Sec5-P34

During a cybersecurity risk assessment, a lender discovers that IT staff cannot produce a complete inventory of laptops, desktops, servers, mobile devices, and installed software connected to the company’s network. Several older devices are still accessing systems even though they are not documented.

A mortgage company created a network map several years ago but has not updated it as new systems, remote users, and cloud connections were added. The company also does not actively monitor all connection points.

A lender suffers a ransomware attack that disables loan origination and servicing systems. Management realizes there is no documented plan explaining how operations will be restored or how systems will be brought back online.

A lender backs up its data once per month to a single hard drive that is stored in the same building as its servers. No cloud or offsite backups are maintained.

An MLO refers a borrower to a settlement service provider in which the MLO owns a 3% interest. The borrower is never informed of this ownership relationship.

An MLO orders a credit report for a consumer who has contacted the company to determine whether they might qualify for a mortgage and what interest rate they could expect.

An MLO pulls a borrower’s credit report without first obtaining a signed authorization form.

A credit reporting agency releases a consumer’s credit report in response to a subpoena issued in connection with a federal grand jury investigation.

A lender obtains a consumer’s credit report in connection with a licensing application.

A state child support enforcement agency requests a consumer’s credit report to establish or modify a child support order.