If your business finances, leases, brokers or bills on credit, assume you are covered and confirm it with your counsel. Then the question changes: most businesses that fail a Safeguards review are not careless, they wrote the policies and nobody owned the work. ITS owns the work.
PCI DSS comes from the card brands and covers cardholder data. The FTC Safeguards Rule comes from federal regulators and covers customer information at non-bank financial institutions. Taking cards does not exempt you from the other one. If you take cards as well, see PCI DSS compliance.
The rule is prescriptive, which is good news: you can read it and know where you stand. These are its own requirement areas, in its own order.
Requirement areas summarized from the FTC's Standards for Safeguarding Customer Information, 16 CFR Part 314.
One named person is responsible for your information security program. They need not be an employee or a security specialist by title, but they do have to be accountable and they do have to report. If nobody is named, nothing else on this list holds.
A written assessment of the internal and external risks to the customer information you hold, refreshed as the business changes. Not a scan report: a document saying what data you hold, where it lives, who can reach it and which risks you treat first.
The rule names them, and the list is not a suggestion.
What the rule names
Continuous monitoring of your systems, or, where you do not have that, penetration testing plus vulnerability assessments on a schedule. The point is not the test. The point is finding your own gaps before somebody else finds them for you.
Security awareness training for staff, qualified security personnel on the program, and a real process for selecting service providers, writing security expectations into their contracts and checking that they hold up. If a vendor loses your customers' data, the obligation is still yours.
A written incident response plan covering roles, communications, remediation and post incident review, plus a written report at least once a year from your Qualified Individual to your board or a senior officer. The rule also requires notifying the FTC of a qualifying security event above a consumer threshold.
Two ITS clients on what changed once somebody owned their security program. Neither quote is about the Safeguards Rule, and the heading claims nothing more than it says.
ITS led significant, transformational changes at Eastern Plumas Health Care to ensure we weren’t susceptible to attacks. Looking back, prior to that partnership, we had a lot of risks on campus. I’m glad nothing happened, but I’m even more proud that after implementing those systems, we’ve avoided data breaches and HIPAA violations throughout our five-year partnership.
We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.
A thirty minute consultation, a plain answer on whether the rule covers you, and a written view of the gap. No obligation, and no jargon.
