Microsoft's current guidance and the regulation, and draft both the fixes and the paperwork. That's how we lower your cost and raise your security at the same time.
Same product, new name. A few recent examples:
Azure Active DirectoryMicrosoft Entra IDOffice 365Microsoft 365Microsoft Endpoint ManagerMicrosoft IntuneMicrosoft Information ProtectionMicrosoft Purview Information Protection
If you've ever felt lost in the Microsoft admin portals, it isn't you.
How it works
AI does the heavy lifting. A human signs off.
We use AI to save you money, and every piece of it is reviewed by a person who knows Microsoft and knows mortgage.
Discovery call
Thirty minutes. We learn how your brokerage runs and check whether the small-business exemption applies.
Read-only tenant review
With your approval, AI agents review your Microsoft 365 configuration and gather evidence. Nothing changes without you.
Documentation drafted
Policies, risk assessment, asset inventory and procedures — drafted around what we actually found.
Human expert review
A Microsoft expert on our team reviews every document and recommendation before you see it.
Audit-ready, year-round
You get the binder and the evidence. We help you keep it current and file on time every April.
2026 is different
If your IT bill hasn't changed, ask what you're getting for it.
Everything in IT changed when AI agents learned to do work that used to take a human helpdesk: password resets, setting up a new loan officer, pulling audit evidence, drafting policies. That work got faster — and it should have gotten cheaper.
If you're still paying your IT company what you paid in 2023, you should be getting a whole lot more for it. This is a good year to look at your entire technology stack: what you pay for, what you use, and what an AI-assisted team can handle for less.
Questions to ask your IT provider this year
- Which of our routine requests are automated now — and how has that changed our price?
- Are we using the Microsoft security features we already pay for? Which ones are off?
- When someone leaves, how fast is their access removed — and can you prove it?
- Can you produce our 23 NYCRR 500 evidence on request?
- What does our contract look like next year, now that AI does more of the work?
Why Firewall Valley
We only work with mortgage brokers.
That focus isn't a limitation. It's why we're better at this than a generalist IT firm.
We speak mortgage
We've worked inside origination, compliance, onboarding and the software vendors that serve this industry. You won't spend the first meeting explaining what a processor does.
Small is the point
We know the exceptions New York makes for small businesses, and we build programs sized for a 5- or 15-person shop — not a bank.
No upselling
We tell you what you need and what you don't. In a market like this one, every dollar you don't spend on IT stays in your business.
New York first, all 50 states
New York has the strictest rules, so that's where we built our playbook. Everywhere else, the FTC Safeguards Rule applies to mortgage brokers — and we map your program to it too.
Ready to get compliant?
Most brokers are one audit away from a finding. Let's fix that before the examiner finds it.