FTC Safeguards Rule

Derek Veillon • November 29, 2022

The New FTC Safeguards Rule: Is Your Business Affected?

Person completing a cybersecurity shield In 2021, the FTC amended the Safeguards Rule (which originally took effect in 2003) to ensure its contents reflect advancements in technology. Originally, the rule was developed to ensure financial institutions protect consumers’ private data. According to the FTC, the 2021 update provides “more concrete guidance for businesses,” including the data security principles affected companies must implement. It will also now apply to a much broader scope of business types.

While the amendment was made in 2021 and the deadline for requirements is approaching, many companies still lack clarity about whether they’re affected and if so, what must be done to ensure compliance. Here’s a quick guide to the New FTC Safeguards Rule to help clear up any uncertainties.

Which Businesses Fall Under the FTC Safeguards Rule?

The amended rule expands the definition of financial institutions, meaning many businesses which previously were not impacted by the rule will be now. The 2003 Safeguards Rule was meant to regulate financial institutions — or organizations “significantly engaged in financial activities.” Now, however, it’s not just banks and similar financial institutions that will be covered under the rule.

By the FTC’s updated definition, affected organizations will be those significantly involved in financial activities, as well as activities incidental to such financial activities. In other words, companies that extend credit lines, offer loans, or are somehow involved with consumers’ ability to access money will all be regulated under the new rule. As the FTC puts it , “The definition of a ‘financial institution’ isn’t a hushed hall with tellers, deposit slips, and ballpoint pens on chains.”

In addition to financial institutions, the FTC cites several other examples of business types that will be impacted by the new rule:

Companies that lease property on a nonoperating basis for 90 days or more, such as automobile, boat, motorcycle, RV, and other types of dealerships
Retailers that issue in-house credit cards
Payday lenders
Real estate settlement services
Companies that sell or print checks
Any company that wires funds
Accountants
Travel agents
Mortgage brokers
Financial counselors or advisors
Appraisers
Credit counseling services
Organizations that work as finders, or any business that charges a fee to connect consumers with lenders

Clearly, a seemingly simple change in verbiage makes the updated rule much more expansive, and many businesses will have to implement changes to ensure compliance with the rule before it takes effect. The above list isn’t exhaustive, however, so as the FTC notes , “If you aren’t sure if you’re covered, now’s the time to nail that down.”

When Does the FTC’s Revised Safeguards Rule Take Effect?

Originally, the deadline for the FTC’s Revised Safeguards Rule was December 9, 2022. The new deadline for the Revised Safeguards Rule is June 9, 2023 . In November 2022, the FTC issued a statement which cited “reports of personnel shortages and supply chain issues” as the driver for the extension.

What to Do if Your Business Is Covered by the FTC’s Revised Safety Rule

At the most basic level, the Safeguards Rule requires covered organizations to develop, implement, and maintain a program that protects consumer data. Yet, the rule’s provisions are far more complex than that, calling for a written information security program that’s tailored to each business’s size, complexity, and nature of activities. According to the FTC, the program should:

Ensure security and confidentiality of customer data
Protect against anticipated threats or hazards to the integrity or security of private data
Protect against unauthorized access to that information which could harm or inconvenience customers

Indeed, covered companies will need to implement a robust information security program. The FTC outlines nine core elements for the program:

Designate a Qualified Individual to implement and supervise the program.
Perform a cybersecurity risk assessment to determine internal and external risks and threats to the confidentiality and integrity of customer data.
Design and implement safeguards to control identified risks. (This point has its own eight-step process, including encrypting customer data, implementing multi-factor authentication, and securely disposing of customer information.)
Routinely monitor and test the effectiveness of safeguards.
Educate staff with cybersecurity awareness training and routine follow-up training.
Monitor service providers and ensure they maintain the appropriate safeguards.
Keep your information security program up-to-date.
Develop a written incident response plan. (There are seven elements of this plan, outlined under Section 314.4(h) of the Safeguards Rule.)
Have your Qualified Individual report to the Board of Directors with annual written reports, which must include an overall assessment of compliance with the information security program.

As you can see, the requirements are robust and call for an equally comprehensive approach. When considering your company’s compliance measures, allow us to assist by providing sophisticated solutions for data security that fit your business’s unique needs.

The post FTC Safeguards Rule appeared first on IT ArchiTeks.

