New FTC Safeguard Rules: Staying Compliant in the World of Collections

The new FTC Safeguard Rules set forth several requirements which need to be complied with. Those requirements include:

1. Encryption of all customer information held or transmitted by the business.
2. Restrict access to allow only access to authorized persons and limit information available to be reviewed to that information necessary to perform their duties or functions.  Multi-factor Authentication should be used.
3. Designating a specific qualified employee to oversee and implement an information security program.
4. Adopt procedures for evaluating and testing the security of external applications and devices used to transmit, access, or store consumer information.
5. Staff must be trained, and retrained, on security awareness and there must be policies and procedures designed to monitor and log activities of authorized users and whether there has been unauthorized users and/or tampering of consumer information.
6. Perform regular security assessments of security practices and procedures testing information security and access, confidentiality, and the integrity of the system.
7. Develop a response plan if and when a security breach occurs.
8. If the business maintains data on more than 5,000 consumers, there must be continuous monitoring and periodic assessments to detect changes and monitor for vulnerabilities.
9. Data disposal procedures must be created to ensure secure disposal of consumer personal identifying information within two years of last providing products or services to the consumer.