While the current rule does not explicitly require these coordinators to be qualified for this position, the current rule requires a financial institution to take «appropriate» safeguards, test them regularly, and evaluate and adjust the information security program in light of those measures. [99] In order to respond effectively to these common requirements, the coordinator of a financial institution must have some level of training and knowledge in the field of information security and is therefore likely to be an appropriate qualified person within the meaning of the final rule. Therefore, in many cases, this change in the rule does not result in additional hiring costs. The GLBA Privacy Rule requires the CU to take precautions to ensure the security and confidentiality of certain non-public personal information (NPI) obtained when CU offers or provides a financial product or service to an individual for personal, family or household purposes. To support compliance, CU has implemented administrative, technical, and physical safeguards as part of its comprehensive data governance and IT security programs. On 7 September 2016, the Commission invited comments on the protection rule as part of its regular review of its rules and guidelines. [12] The Commission called for comments on a number of general issues, including the economic impact and benefits of the rule; potential conflicts between the rule and state, local, or federal laws or regulations; and the impact of technological, economic or other industrial changes on the rule. The Commission received 28 comments from persons and entities representing a wide range of views. [13] Most commentators agreed that the rule is still necessary and benefits consumers and competition. [14] The FTC amended the rule in December 2021 to provide more specific guidance to financial services firms and their third-party service providers, which we have discussed here before. Unlike previous rules and guidelines issued by federal financial regulators, the FTC`s new security rule includes specific criteria for the safeguards that financial institutions must implement as part of their information security program.

For example, the new security rule requires financial institutions to implement multi-factor authentication for people accessing networks containing customer information. For example, an information security program that does not have access controls or includes measures to monitor user activities on systems cannot be called financial institution systems protection. The final rule therefore continues to require that any information security program include safeguards that take these elements into account, with the changes described below. f. Monitor your service providers. Choose service providers who have the skills and experience to take appropriate security measures. Your contracts should set out your security expectations, include ways to monitor your service provider`s work, and include regular reassessments of their suitability for the position. «The safeguard rule requires financial institutions to develop, implement and maintain an information security program with administrative, technical and physical safeguards in place to protect customer information. Your information security program must be written and appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information in question. As the name suggests, the goal of the Federal Trade Commission`s Customer Information Protection Standards — or Safeguards Rule for short — is to ensure that companies that fall under the rule take protective measures to protect the security of customer information. The safeguard went into effect in 2003, but after public comment, the FTC amended it in 2021 to ensure the rule keeps pace with current technology. While maintaining the flexibility of the original safeguard clause, the revised rule provides more concrete guidance to businesses.

It reflects the key data security principles that all covered organizations must implement. The security rule requires covered financial institutions to develop, implement and maintain an information security program with administrative, technical and physical safeguards to protect customer information. The rule defines customer information as «any record containing non-public personal information about a customer of a financial institution, whether in paper, electronic or other form, that is processed or retained by you or your affiliates or on your behalf.» (The definition of «non-public personal information» in paragraph 314.2(l) explains in more detail what is included and what is not.) The rule includes information about your own customers and information about customers of other financial institutions that have provided you with this data. In addition to penetration testing, it`s worth noting that risk assessments, like the one you did in Step 2, are another way to monitor protections, especially after major changes to your infrastructure.