FTC Safeguards Rule: What You Need to Know

The Federal Trade Commission has developed their Safeguards Rule for one purpose: To set up a guideline on how to interact, store, and use customer information. The FTC enacted the Rule in 2003, but it was heavily amended in 2021 to ensure that it keeps up with the technology used by businesses today. It outlines the policies and procedures that all covered companies need to enact.

What Is the FTC Safeguard Rule?

The FTC Safeguard Rule is a data privacy mandate enacted to protect personal information. Any financial institutions, including mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, and investment advisors that aren’t required to register with the SEC are required to meet the metrics under the FTC Safeguard Rule.

In order to be compliant with the FTC Safeguard Rule, applicable financial institutions have to write out their information security program and have it meet some very specific metrics. It has to fit the size and complexity of your business and fit the type of information that the organization keeps. 

The idea is to ensure the security and confidentiality of customer information; protect against threats to the integrity of that information; and protect against unauthorized access to information that could result in inconvenience or harm to the customer. 

How to Build a Reasonable Security Platform

Nothing inside the FTC Safeguard Rule is outside the norm when it comes to protecting customer data, but they do give an overview of what they expect one of their covered businesses to do to ensure data stays secure. Here is a brief overview of the eight-step process they recommend:

1. Designate a qualified individual to oversee organizational data security.
2. Conduct a comprehensive risk assessment.
3. Design and deploy necessary safeguards outlined in the risk assessment.
4. Monitor system and regularly test it.
5. Train employees in best practices of data security and privacy.
6. Oversee any third-party’s access and control.
7. Regularly update the security program to keep it current. 
8. Create a written response plan for necessary continuity. 

SCW Can Help!

If your organization needs to maintain compliance with any regulatory mandate, the IT professionals at SCW can help. Give us a call today at (509) 534-1530 to learn more.