Updated September 01, 2026

TL;DR: Texas real estate brokerages face compliance obligations from four sources: TREC’s four-year record retention rule, the GLBA Safeguards Rule for settlement service providers, NAR’s voluntary wire fraud and MFA guidance, and carrier-mandated controls for cyber insurance binding. This checklist maps all four to 90+ yes/no items and produces a scored document an underwriter, auditor, or TREC examiner can review on demand.

Texas real estate firms face documented cybersecurity compliance obligations from four distinct sources: TREC record retention rules, the GLBA Safeguards Rule (for settlement and title operations), NAR cybersecurity guidance, and cyber insurance carrier underwriting requirements. This checklist maps all four frameworks to 90+ yes/no control items. Completing it produces a scored document you can file for an insurance renewal, an internal audit, or a carrier questionnaire, backed by real estate cybersecurity services Texas field expertise.

Cybersecurity Compliance Checklist for Texas Real Estate: TREC, GLBA, NAR, and Cyber Insurance (2026)

The FTC’s updated Safeguards Rule explicitly names real estate settlement service providers as covered financial institutions. Most IT people at brokerages manage TREC, GLBA, NAR, and carrier requirements separately, with records in one folder, questionnaire answers in another, training records somewhere else. For providers that help consolidate this work, see best cybersecurity services 2026.

This checklist maps all four frameworks to a single set of yes/no control items. A “No” answer is not a failure, it’s a documented gap, the exact artifact an underwriter, auditor, or examiner needs.

Disclaimer: This checklist is for internal compliance use, not legal advice. Consult a licensed attorney for your specific regulatory obligations.

How to Use This Checklist

This checklist has five framework sections plus a vendor evaluation section. Each item is a yes/no question. “Yes” means you have the control in place and can document it. “No” means you have a gap. Document the gap, not the wish. A scored checklist with documented gaps is what an underwriter or auditor needs to see.

Score (No answers)	Exposure Level	Recommended First Step
0–3	Low	Verify documentation is current and accessible on demand
4–10	Moderate	Prioritize cyber insurance carrier requirements first (Section 4)
11–20	High	Start with MFA enforcement and backup verification, then work the list
21+	Critical	Schedule a gap review before your next carrier renewal date

The PDF version is print-ready for binders, audit files, and carrier submissions. The Excel version includes auto-scoring formulas. TechProComp’s self-scored version appears in Section 5 as a reference point.

Section 1: TREC Record Retention and Data Handling

TREC’s record retention requirement applies to every Texas real estate brokerage regardless of size. Under TREC Rule 535.2(h) (22 Texas Administrative Code), brokers must maintain transaction records for a minimum of four years in a format “readily available to the Commission”, which explicitly covers digital and cloud-stored records. The four-year window runs from closing, contract termination, or end of transaction.

A brokerage that cannot produce any of these on demand at a TREC inspection is exposed, regardless of whether it has experienced a breach.

Written Retention Policy

A written policy is the baseline TREC expects to see. These items confirm you have one.

• [ ] A written data retention policy exists, is dated, and names a responsible party
• [ ] The policy specifies the 4-year retention period for all eight TREC-enumerated record categories
• [ ] The policy covers digital records stored in cloud systems (not just physical files)

Digital Record Storage and Access Controls

TREC inspections can include a review of who accessed records. An audit trail distinguishes a documented retention program from a folder on a shared drive.

• [ ] Transaction records are stored in an access-controlled system (not a shared public drive)
• [ ] Access to transaction record systems follows least-privilege (agents access only their own files)
• [ ] An audit trail is available showing who accessed or modified records and when
• [ ] Employee offboarding removes access to transaction record systems within 24 hours of departure

Backup and Restore Verification for Transaction Records

Undocumented backups satisfy neither a TREC examination nor a carrier questionnaire. The restore must be tested and recorded.

