Here's what I keep running into.
I get on a call with a mid-size servicer that has a solid book of business and a good reputation. When I ask about their business continuity program the answer is always some version of: "Yeah, we've got a plan. It's in a shared drive somewhere. We did a quick drill last year, I think."
They're not careless, they're stretched. They have a compliance officer who's already handling ten other things and a CEO who signed off on the plan eighteen months ago without reading past page three.
That's the reality for most mid-size mortgage servicers in the United States right now and Fannie Mae just raised the bar on every single one of them. The game is changing and most servicers haven't caught up.
The Business Resiliency Supplement is not optional; it requires servicers to prove that their continuity program is tested, governed, and operational. Annual validation, board-level accountability, a 36-hour cybersecurity incident reporting window, drill evidence, and corrective action tracking is now required with appropriate evidence.
Through close to two decades in this industry, I've watched requirements come and go. This one has teeth and the servicers who are still treating BCP like a document they update once a year are going to find that out the hard way.
Every servicer I talk to has an existing plan, but almost none of them know where the gaps are
They don't know that their vendor list has no alternatives documented. They don't know that their recovery time objectives haven't been validated in two years. They don't know that three of their five cost centers have never had their BCP reviewed independently. They don't know that their escalation chain has two people on it who left the company six months ago.
These are the gaps I see every single week and they don't show up until an auditor asks for evidence, a client runs due diligence, or a real disruption hits and the plan that looked great on paper falls apart in the first hour.
The future of BCP is not in documents, it is in a modern system that identifies the gaps, prioritizes them, and helps you close them.
For a large bank, building a continuity program usually means hiring a CISO, bringing in a BCP consultant, staffing a full-time business continuity manager, investing in a six-figure enterprise platform, and still spending months before the program is fully in place.
For a mid-size servicer, that model is rarely practical. They do not have the same headcount, budget, or implementation runway, and they should not need an enterprise-scale setup just to build a reliable continuity program.
What they need is a platform that can guide them the way a good consultant would. It should ask the right business-specific questions, not overwhelm them with generic checklists. It should flag gaps as the plan is being built, generate a usable continuity plan with a meaningful maturity score, and keep that plan current as regulations, vendors, operations, and business priorities change.
That's what we're building with Beacon. A system that thinks like a BCP subject matter expert so that a compliance officer with zero continuity experience can build, test, and prove a real program, without hiring someone and without stopping their actual work to do it.
BCP is not a one-time event. It's a living operation
The biggest misconception I fight is that BCP is something you do once and you're done.
You're never done.
- New compliance rules come in: your score changes.
- A vendor goes under: your risk profile changes.
- You open a new office: your recovery plan changes.
- A key person leaves: your escalation chain breaks.
A real continuity program absorbs all of that in real time. Every cost center validates its own plan, every department reviews its own recovery procedures, drills happen with real notifications, real scenarios, real feedback. Gaps get identified, actions get assigned, evidence is easily produced. When the CEO finally signs off, that signature actually means something, because six months of real operational work sits behind it.
That's the standard. And mid-size servicers deserve a platform that gets them there without the enterprise price tag, without the six-month implementation, and without needing a domain expert on staff.
That's Beacon.