There is no federal law requiring real estate businesses to implement information security programs. That has led to real estate businesses having vulnerable systems.