FTC Safeguards Rule and Everything Your Firm Needs to Know About the June 2023 Deadline!

Learning Objectives

• To discuss the requirements to designate a qualified individual.
• To review best practices on how to document risk assessments.
• To explain how and why you must apply controls.
• To explain how you must validate controls.
• To identify steps to develop a training and auditing program.
• To identify who can monitor service providers.
• To discuss how to develop a continuous improvement cadence.

Course Description

This course is valid up to December 31st, 2023 for CFP Professionals. It is advisable to complete this course before that to process the credit on time.

The Federal Trade Commission (FTC) has recently extended the deadline for compliance with some provisions of their updated Safeguards Rule a full six months. Some regulations are already in effect, but others are due on June 9, 2023, instead of December 9, 2022. Nine (9) elements regarding your technology and controls will need to be addressed. 

In this CPE webinar, we will cover what they mean and what you must do to be compliant. “The Safeguards Rule” requires covered financial institutions to develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information and ensure cyber security. The Rule defines customer information to mean “any record containing nonpublic personal information about a customer of a financial institution, whether in the paper, electronic, or another form, that is handled or maintained by or on behalf of you or your affiliates.” The Rule covers information about your customers and information about customers of other financial institutions that have provided that data to you. We will discuss ways to ensure this information is protected and what a reasonable security program looks like.

To dig deeper, you need an information security program appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information involved. This is what your company's program should accomplish:

• To ensure the security and confidentiality of customer information
• To protect against anticipated threats or hazards to the security or integrity of that information
• To protect against unauthorized access to that information that could result in substantial harm or inconvenience to any customer

Unlike previous FTC regulations, this one has severe penalties for non-compliance. They are:

• Fines range from $10,000 to $100,000 per violation (wide regulatory discretion on amount). 
• Gross breaches can result in up to 5 years in prison (For Example Internal abuse of protected information). These will be enforced by the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). 

Overview

• Cyber security market

  6 mins
• What did the Gramm-Leach-Bliley Act do?

  12 mins
• Security programs objective

  23 mins
• What does a risk assessment look like?

  33 mins
• Encryption - High risk issues

  48 mins
• Monitoring service providers

  64 mins
• Consequences of FTC regulations violation

  82 mins