Safeguards Rule Check

Coming soon. Does your agency's security program meet the FTC Safeguards Rule, and do you owe the FTC a breach notice?

Checks your information security program against the FTC Safeguards Rule (16 CFR 314), which covers collection agencies and debt buyers: a Qualified Individual, written risk assessment, access controls, data inventory, encryption in transit and at rest, secure development, multi-factor authentication for anyone accessing your systems, disposal within 2 years, change management, activity logging, continuous monitoring or annual penetration tests plus vulnerability assessments every 6 months, staff training, vendor oversight, a written incident response plan and an annual written report to the board, with the exemption for institutions holding information on fewer than 5,000 consumers. For an incident it tells you whether it is a notification event (unencrypted information of 500 or more consumers acquired without authorization) and the FTC deadline, 30 days after discovery. Yes/no facts and dates only. Early access pending legal review. Not legal advice.

Status: Coming soon. Pricing is set at launch.

DebtLayer · Tools · Free tools · Docs · support@debtlayer.io