Improve security. Stay compliant. Avoid fines.

314.4 of the FTC Safeguards Rule requires covered entities to:

• a. Designate a Qualified Individual
  Financial institutions are required to designate a Qualified Individual who oversees and implements the information security program. This individual can be an employee, an affiliate, or a service provider. If an affiliate or service provider is chosen, the financial institution remains ultimately responsible for compliance. Additionally, a senior member of the institution must provide guidance and supervision to the Qualified Individual.

• b. Conduct a risk assessment
  The information security program should be grounded in a risk assessment. This assessment identifies anticipated internal and external risks to the security, confidentiality, and integrity of customer information. It evaluates the existing safeguards and controls in place to mitigate these risks. The risk assessment should be documented and regularly reviewed and updated.

• c. Design and implement safeguards
  Financial institutions are required to develop and put in place protective measures to manage identified risks. These measures encompass access controls, which can be both technical and physical. Their purpose is to verify and allow access only to authorized users, thereby safeguarding against unauthorized acquisition of customer information.

• d. Regularly monitor safeguards
  Financial institutions are required to continuously test or monitor the effectiveness of the critical controls, systems, and procedures within their safeguards. This involves evaluating their capacity to detect both actual and attempted attacks on, or intrusions into, information systems. Essentially, this provision underscores the importance of ongoing assessment and validation of security measures to effectively safeguard customer information.

• e. Train your staff
  Financial institutions are required to establish policies and protocols to ensure that staff members can effectively implement your information security program. This involves providing security awareness training that remains current and aligns with the risks identified through the risk assessment process.

• f. Monitor your service provider
  Financial institutions are required to supervise service providers by carefully choosing and retaining those who have the ability to uphold suitable safeguards for customer information. These providers must be contractually obligated to implement and uphold these protective measures.

• j. Keep information security program current
  To remain compliant with the FTC Safeguards Rule, it is essential to continuously update your information security program. This entails regularly reviewing and revising your policies, procedures, and safeguards to address emerging risks and industry advancements. A practical guideline is to make updates when there are significant organizational changes. Always remember that in information security, adaptation to change ensures the ongoing effectiveness of your security measures.

• h. Create a written incident response plan
  Financial institutions must create a written incident response plan as part of the FTC Safeguards Rule to effectively handle security events and protect customer information. The essential elements that should be included in such a plan include goals of the plan, internal processes for response, roles and responsibilities, communication strategies, remediation requirements, documentation and reporting, post-incident evaluation and revision.

• k. Report to board of directors
  Your designated Qualified Individual must provide written reports regularly, at least annually, to your Board of Directors or governing body. If your company lacks a Board or its equivalent, the report should be directed to a senior officer responsible for your information security program.