Mortgage & Title CyberSecure
Starter Kit$149
Professional$249
ALTA Pillar 3 guide
ALTA Best Practices Pillar 3 information security policy template
Pillar 3 asks title and settlement companies for a written information security plan and a written privacy plan. Here is what that means in plain English, and an editable WISP that maps to it.
- Plain English
- Editable Word & Excel
- Free self-assessment
Updated October 18, 2026 · Get the free self-assessment
The requirement
What Pillar 3 asks for, in plain English
ALTA's Title Insurance and Settlement Company Best Practices are the industry framework that lenders and underwriters ask title agents to follow. Version 5.0 took effect on October 8, 2026, and keeps information security as Pillar 3, Information Security and Privacy Plans.
Pillar 3 says to adopt and maintain a written information security plan (WISP) and a written privacy plan to protect nonpublic personal information (NPI), as required by local, state and federal law. NPI includes the Social Security numbers, bank accounts, loan figures and ID documents in every closing file.
Most non-bank lenders, brokers and settlement agents are also financial institutions under the FTC Safeguards Rule. That rule spells out what the WISP has to contain: a Qualified Individual, a written risk assessment, MFA, encryption, training, vendor oversight, an incident plan and FTC notice within 30 days for breaches involving 500 or more consumers.
Version 5.0 also makes vendor management its own pillar (Pillar 7). The kit's service provider policy and questionnaire help with that too.
Requirement by requirement
Where each requirement is covered in the Mortgage & Title CyberSecure kit
Every document is editable Word or Excel. Items marked Pro are in the Professional Edition only.
| Requirement | What it means for you | Kit documents |
|---|---|---|
| Written information security plan (Pillar 3) | One document describing how you protect NPI. |
|
| Written privacy plan (Pillar 3) | How you collect, share and give notice about NPI. |
|
| Risk assessment and NPI inventory | Know where closing data lives and what threatens it. |
|
| Access control, MFA and encryption | Lock down production, title and e-closing systems. |
|
| Secure disposal | Shred and wipe NPI you no longer need. |
|
| Wire and payoff verification | Call-back verification before any wire or payoff change. |
|
| Identity verification and impersonation fraud | Verify signers and train staff to spot impersonation. |
|
| Vendor management (Pillar 7) | Vet and monitor the vendors who touch NPI. |
|
| Incident response and breach notice | A plan for incidents, including FTC and investor notices. |
|
See a sample page
What the Written Information Security Program (WISP) looks like
Plain-language templates with bracketed fields for your details, policy IDs that stay the same when you upgrade, and a footer reminding you to customize before use.
- Download right after checkout
- Edit in Microsoft Word, Google Docs or any word processor
- One-time price: Starter $149 · Professional $249
What's inside
Every file in each edition
Policy numbers carry over from the Starter Kit to the Professional Edition, so you can start small and upgrade without renumbering.
Starter Kit
$14924 editable files
Policies 15
- MT-CYB-001Information Security Program & Qualified Individual Policy
- MT-CYB-002Risk Assessment & Customer Information Inventory Policy
- MT-CYB-003Access Control & Least Privilege Policy
- MT-CYB-004Multi-Factor Authentication Password Policy
- MT-CYB-005Encryption & Secure Information Exchange Policy
- MT-CYB-006Acceptable Use & Workstation Security Policy
- MT-CYB-007Email Security, Phishing & Impersonation Policy
- MT-CYB-008Personnel Security & Confidentiality Policy
- MT-CYB-009Security Awareness & Training Policy
- MT-CYB-010Physical Security & Clean Desk Policy
- MT-CYB-011Backup, Recovery & Business Continuity Policy
- MT-CYB-012Records Retention & Secure Disposal Policy
- MT-CYB-013Service Provider Oversight Policy
- MT-CYB-014Incident Response & Notification Policy
- MT-CYB-015Remote Work & Mobile Device Policy
Plans, guides & assessments 8
- WordImplementation Guide
- WordStaff Cybersecurity Quick Guide
- WordIncident Response Plan
- WordWritten Information Security Program (WISP)
- WordClient Wire Fraud & Information Security Advisory
- Word30-60-90 Day Action Plan
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
Workbook 1
- ExcelMortgage & Title CyberSecure Toolkit
Professional Edition
$24942 editable files
Policies 21
- MT-CYB-001Information Security Program & Qualified Individual Policy
