The FTC Safeguards Rule: who it covers and what it requires

Who does the ftc safeguards rule apply to?

Many business owners assume that 'financial rules' only apply to banks or credit unions. However, the ftc safeguards rule covers a much wider range of companies. If your business provides financial products or services to consumers, you likely fall under this rule. This includes mortgage brokers, payday lenders, tax preparers, and even car dealerships that offer financing or leasing to their customers.

The rule is designed to ensure that these companies have a plan to protect the sensitive information they collect. This includes things like bank account numbers, credit scores, social security numbers, and income tax returns. The Federal Trade Commission (FTC) expects you to treat this data with a high level of care because a breach can lead to devastating identity theft for your customers.

If you are unsure if you are covered, think about whether you are 'significantly engaged' in financial activities. If a large part of your revenue comes from helping people manage their money, borrow money, or plan their finances, the answer is likely yes. Even if you only handle a small number of financial transactions, the rule may still apply if they are a regular part of your business model.

The core requirements of the rule

The Safeguards Rule was updated recently to include very specific technical and administrative requirements. It is no longer enough to have a general idea of security; you must have a formal, written information security program. The FTC requires that your program be appropriate for the size and complexity of your business, but the basic requirements are the same for everyone.

• Designate a 'Qualified Individual' to lead and be responsible for your security program. This person can be an employee or a third party.
• Write a formal risk assessment that identifies where customer data is stored and how it might be at risk from hackers or inside threats.
• Implement technical controls like encryption for all customer data, both while it is sitting on your drives and while it is being sent over the web.
• Enable multi-factor authentication (MFA) for anyone accessing customer data, including your own staff and any outside vendors.
• Regularly monitor and test your security systems, such as your firewalls and antivirus, to ensure they are working as expected.

For businesses that handle a large volume of data, the requirements are even stricter. You may be required to perform regular 'penetration testing' where a security expert tries to break into your systems to find weaknesses. You also need to keep your software updated and ensure that your network is properly segmented to keep sensitive data away from public areas.

Appointing a Qualified Individual

One of the most important parts of the rule is the requirement to have a 'Qualified Individual.' This person does not have to be a full-time employee; they can be a third-party service provider like a managed security company. However, someone must be officially in charge. This person is responsible for the overall health of your security program and must report to your board of directors or senior management at least once a year.

The annual report should cover the status of the security program, any significant security events that happened during the year, and any recommendations for improvements. This ensures that security is a topic of conversation at the highest levels of your company, rather than just something the IT person worries about in the background.

Inventory and data management

You cannot protect what you do not know you have. The FTC Safeguards Rule requires you to keep an inventory of all the data you collect and where it is stored. This includes physical files in a cabinet, digital files on your office server, and data stored in cloud apps like Google Drive or Dropbox. You must know who has access to this data and why.

You must also have a clear policy for deleting customer data when you no longer need it. Keeping old data increases your risk. If a hacker gets into your system, you don't want them to find records from 10 years ago that you should have deleted. The rule requires you to securely dispose of customer information no later than two years after the last time you used it for a business purpose, unless the law requires you to keep it longer.

Managing your service providers

If you hire outside companies to help you with IT, marketing, or data storage, you must make sure they are also protecting your customer data. The rule requires you to choose providers that can maintain appropriate safeguards. You must require them by contract to protect the data you share with them. You should also check on them periodically to ensure they are keeping their promise. If a vendor has a breach, it could still be your responsibility if you didn't do your due diligence.

Incident response planning

The FTC Safeguards Rule requires every covered business to have a written incident response plan. This plan tells your team exactly what to do if you suspect a data breach or a cyberattack. It should cover who to call, how to stop the breach from spreading, and how to recover your data from backups. The goal is to minimize the harm to your customers and your business reputation if something goes wrong.

Your plan should also include how you will notify the FTC and your customers if a breach occurs. Recent changes to the rule require you to notify the FTC within 30 days of discovering a breach that involves the unencrypted information of at least 500 people. Having a plan ready means you won't be scrambling to figure out the law during a crisis.