S&P Global: Cyber security essentials for servicers

Over the last several years, cyber security, a crucial component in any servicer's operation, has taken on an increasingly visible role due to numerous high-profile data breaches impacting various industries. According to the cyber security research firm Check Point Research, the average number of cyber attacks per organisation per week rose 38% in 2022 from 2021, and increased by 28% in the six-month period ending March 31, 2024. 

The average number of weekly events has also grown year over year. They look at the importance of cyber security for U.S. and Canadian servicers and discuss how they assess a servicer's program in the evaluation review process. 

High cost of corporate inaction 

Inaction against preventing cyber attacks can come with a high cost and remediation actions. For example, International Business Machines Corp. (IBM) noted in its Cost of a Data Breach Report 2024 that the average cost of a corporate data breach in 2024 was $4.88 million, a 10% increase from the prior year and the largest yearly increase since the start of the COVID-19 pandemic.

Additionally, it was noted that 70% of organisations experiencing a breach indicated it was a significant or very significant disruption. Moreover, IBM said that 63% of organisations are planning to increase their security investments as compared to last year when the figure was 51%, focused mainly on employee training as the top investment area.

Remediation actions

Servicers have had to enforce corrective actions, including certain customer-facing activities

As a result of cyber attacks and breaches, servicers have had to implement various corrective actions, including suspending certain customer-facing activities (website access, payment processing, etc.) and halting internal operations until an investigation determines the method of attack, the impact on systems, and how to stop the attack. 

Remediation actions, in addition to addressing the source of the breach, generally include notifying affected customers and offering credit monitoring services for a predetermined period of time. It is also not uncommon for litigation to be initiated on behalf of the affected parties, alleging inadequate cyber security procedures as the cause of the breach.

Assessing a servicer's cyber security program

While servicers have implemented various cyber security tools and programs, hackers continue to design increasingly sophisticated malware with the potential to penetrate companies' defence systems. Though not all companies have been impacted by cyber breaches, hackers are increasingly using AI and other tools to develop malware that can infiltrate even the most cutting-edge applications, so a servicer's cyber security program becomes even more important as hackers evolve.

S&P Global Ratings' servicer evaluation group recognises that a sound cyber security program is a significant factor in the overall analysis of a servicer's operations. When conducting an operational assessment of a servicer, they ask the company to describe its overall cyber security program. The general topics they discuss include the following:

• Its information security program and management team (e.g., the CEO, chief information officer, and chief information security officer); 
• Staff resources dedicated to monitoring company systems to triage and address potential cyber security threats; 
• Frequency of phishing and/or smishing testing programs, overall click rates, and remediation actions; 
• Timing of vulnerability scans and what internal and external tools are employed to assist in monitoring and identifying potential threats; 
• The incorporation of AI into the servicer's preventive tools and systems used to combat attacks and secure systems; 
• Frequency of external penetration tests and the vendor's rotation schedule, along with a discussion of the latest results; 
• Frequency of internal penetration testing and the results of the last test; 
• The servicer's data storage backup routines, including how data is backed up (i.e., the cloud, tapes, or both) and whether data is stored on air-gapped mediums; 
• Recovery time and recovery point objectives for the servicer's data and business units; 
• Frequency of a servicer's recovery exercises, including data backups to validate their restoration ability; 
• Data encryption practices at rest and in transit; 
• Plans to address potential ransomware attacks and the frequency of tabletop exercises; 
• Employee training on cyber and information security, including social engineering; 
• System and organisation controls (SOC) 2 certification or other evaluations or tools used to assess the company's cyber security posture; and 
• The process to evaluate third-party vendors' cyber security posture.

Staying ahead of the curve 

Sustained investments in cyber security will be crucial for any business entity, especially servicers, as they will continue to experience ever-evolving threats requiring additional expertise, capital, and technology to stay ahead of the curve.

Despite servicers' significant expenditure on cyber security staff and systems to support their programs, these preventative measures are only effective if the program is successfully implemented and maintained. Notwithstanding, even the best preventative measures will be continuously challenged by the ever-increasing sophistication of attacks. 

Event-reporting regulations

New privacy and event-reporting regulations and compliance needs from California and New York

A key focus for servicers will be whether they can keep up with the malicious actors who try to penetrate their systems and obtain non-public information, thereby disrupting operations, affecting customers, and posing significant financial harm to the company. 

New privacy and event-reporting regulations and compliance requirements from the states of California and New York impacted various industries including servicers, among others. Although not directly affecting servicing, the Securities and Exchange Commission has also stated that cyber security is one of its 2024 priorities when conducting examinations of broker-dealers and investment advisors. 

New government regulations

As servicers navigate ever-increasing cyber threats and the rollout of new government regulations, their dependence on the digitisation of information and processes should be balanced with comprehensive and preventative cyber security controls in order to effectively combat the risks that lie ahead.

While this article focuses on the impacts of cyber security for the Servicer Evaluation ranking process, S&P Global Ratings has written additional articles that relate to cyber security across other industries and the potential credit impacts that they may have (see "Cyber Risk Insights: Navigating Digital Disruption Booklet Published," published July 9, 2024, and "Digital Booklet Published: Cyber Risk Insights," published Feb. 22, 2023). The analysts would like to thank Marilyn Cline for her contribution to this report.