Late last year, the Federal Trade Commission (FTC) released the final amendment to its Safeguards Rule, expanding on the types of entities covered by the Safeguards Rule and the specific elements required of the covered entity's security program in order to adequately protect customer information. The deadline for compliance is approaching quickly. On December 9, 2022, all covered entities will be expected to comply with the amended Safeguards Rule.
Covered entities include all financial institutions under the FTC's authority, including mortgage lenders and brokers, finance companies, account servicers, collection agencies and financial advisers. Additionally, any entity "significantly engaged" in activities incidental to financial activities must comply with the Safeguards Rule, including retailers extending their own credit, dealers leasing automobiles longer than 90 days, and any entity acting as a "finder" by bringing buyers and sellers together. However, there is some relief in the form of certain exemptions for entities that collect information from less than 5,000 consumers in total.
If you are a covered entity, the Safeguards Rule requires the following administrative, technical and procedural safeguards:
- Designating a qualified individual to oversee and enforce your information security program and collecting an annual written status report from the designated individual. This individual can be an affiliate or service provider, subject to the direction and oversight of a senior member of your team.
- Conducting a regular written risk assessment that identifies your particular risks and threats, the adequacy of existing safeguards to address such risks and threats, and the manner of mitigation for any unaddressed risks and threats.
- Implementing appropriate safeguards to control risks identified by your written risk assessment, including user access controls, encryption of all customer information in transit and at rest, multifactor authentication for any individual accessing information, specific retention and disposal protocols, and consistent monitoring.
- Performing annual penetration testing and biannual vulnerability assessments.
- Establishing a written incident response plan identifying internal response processes, levels of decision-making authority, remediation methods for identified weaknesses, and appropriate documentation and reporting methods for incident responses.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.