• [ ] Transaction records are backed up at least daily
• [ ] A restore test of transaction records was completed within the past 12 months
• [ ] Restore test results are documented (date, files restored, result)

Section 2: GLBA Safeguards Rule (Financial Data and Title/Settlement)

The GLBA Safeguards Rule applies to Texas real estate brokerages that receive nonpublic personal financial information from mortgage buyers or participate in settlement and closing services. Under 16 CFR 314.2, “an entity that provides real estate settlement services is a financial institution.” The FTC’s Safeguards Rule requires covered financial institutions to “develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information.” Section 314.4 identifies nine required elements, covering areas from risk assessment and access controls to MFA, penetration testing, and incident response. The updated technical safeguards took effect June 9, 2023.

For foundational context, see cybersecurity for real estate.

One client on the documentation challenge:

They have simplified dozens of IT issues our company had and have really brought a level of organization and security to our team. – Kelly Shoemaker on Google

Written Information Security Program Requirements

The GLBA requires a written information security program (WISP) with a named coordinator and documented annual review. Per the FTC’s guidance on 16 CFR 314.4(a), covered institutions must “designate a Qualified Individual to implement and supervise your company’s information security program,” who can be “an employee of your company or can work for an affiliate or service provider.”

• [ ] A written information security program (WISP) exists and is dated
• [ ] A qualified individual is named in the WISP as responsible for overseeing and enforcing it
• [ ] The WISP has been reviewed and updated within the past 12 months
• [ ] The qualified individual provides a written annual report to the board or equivalent governing body on program status

Risk Assessment and Safeguards Documentation

The Safeguards Rule requires a written risk assessment: a document with categorized risks and mitigation decisions on file, not a mental model.

• [ ] A written risk assessment was completed within the past 12 months
• [ ] The assessment identifies reasonably foreseeable risks to customer information
• [ ] Risks are categorized with mitigation status documented (mitigated, accepted with rationale, in progress)
• [ ] MFA is implemented for all individuals accessing any information system (mandatory per 16 CFR 314.4(c)(5))
• [ ] All customer information is encrypted both in transit over external networks and at rest
• [ ] A penetration test was conducted within the past 12 months (required absent effective continuous monitoring)
• [ ] Vulnerability assessments are conducted at least every six months

Vendor Oversight and Employee Training

The Safeguards Rule requires service providers to maintain appropriate safeguards by contract (16 CFR 314.4(f)). Under Section 314.4(j), a “notification event” requiring FTC reporting is defined as “a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information,” with notice required “as soon as possible – and no later than 30 days after discovery.”

• [ ] Technology vendors with access to customer data are required by contract to implement appropriate safeguards
• [ ] A vendor security assessment was completed for each critical vendor in the past 12 months
• [ ] GLBA security awareness training was completed by all employees in the past 12 months
• [ ] Training completion is recorded by employee name and date
• [ ] A written incident response plan exists covering FTC notification procedures for events affecting 500+ consumers

Section 3: NAR Cybersecurity Guidance

NAR does not impose regulatory requirements the way TREC or GLBA do. The checklist items here reflect NAR’s Cybersecurity Checklist, which NAR describes as “best practices to help you curb the risk of cybercrime.” This is voluntary guidance with no enforcement mechanism. A “No” here creates no FTC exposure, but it does create wire fraud exposure, and cyber insurance carriers ask about these same controls.

According to NAR’s FBI IC3 data, cyber criminals stole more than $275 million through real estate-related fraud from 12,368 victims in 2025. A compromised agent email account is the primary entry point for wire redirect attacks.

Wire Fraud and Business Email Compromise Controls

NAR’s two highest-priority controls: MFA on all email accounts and a written wire transfer verification procedure.

• [ ] All agent and staff email accounts have MFA enabled
• [ ] A written wire transfer verification procedure exists, all wire instructions are verified by a phone call to a known, independently sourced number before funds move
• [ ] Wire instruction changes received by email are treated as suspicious regardless of sender
• [ ] DMARC, DKIM, and SPF are configured on the brokerage domain to reduce email spoofing
• [ ] A written wire fraud disclosure is provided to clients at the start of each transaction (NAR Wire Fraud Email Notice Template or equivalent)
• [ ] Per NAR guidance, agents use encrypted email, a transaction management platform, or a document-sharing program when transmitting sensitive information

Agent Training and Incident Response

NAR recommends annual cybersecurity training and a written incident response procedure covering BEC scenarios. See wire fraud protection guide for implementation guidance.