< Older Post

Newer Post >

Essential Cybersecurity Measures Every Trucking Company Needs

By Derek Veillon • November 12, 2024

In our previous post, we explored why trucking companies have become prime targets for cybercriminals. Now, let's focus on practical steps your company can take to protect itself. Recent research brings encouraging news: organizations with comprehensive security measures can reduce cyber attack costs by up to $1.76 million and identify threats 108 days faster than those without proper protections. Let's explore how to achieve this level of protection in your operations. Building Your First Line of Defense The strongest cybersecurity strategies start with your people. While advanced technology plays a crucial role, your employees remain your first and most important line of defense. This is particularly true in trucking, where staff at all levels interact with critical systems daily – from dispatchers accessing fleet management systems to drivers using ELDs. Effective employee training doesn't need to be complex, but it should be consistent and relevant to your operations. Your team needs to understand how to recognize phishing attempts that target shipping documents or payment information, and how to properly handle sensitive customer data. They should also know exactly what to do if they suspect suspicious activity in any of your systems. But even well-trained teams need a plan. This is where incident response planning becomes crucial. Think of it as your roadmap for when things go wrong – and in today's threat landscape, it's not a matter of if, but when. A well-designed response plan helps your team act quickly and effectively during an incident, potentially saving millions in damages and weeks of recovery time. Protecting Your Technology Infrastructure Modern trucking operations depend on a complex web of technology. Your fleet management systems and ELDs are particularly critical – and vulnerable – assets that require special attention. The key is implementing security measures that protect these systems without creating operational bottlenecks. Start by implementing strong access controls and multi-factor authentication for all critical systems. This simple step can prevent many common attacks. Regular system updates and patches are equally important – many successful attacks exploit known vulnerabilities that could have been prevented with routine maintenance. One often-overlooked aspect is network segmentation. Think of it as creating secure zones within your digital infrastructure. By keeping your fleet management systems separate from general business networks, you significantly reduce the risk of a breach spreading throughout your entire operation. If an attacker compromises an office computer through a phishing email, proper segmentation can prevent them from reaching your operational technology systems. The Power of Modern Security Tools Today's cyber threats are sophisticated, but so are the tools available to combat them. Security AI and automation have proven particularly effective in the transportation sector. These systems act like a vigilant security team that never sleeps, continuously monitoring your systems for suspicious activity and responding to threats in real-time. Organizations using these advanced tools have seen remarkable results, identifying and containing threats more than three months faster than those without them. For a trucking company, where every day of disruption impacts your bottom line and customer relationships, this time savings can make the difference between a minor incident and a major crisis. Endpoint Detection and Response (EDR) systems have also become essential in protecting modern trucking operations. With drivers and assets spread across the country, traditional security measures aren't enough. EDR provides real-time protection for all your connected devices, from office computers to mobile devices used in the field. Securing Your Supply Chain In transportation, you're only as secure as your weakest link. This includes your connections with partners, vendors, and customers. Recent attacks have shown how cybercriminals can exploit these relationships to breach otherwise well-protected systems. Regular assessment of your third-party integrations and implementation of secure data sharing protocols isn't just good security practice – it's essential for business continuity. Moving Forward with Confidence Implementing comprehensive cybersecurity measures might seem daunting, but it doesn't have to be. The key is taking a methodical, prioritized approach that aligns with your operations. Start with the basics – employee training and incident response planning – and build from there. Regular security assessments can help you identify your most critical vulnerabilities and address them systematically. Don't wait for an attack to test your defenses. Schedule a complimentary cyber strategy session today to assess your current security posture and develop a practical protection plan that works for your specific operations. Click the “Schedule Your Cyber Strategy Session” button to start the conversation. Let's secure your operations before an attack occurs. Stay tuned for our next post about the latest cyber threats targeting the transportation industry and how to defend against them.

central freight lines 18 wheeler driving down the highway

Why Trucking Companies Are Prime Targets for Cyber Criminals: Understanding the Risk

By Derek Veillon • November 5, 2024

Recent cyber attacks have made one thing clear: the transportation sector has become an increasingly attractive target for cybercriminals. The statistics are sobering - the transportation sector has seen a 400% increase in reported cyberattacks between 2017 and 2022. As a veteran-owned provider of cybersecurity solutions specializing in transportation, we've watched this trend unfold with growing concern. The Growing Threat Landscape Recent months have shown just how vulnerable the trucking industry has become. In fall 2023, Estes Express Lines, one of the industry's largest players, fell victim to a ransomware attack that compromised the personal data of over 21,000 individuals. The attack forced immediate system shutdowns and created significant operational disruptions, even though the company refused to pay the ransom. Just months earlier, a ransomware attack on ORBCOMM sent shockwaves through the industry when it disrupted fleet management systems nationwide. The impact was so severe that the Federal Motor Carrier Safety Administration had to issue special waivers allowing truckers to use paper logs when their Electronic Logging Devices (ELDs) became inoperable. This incident demonstrated how quickly a cyber-attack can cascade through interconnected systems and affect multiple companies simultaneously. Why Trucking Companies Are Attractive Targets Three key factors make the transportation sector particularly vulnerable to cyber-attacks: Critical Infrastructure Status Transportation's designation as critical infrastructure means disruptions have immediate ripple effects throughout supply chains. This pressure often leads companies to consider paying ransoms quickly to restore essential services, making them attractive targets for cybercriminals. Complex Digital Networks Modern trucking operations rely on interconnected systems - ELDs, fleet management systems, telematics, and customer portals - each representing a potential entry point for attackers. The integration of legacy systems with modern technology creates security gaps that cybercriminals eagerly exploit. Regulatory Compliance Requirements Electronic logging mandates and real-time tracking requirements mean companies can't simply revert to manual processes during an attack. When systems go down, the ability to operate legally becomes immediately compromised. The Real Cost of Inaction The financial impact of cyber-attacks extends far beyond the immediate incident. Companies face direct costs of system recovery, lost revenue during disruptions, regulatory fines, customer compensation costs, and long-term reputational damage. According to IBM's research, organizations that don't involve law enforcement in ransomware incidents face $470,000 in additional costs and experience a 33-day longer breach lifecycle. Protecting Your Operations The transportation sector must acknowledge that cybersecurity is no longer optional—it's a critical business function. As noted by the National Motor Freight Traffic Association's Digital Solutions Conference, the industry is drawing a line in the sand: cyberattackers will not be permitted to take down trucking. Protection requires a comprehensive approach combining modern security tools, employee training, incident response planning, and regular security assessments. As a veteran-owned business with deep experience in both cybersecurity and transportation, we understand how to protect your operations with solutions that are both highly effective and practical for trucking operations. Don't wait until your company becomes the next cyber-attack headline. Schedule a complimentary cyber strategy session today. Stay tuned for our next post about essential cybersecurity measures every trucking company needs to implement to protect against these growing threats.