- MT-CYB-002Risk Assessment & Customer Information Inventory Policy
- MT-CYB-003Access Control & Least Privilege Policy
- MT-CYB-004Multi-Factor Authentication Password Policy
- MT-CYB-005Encryption & Secure Information Exchange Policy
- MT-CYB-006Acceptable Use & Workstation Security Policy
- MT-CYB-007Email Security, Phishing & Impersonation Policy
- MT-CYB-008Personnel Security & Confidentiality Policy
- MT-CYB-009Security Awareness & Training Policy
- MT-CYB-010Physical Security & Clean Desk Policy
- MT-CYB-011Backup, Recovery & Business Continuity Policy
- MT-CYB-012Records Retention & Secure Disposal Policy
- MT-CYB-013Service Provider Oversight Policy
- MT-CYB-014Incident Response & Notification Policy
- MT-CYB-015Remote Work & Mobile Device Policy
- MT-CYB-016Wire Transfer, Closing Funds & Payoff Verification Policy
- MT-CYB-017Identity Verification & Impersonation Fraud Policy
- MT-CYB-018Vulnerability Management & Security Testing Policy
- MT-CYB-019Generative AI & Cloud Application Use Policy
- MT-CYB-020Privacy Notice & Information Sharing Policy
- MT-CYB-021AI Governance Policy
Plans, guides & assessments 10
- WordProfessional Edition Implementation Guide
- WordIncident Response Plan & Playbooks
- WordTabletop Exercise Kit
- Word30-60-90 Day Action Plan
- WordStaff Cybersecurity Quick Guide
- WordWritten Information Security Program (WISP)
- WordClient Wire Fraud & Information Security Advisory
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
- Word50-Question Mortgage & Title Cybersecurity Self-Assessment
Forms & templates 10
- FORM-01Wire Instruction & Payoff Verification Form
- FORM-02Access Request Form
- FORM-03Staff Offboarding Checklist
- FORM-04Software, SaaS & AI Tool Request Form
- FORM-05Security Exception Request
- FORM-06Incident Intake Form
- FORM-07Service Provider Security Questionnaire
- FORM-08Confidentiality Policy Acknowledgment Form
- FORM-09Breach Notification Worksheet
- FORM-10Qualified Individual Annual Report
Workbook 1
- ExcelMortgage & Title CyberSecure Professional Toolkit
Questions
Frequently asked questions
What is ALTA Best Practices Pillar 3?
In Version 5.0 (effective October 8, 2026), Pillar 3 is Information Security and Privacy Plans: adopt and maintain a written information security plan and a written privacy plan to protect NPI as required by law.
Did Version 5.0 change the pillar numbers?
Some. Information security stays at Pillar 3, and vendor management becomes its own Pillar 7. Check ALTA's 5.0 framework for the full list.
Is ALTA Best Practices a law?
No. It is an industry framework. The legal requirement for most title and settlement agents and non-bank lenders comes from the FTC Safeguards Rule and state law.
Does this kit include wire fraud controls?
Yes. The Professional Edition includes a wire transfer, closing funds and payoff verification policy, a verification form and a client wire fraud advisory.
Is this legal advice or an ALTA certification?
No. Cybriva is not affiliated with ALTA. These are editable templates and plain-English education, not a certification or compliance determination.
Free download
Free Mortgage & Title cybersecurity self-assessment
Answer 50 yes / no / not sure questions across 10 areas. Score your results and get clear next steps for your industry.
- Small Business, Law Office, Real Estate, Healthcare, Accounting & Tax, Insurance Agency, Financial Advisor, Auto Dealer, Mortgage & Title, and Cyber Insurance Readiness editions
- Starred priority questions and a scoring table
- Printable PDF
Your assessment is ready
Thanks. Your download should start automatically. If it doesn't, use the button below.
Download the PDFQuestions about your results? Email info@cybriva.ai.
Ready to put it in writing?
Get the Mortgage & Title CyberSecure kit
Start with the Starter Kit or get every policy, form and workbook in the Professional Edition. Policy numbers carry over if you upgrade.
See the full Mortgage & Title CyberSecure pageSources
- ALTA Best Practices Framework, Version 5.0 (effective Oct. 8, 2026)
- ALTA: proposed Best Practices 5.0 revisions
- 16 CFR Part 314, FTC Standards for Safeguarding Customer Information (eCFR)
- FTC Safeguards Rule notification amendment, 88 Fed. Reg. (Nov. 13, 2023)
This guide is plain-English education, current as of October 18, 2026. It is not legal advice, an audit or a compliance determination, and Cybriva is not affiliated with any regulator or standards body named here. Rules change and vary by state; confirm how they apply to you with your attorney or compliance advisor.