• [ ] Annual cybersecurity awareness training was completed by all agents and staff, with records (also required by GLBA and most carrier questionnaires)
• [ ] Training covers phishing, BEC, and wire fraud scenarios specifically
• [ ] A written incident response procedure exists and names what to do if wire fraud is suspected
• [ ] A confirmed phishing simulation was conducted in the past 12 months, or a documented alternative training method was used

Section 4: Cyber Insurance Carrier Requirements

Carriers in 2025-2026 require documented security controls before binding or renewing coverage. A “No” on any item below is a premium driver or denial risk. According to Coalition, MFA is one of the five essential controls insurers look for before agreeing to provide cyber insurance coverage, citing it as a necessity for preventing unauthorized account access. Coalition’s separate claims data has found that the large majority of cyber insurance claims involve organizations that lacked properly enforced MFA. CyberDuo’s 2026 renewal analysis documents that carriers now explicitly cite missing controls like MFA and EDR as reasons to refuse coverage, and that a focused 30-day sprint to close common gaps is often enough to make a submission underwriter-ready. Carriers now require evidence of controls: screenshots, EDR exports, and backup logs, not self-attestation.

One reviewer on what a security-focused MSP engagement delivers:

TechProComp has been instrumental in filling in as an outsourced network administrator, helping the client make their network more secure by finding and fixing important vulnerabilities. – Keith Kelley on Clutch

See also real estate cybersecurity features.

Identity and Access Controls

Carriers require MFA enforced (not optional), meaning users cannot bypass it.

• [ ] MFA is enforced (not optional) on all email accounts, including shared mailboxes and service accounts
• [ ] MFA is enforced for all remote access: VPN, RDP, SSH
• [ ] Privileged/admin accounts use separate credentials from standard user accounts
• [ ] An access review was completed within the past 6 months confirming active accounts belong to current employees
• [ ] Privileged access management (PAM) controls are in place for admin account usage

Endpoint and Network Security

Most carriers require EDR or MDR across all endpoints. Traditional antivirus does not satisfy this requirement.

• [ ] EDR or MDR is deployed on all endpoints: laptops, desktops, and servers
• [ ] No end-of-life operating systems are present on the production network
• [ ] Network segmentation is documented (at minimum, guest network separated from corporate)
• [ ] Firewall rules were reviewed within the past 12 months and unused rules removed
• [ ] Critical patches are deployed within 14 days of release
• [ ] A written patch management policy exists and is dated

Backup and Recovery

Carriers require immutable offsite backups with documented restore tests. A dated restore test result on file, not self-attestation.

• [ ] Backups are stored offsite or in cloud storage, separate from the primary network
• [ ] Backups are immutable, ransomware cannot encrypt or delete the backup copy
• [ ] A backup restore test was performed and documented within the past 12 months (date, scope, result on file)
• [ ] Recovery point objective (RPO) and recovery time objective (RTO) are documented

Incident Response and Policy Documentation

Carriers require an IRP that names people, not just describes processes, with tabletop exercise evidence on file.

• [ ] A written incident response plan (IRP) exists, is dated, and names a coordinator and backup
• [ ] The IRP was tested via a tabletop exercise or simulation within the past 12 months, with notes on file
• [ ] A cyber event notification procedure is documented, including escalation order
• [ ] The brokerage’s cyber insurance policy number and carrier contact are documented and accessible without email login

Section 5: SOC 2 Vendor Expectations

Enterprise real estate clients and title companies increasingly require their technology vendors (MSPs, SaaS platforms, cloud storage providers) to produce a SOC 2 Type II report before approval. A SOC 2 Type II report covers both design and operating effectiveness of controls over a minimum six-month period. The five AICPA Trust Service Criteria are Security (required in every audit), Availability, Processing Integrity, Confidentiality, and Privacy.

