Cyber Resilience · Mortgage brokers
Cyber security for mortgage brokers
Fixed-price Microsoft 365 security for mortgage brokers. We protect the passports, payslips and bank statements sitting in your mailboxes, stop the email fraud that targets your clients, and give you a record to show when a network, lender or insurer asks.
"The lender has asked for fresh copies of your passport, your last three payslips and three months of bank statements. Please upload them using the link below today so we don't lose the rate."
Why brokers are targeted
A mortgage application is an identity kit. Passport or driving licence, proof of address, payslips, P60s, bank statements, sometimes a credit report. Most brokers collect them by email, and most of those emails are still sitting in someone's inbox years later.
That makes a broker's mailbox valuable. Whoever gets into it can use those documents to open accounts or take out credit in your clients' names. They can also write to clients from your real address, asking for more documents, or for a deposit or fee to be paid somewhere new.
The way in is rarely clever. A fake Microsoft sign-in page, a password used on another site, an account without MFA. Once inside, a forwarding rule can copy every new email out of the firm without anyone noticing.
Who asks, and what they ask for
The ICO
You're responsible for the personal data you hold. The ICO's guide to data security expects appropriate technical and organisational measures, and calls Cyber Essentials a good starting point. If a breach puts people at risk, you must tell the ICO, where feasible within 72 hours.
Your network
If you're an appointed representative, your principal is responsible for you and should oversee and monitor what you do. Your network may set its own data security rules and audit them.
The FCA
Directly authorised brokers fall under the FCA's Principles for Businesses. Principle 3 requires you to organise and control your affairs responsibly and effectively, with adequate risk management systems.
Lenders and insurers
Lender panels and insurers set their own terms and questionnaires, and they vary. When one asks about MFA, managed devices or how you handle client documents, you want to answer yes, with evidence.
The controls that matter most for brokers
On Self-Service we configure these and leave them in report-only for your own IT person to switch on. On Managed we enforce them and keep them right.
Keep less, lose less
The safest client document is the one you no longer hold. UK GDPR says personal data must be kept for no longer than necessary, and the ICO's storage limitation guidance is clear that the law doesn't set specific time limits. You decide, write it down, and review.
Some records have a minimum. For advised mortgage sales, MCOB 4.7A.25R requires you to keep the customer information you used and the reasons for your recommendation for at least three years from the date of the advice. Your network or lenders may ask for longer. Agree a period with your compliance support, then let Microsoft 365 enforce it rather than relying on memory.
Fixed price, before we start.
One fixed price for a typical 10-user brokerage, agreed before we start. Tell us on the call if your network has its own security requirements and we will work to them.
A full assessment and configuration of your Microsoft 365, controls set to report-only, handed over for your own IT person to run.
We enforce the controls and keep them right, with business-hours incident response and plain-English reporting. Where most firms start.
Everything in Managed, plus 24/7 monitoring, incident response at any hour, and Cyber Essentials alignment.
Prices for a typical 10-user organisation. Managed and Managed Plus run on a 12-month term. Larger firms get exact figures after the consultation. Compare the options control by control →
A real breach, and what we rebuilt.
A UK company trusted with sensitive client data came to us after a phishing attack reached their clients. In just under two months we rebuilt their Microsoft 365 security from the ground up.
&DEV is itself certified to Cyber Essentials Plus across the whole organisation, independently audited, valid until 2 October 2027.
Conditional Access, phishing-resistant MFA for admins and risk-based sign-in blocks, so a stolen password alone no longer opens client files.
Admin accounts under PIM with approval workflows and monitored break-glass accounts, so admin rights are granted only when needed, and logged.
Every device hardened in Intune with Defender for Endpoint, and SPF, DKIM and DMARC enforced, so only trusted devices connect and nobody can spoof the company.
Defender watching for anomalies and OAuth abuse: around 96 controls in all, to a Cyber Essentials Plus-aligned baseline.
Questions mortgage brokers ask us
01 Do appointed representatives need their own controls?
Usually, yes. Your principal is responsible for overseeing you, but unless your network supplies and runs your email and devices, the Microsoft 365 your advisers use is yours to secure. Your network may also set rules you must meet. We can work to them and give you the evidence.
02 How long should we keep client ID?
No longer than you need it. UK GDPR doesn't set fixed periods, so set your own and write it down. For advised mortgage sales, MCOB 4.7A.25R requires the customer information and the reasons for your advice to be kept for at least three years from the date of the advice, and your network or lenders may ask for longer. Agree a period with your compliance support, then delete on schedule.
03 Do we need Cyber Essentials?
We're not aware of an FCA rule that requires it, but a network, lender or insurer may ask for it, and the ICO calls it a good starting point. The uplift covers the Microsoft 365 side of Cyber Essentials, and Managed Plus includes Cyber Essentials and Cyber Essentials Plus alignment.
Book a 30-minute consultation.
A straightforward call with an engineer, not a salesperson. We'll talk through where firms like yours are most exposed and how the uplift would work for you. No system access, no obligation.
