While lenders need contingency plans to put into action if a cyber attack debilitates their in-house systems, they also need to ensure the flow of business is uninterrupted in the event that a vendor's technology goes offline. 

To get an idea of what they must do, consider the temporary shutdown of some title systems seen recently, said Donna Schmidt, managing director and owner of vendor DLS Servicing and co-founder of a technology called Waterfallcalc.

The system outages at Fidelity National Financial's Servicelink and First American illustrate the value of working with multiple vendors, she said. 

Anyone reliant on just one title vendor could face procedural delays. In an area like default servicing where a title report is necessary to determine whether a modified loan can stay in a first lien position, it could jeopardize the ability to meet certain deadlines.

Once default servicers have the information needed from a borrower to make a decision on a loan outcome like a modification, they have 30 days to deliver it under Consumer Financial Protection Bureau rules.

Companies with multiple, pre-existing vendor relationships may not skip a beat in such tasks when system outages arise.

"They can keep plowing through what they have to get done. Others may have issues with delivery times," said Schmidt.

That's because the approval process when signing a contract with a new vendor often requires more time than mortgage companies have if they want to avoid delays, she said.

The CFPB's 30-day rule is just one of many time-sensitive tasks servicers have to fulfill promptly to avoid expenses.

"When you're dealing with anything in the default area, you are up against a very firm deadline that could cost you money," Schmidt said

She said that's why she's been advising clients to have multiple vendors in areas where they're really needed.

"We're telling our clients to start looking at some redundancies in critical situations. Property inspections is another one. You have to do property inspections between 45 and 55 days in order to get reimbursed by HUD," said Schmidt.

While the thin profit margins in the industry might make a mortgage company think twice before investing in contracts with multiple vendors, her company and some others do charge on a per-loan basis, which makes it easier to keep them on standby, she said.

"You can send all your business to one vendor, but you should have a relationship with another one as a backup to cover you if you can. I think we have to get there in these days of cyber attacks, Schmidt said.