ALTA Best Practices: What the IT and Security Pillars Actually Ask For

What are the ALTA Best Practices?

The ALTA Best Practices are a set of seven standards the American Land Title Association publishes for title agencies and settlement companies. They cover licensing, escrow money, data security, closings, title policies, insurance, and consumer complaints. ALTA calls them “voluntary.” The current framework is version 4.2, approved by ALTA’s Board of Governors in June 2025 and effective August 19, 2025.

Here are the seven pillars, numbered the way ALTA numbers them:

1. Maintain current licenses.
2. Written procedures and controls for escrow trust accounts.
3. A written information security plan (WISP) and a written privacy plan to protect NPI.
4. Settlement policies and procedures.
5. Title policy production, delivery, reporting, and premium remittance.
6. Insurance and fidelity coverage.
7. Written procedures for resolving consumer complaints.

The framework has three parts: the Best Practices document, the Assessment Procedures an assessor works from, and a certification package. Everything below is taken from those documents and ALTA’s Best Practices page.

Which pillars are about IT and security?

Pillars 2 and 3 are where IT does the work. Pillar 3 is all information security. Pillar 2 is about money, but it’s also where ALTA puts wire fraud, and wire fraud starts in somebody’s inbox. The other pillars touch IT around the edges. Pillar 4 asks for an identity fraud prevention program for signers and vetted remote notarization platforms. Pillar 6 calls for cyber liability insurance.

Pillar 2 says a written wire transfer procedure has to be “in place and tested at least annually.” For outgoing wires, that procedure has to verify wire instructions “independent of the initial communication.” The framework also says it “should include the use of multi-factor authentication.” You also need a written wire fraud response procedure built on ALTA’s Rapid Response Plan for Wire Fraud Incidents, reviewed every year. And former employees have to come off the escrow account signer list right away.

That’s the scenario in our BEC wire fraud incident report. An attacker got into a closer’s inbox and sent new wire instructions on a real closing. What saved the wire was a phone call to the other side, made outside of email. That’s the independent verification Pillar 2 asks for. The attacker got in because MFA was enrolled but not enforced.

What does Pillar 3 (NPI) require?

Pillar 3 requires a written information security plan sized to your company that protects NPI: names combined with things like Social Security, driver’s license, or account numbers. ALTA’s Pillar 3 text points to the Gramm-Leach-Bliley Act as the legal reason title companies need one. The WISP has to cover:

• Multi-factor authentication, if available, on systems that hold NPI.
• Passwords: unique logins, re-entering the password after the system idles, and complex passwords at least eight characters long.
• Timely software updates.
• Physical security: background-checked access only, removable media prohibited or controlled, and NPI on paper locked up.
• Network and cloud security, whether the data sits in your office, a data center, or a vendor’s cloud.
• Acceptable use guidelines for company IT.
• A business continuity and disaster recovery plan and an incident response plan, both written and both tested periodically. The incident response plan has to include everything in ALTA’s Cybersecurity Incident Response Plan template.
• Training on the WISP and on current threats.
• Records retention and disposal that follows the law.
• Vendor oversight: service providers and software with access to NPI, including “IT consultant employees” and AI tools, need security policies consistent with your WISP.
• A published privacy policy.

Version 4.2 also names systems that weren’t built to hold NPI but can let someone in: guest Wi-Fi, smart devices, climate control, and personal devices plugged into the office network.

If you’re a title company, your IT provider is on that vendor list. Ask them how they’ll show up in your WISP.

Is ALTA Best Practices certification required?

Not by ALTA. ALTA calls the practices voluntary, and it doesn’t certify anyone. ALTA’s Best Practices FAQ says it “does not perform any Best Practices assessments, nor does ALTA certify any company’s compliance,” and it has no badge for it either. The certification is a letter you produce. You can do an internal assessment and sign a representation letter, or hire a third party to run the Assessment Procedures. You send the result to your lender partners or underwriter if they ask for it. You don’t send it to ALTA.

In practice, the requirement comes from your lenders and underwriters. ALTA suggests renewing every 24 months. Its FAQ also says each lender and underwriter “is free to choose a shorter or longer timeline.” So check what your lenders actually ask for.

What evidence will an assessor or underwriter ask for?

Assessors want records, not promises. The Assessment Procedures tell them to “obtain evidence” and to test samples. For Pillars 2 and 3, here’s what IT has to be able to hand over:

• The WISP, reviewed and updated at least annually, covering every section of Pillar 3.
• A risk assessment that lists where NPI is stored, processed, sent, and disposed of, ranks the threats, and records how the WISP gets tested and how gaps get fixed.
• Training records: WISP training at hire and refresher training every year.
• A user ID list for every system that holds NPI, showing that each ID belongs to one person.
• Access records: approval before access was granted, access removed for a sample of people who left, admin rights kept away from people who do business transactions in the same system, and a management access review at least once a year.
• MFA on every access point to remotely hosted or remotely accessible systems that hold NPI.
• Device settings that match the removable media policy.
• Proof of encryption or another secure way to deliver NPI.
• Monitoring: how attacks are detected, a sample of security alerts with management follow-up, and outsourced monitoring reports with proof that management reviewed them.
• Change management: a sample of hardware and software changes that were documented, tested, and approved, plus a timely patching procedure.
• Backup and recovery procedures, with documented test results.
• An incident response plan that names a single point of contact, lists who to notify, and includes your cyber insurance carrier contacts.
• Vendor due diligence that considered security, plus checks that vendors carry cyber and breach insurance.
• Wire procedures: the written wire transfer procedure with MFA and independent verification, plus the wire fraud response procedure.

Plaintext passwords sitting in files fail Pillar 3 quickly. We wrote up how we scan endpoints for password files before an audit finds them.

Key takeaways

What this looks like when we do it

When we take on a title company, we build the controls first and write them down second. Then the WISP describes systems that actually exist. On our managed IT for title companies baseline, that means MFA enforced across the whole tenant, not optional for each user. It also means email authentication, monitoring for the mailbox rules and odd sign-ins attackers leave behind, patch management, and endpoint detection and response.

The evidence comes out of the same tools that run the controls. We can export the user and MFA list, show who lost access and when, report on patching and encryption, and keep backup test results on file. Your wire procedure is yours to write and run. We make sure the email and identity side of it holds up, and we know what to look for when it doesn’t, because we’ve already worked a BEC case on a real closing.

We don’t sign your certification letter. You do, or the third-party assessor you hire does. Our job is to make sure the IT pages of that package are true and every item has evidence behind it. Our title company page covers the wire fraud side in more detail.

Have a lender asking for your ALTA letter and an IT section you can’t prove yet? Get in touch and we’ll go through it with you.