The FTC Safeguards Rule: What You and Your Clients Need To Know

Section 314.4 of the Safeguards Rule outlines the necessary components for a company’s information security program, including nine specific elements. We will analyze each element systematically.

Your company needs a Qualified Individual to implement and supervise its information security program.
This person can be an employee, affiliate, or service provider. They don’t need a specific degree or title, just real-world knowledge suited to your circumstances. The Qualified Individual chosen by a small business may have a different background from someone in charge of a large corporation’s complex system. If your company hires a service provider, it’s still your responsibility to designate a senior employee to supervise them. If the Qualified Individual works for an affiliate or service provider, that entity must also maintain an information security program to protect your business.

Perform a risk assessment.
Before creating an information security program, conduct a risk assessment to identify potential risks and threats to customer information. This assessment should be in writing and include criteria for evaluating the risks and threats. Consider possibilities such as unauthorized disclosure, misuse, alteration, or destruction of customer information. Risks to information change over time, so the Safeguards Rule requires periodic reassessments to account for changes in operations or new threats.

Design and implement safeguards to control the identified risks through your assessment.
The implementation of safeguards is necessary to mitigate risks identified through the risk assessment. The Safeguards Rule mandates companies to design an information security program that includes these safeguards.

1. Apply and continually evaluate access controls. Regularly review access to customer information to ensure it is only granted to those with a legitimate business need.

2. Know what you have and where you have it. A fundamental step to effective security is understanding your company’s information ecosystem. Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. Keep an accurate list of all systems, devices, platforms, and personnel. Design your safeguards to respond with resilience.
   
   
3. Make sure encryption is used to secure data.  To ensure the security of customer information, encrypt it while it’s on your system and during transit. If encryption is not possible, use alternative controls approved by the Qualified Individual overseeing your information security program.
   
   
4. Regularly monitor the apps used on the in-house and client’s network.  It is recommended to assess the security of any apps used for storing, accessing, or transmitting customer information, whether they are developed in-house or by third-party providers. Appropriate procedures should be implemented for this evaluation process.
   
   
5. Utilize multi-factor authentication for anyone accessing customer information on your system. The Rule requires the use of multi-factor authentication to access customer information on the system. This involves the use of at least two authentication factors, which may include a password or token, as well as biometric characteristics. The only deviation from this requirement is if a Qualified Individual approves the use of a different secure access control method in writing.
   
   
6. Disposal of client data securely is required. It is recommended to dispose of customer information in a secure manner within two years of its last use, unless there is a legitimate business or legal reason to retain it. In cases where targeted disposal is not possible due to the maintenance of the information, exceptions may apply.
   
   
7. Expect to evaluate necessary changes to your network periodically. You should be prepared for changes to your information system or network. These changes can weaken current security measures. A new server, for instance, may create new security risks. Your safeguards must adapt to changes in your systems and networks as new business processes are implemented. To comply with the Safeguards Rule, financial institutions must include change management in their information security program.
   
   
8. Track authorized users’ activity and watch for unauthorized access. It is recommended to record the activity of authorized users and to be vigilant for any unauthorized access. It is also advisable to establish protocols and measures for monitoring the access of authorized users to customer information and to detect unauthorized access.

Monitor and check the fulfillment of your safeguards.  Test your procedures to detect actual and attempted attacks. For information systems, monitor your system continuously. If not, conduct annual penetration testing and vulnerability assessments, including system-wide scans every six months to detect known security vulnerabilities. Also, test whenever there are material changes to your operations or business arrangements and when circumstances may impact your information security program.

Continue training and educating your staff. To ensure the effectiveness of a financial institution’s information security program, all staff members need to be vigilant. Properly trained employees can enhance the program’s impact by identifying risks. Regular security awareness training and updates should be provided to all personnel. Employees, affiliates, or service providers with hands-on responsibilities must undergo specialized training. They should also stay updated on the latest emerging threats and countermeasures. Verification of their knowledge is essential.

Measure your service provider’s skill sets.  When choosing service providers, it is important to confirm their skills and experience in maintaining appropriate safeguards. Agreements should explicitly outline security expectations, incorporate methods for supervising service providers’ work, and allow for regular evaluations of their suitability for the role.

Keep your information security program current. It is important to maintain an up-to-date information security program as the field is constantly evolving. This includes adapting to changes in operations, incorporating findings from risk assessments, addressing emerging threats, adjusting for staff turnover, and responding to other circumstances that may affect the program. The most effective programs are able to flexibly accommodate necessary updates.

Have an incident response plan in writing. It is imperative for businesses to have a response and recovery plan in place in case of a security event resulting in unauthorized access or misuse of information. As per Section 314.4(h) of the Safeguards Rule, the response plan must cover all necessary measures.

• The objectives of your plan.
• The internal procedures that your company will initiate in response to a security incident.
• Establishing clear roles, responsibilities, and levels of decision-making authority is crucial.
• The exchange of information and communication can occur both within and outside of your organization.
• The process aims to address any weaknesses found in your systems and controls.
• The company requires proper documentation and reporting of security events, along with a clear plan for response.
• Conducting a post-mortem analysis and revising the incident response plan and information security program based on the findings is recommended.

It is necessary for the Qualified Individual to provide regular written reports to the Board of Directors or governing body, at least once a year. If there is no Board or equivalent in your company, the report should be sent to a senior officer who is responsible for the information security program. What is the topic that the report needs to cover? The initial step involves evaluating your company’s adherence to its information security program as a whole. The topics that must be covered in the program include risk assessment, risk management and control decisions, service provider arrangements, test results, security events, management responses, and recommendations for changes in the information security program.