What does the FTC Safeguards Rule ask a financial institution to do?

Who does this rule apply to?

The rule applies to the handling of customer information by financial institutions under the FTC's jurisdiction.

The list of examples in section 314.1(b) names tax preparation firms, alongside mortgage brokers, finance companies, collection agencies and financial advisors.

This part applies to the handling of customer information by all financial institutions over which the Federal Trade Commission ("FTC" or "Commission") has jurisdiction.

More specifically, those entities include, but are not limited to, mortgage lenders, "pay day" lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders.

What does it ask for?

Section 314.3(a) says the institution shall keep a comprehensive information security program, written down, with safeguards that fit its size and complexity, what it does, and how sensitive the customer information is.

You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue.

What are some of the elements of the program?

Section 314.4 lists the elements. The first is to name a Qualified Individual who oversees, puts in place and enforces the program.

The program is to rest on a risk assessment of foreseeable inside and outside risks to customer information, and section 314.4(b)(1) says that assessment shall be written.

Section 314.4(c)(5) names multi-factor authentication for anyone accessing any information system, unless the Qualified Individual approves in writing reasonably equivalent or more secure access controls.

Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program (for purposes of this part, "Qualified Individual").

Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks.

(1) The risk assessment shall be written and shall include: (i) Criteria for the evaluation and categorization of identified security risks or threats you face;

Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls;

When must the FTC be told?

If a notification event involves the information of at least 500 consumers, the rule says the institution must notify the FTC as soon as possible, and no later than 30 days after discovery.

A notification event is the acquisition of unencrypted customer information without the authorization of the person it is about.

Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event.

Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.

Is a smaller institution treated differently?

Section 314.6 says four parts of section 314.4 do not apply to an institution that keeps customer information on fewer than five thousand consumers: (b)(1), which includes the written risk assessment, and (d)(2), (h) and (i). The other elements, the multi-factor authentication element among them, are not in that list.

Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.