One reviewer on vendor-level accountability:

This level of dedication and immediacy is unique; it makes a significant difference in our experience with them. – Verified User on Clutch

The checklist items below are for evaluating your technology vendors, not your own internal SOC 2 posture.

• [ ] All technology vendors with access to client data or brokerage systems have been asked to provide a SOC 2 Type II report
• [ ] A vendor security review was completed for each critical vendor within the past 12 months
• [ ] New vendor onboarding includes a security questionnaire before access is granted
• [ ] Vendor access to brokerage systems is scoped to least privilege, no vendor has broader access than their service requires
• [ ] Vendor offboarding removes all system access within 24 hours of contract end
• [ ] Vendor contracts include a requirement to maintain appropriate security safeguards
• [ ] A record of which vendors have provided SOC 2 reports and the report dates is maintained

TechProComp self-scoring reference: TechProComp is SOC 2 certified (verified March 2026). As an MSP with access to client IT infrastructure, TechProComp’s SOC 2 report is available on request for vendor due diligence.

Frequently Asked Questions

What cybersecurity compliance does a Texas real estate firm need?

Four sources: TREC Rule 535.2(h) (four-year record retention), the GLBA Safeguards Rule (written information security program for settlement service providers), NAR voluntary cybersecurity guidance, and cyber insurance carrier controls documentation (MFA, EDR, backup verification, written IRP).

Does TREC require cybersecurity?

TREC does not mandate a named security framework. It requires record retention: eight categories of transaction records, four years, in a format “readily available to the Commission.” A brokerage without access controls and a tested backup is exposed at inspection even without a breach. Confirm your access controls and backup documentation are current before any inspection date.

Does GLBA apply to real estate brokerages?

Yes, for any brokerage involved in settlement services or receiving buyer financial data. Under 16 CFR 314.2, real estate settlement service providers are explicitly named as financial institutions. Consult legal counsel if your scope is unclear.

What does NAR recommend for cybersecurity?

MFA (“use two-factor authentication whenever it is available”), a written wire transfer verification procedure, encrypted email for wire instructions, annual cybersecurity training, and a breach notification policy. NAR guidance is voluntary with no enforcement mechanism.

How do I fill out a cyber insurance questionnaire?

Complete this checklist first. Carriers ask about MFA enforcement, EDR coverage, backup immutability, restore test dates, and IRP testing history. Per industry data, carriers require evidence, not self-attestation.

Key Terminology

TREC (Texas Real Estate Commission): Texas state agency licensing and regulating real estate brokers. Rule 535.2(h) requires four-year retention of eight transaction record categories in a format readily available to the Commission, including digital and cloud records.

GLBA Safeguards Rule: The FTC’s Standards for Safeguarding Customer Information (16 CFR Part 314), requiring covered financial institutions, including real estate settlement service providers, to implement a written information security program. Updated June 9, 2023.

Written Information Security Program (WISP): GLBA-required compliance document naming a qualified individual, documenting a risk assessment, mapping safeguards to risks, addressing vendor oversight, covering employee training, and containing a written incident response plan.

EDR (Endpoint Detection and Response): Security tool monitoring endpoints for malicious behavior and responding to active threats. Distinct from antivirus, which only blocks known signatures. Carriers treat EDR as a required control.

MFA (Multi-Factor Authentication): Authentication requiring two or more verification factors. GLBA mandates MFA for all individuals accessing any information system. Carriers require it enforced on all email and remote access.

Incident Response Plan (IRP): Written document defining steps, roles, and escalation paths for a cybersecurity event. GLBA requires notification procedures covered. Carriers require tabletop exercise testing within the past 12 months.

Immutable Backup: A backup that cannot be altered or encrypted after writing. Protects against ransomware encrypting backup copies. Carriers require immutability paired with a documented restore test.

If any checklist item returned a “No,” you have a documented gap. TechProComp’s 30-minute compliance gap walkthrough reviews your scored checklist, identifies which gaps create the highest carrier or audit risk, and shows you exactly what it would take to close them, with no obligation. Book a compliance gap walkthrough.

---