On October 27, 2021, the Federal Trade Commission announced significant amendments to the agency’s Safeguards Rule (the “Final Rule”). Promulgated in 2002 pursuant to the Gramm-Leach-Bliley Act, the Safeguards Rule obligates covered financial institutions to develop, implement and maintain a comprehensive information security program that complies with the Rule’s requirements.

The Final Rule modifies the Safeguards Rule in five key ways, adding provisions that (1) provide more guidance on developing and implementing specific aspects of an information security program; (2) require financial institutions to make periodic reports to their boards of directors or governing bodies regarding their information security program; (3) exempt from certain Safeguards Rule requirements financial institutions that collect information from a number of customers below a designated threshold; (4) expand the definition of “financial institution” to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities; and (5) define key terms and provide relevant examples within the Safeguards Rule itself.

Security Programs. The Final Rule specifies criteria that financial institutions must include in their risk assessments, and specifies that such assessments must be in writing. The Final Rule also requires covered financial institutions to implement specific safeguards, including: (1) encryption for all customer information in transit and at rest (subject to certain exceptions where compensating controls are implemented); (2) continuous monitoring or periodic penetration testing and vulnerability assessments; (3) multi-factor authentication for any individual accessing an information system (or a reasonably equivalent or more secure access control approved in writing by a “qualified individual”); (4) a written incident response plan; and (5) steps to select and retain service providers capable of maintaining appropriate safeguards for customer information, including contractually requiring service providers to implement such safeguards, and periodically assessing service providers based on the risk they present.

Accountability. Whereas the current Safeguards Rule requires covered financial institutions to designate one or more employees to coordinate their information security program, the Final Rule requires financial institutions to designate a single “qualified individual” responsible for overseeing, implementing and enforcing the institution’s information security program. While a previous version of the Final Rule referred to this individual as the Chief Information Security Officer, the Final Rule does not specify any particular level of experience, education, or compensation, or require any particular duties outside of overseeing the financial institution’s information security program and other requirements specifically set forth in the Final Rule.  Additionally, the Final Rule requires covered financial institutions to submit periodic reports to boards of directors or governing bodies addressing, among other items, the status of the institution’s information security program and recommended changes thereto, and the institution’s compliance with the Final Rule. The Final Rule also builds on the Safeguards Rule’s employee training requirements.

Small Businesses. The Final Rule exempts financial institutions that collect information about fewer than 5,000 consumers from the written risk assessment, incident response plan and annual reporting requirements.

Expanded Definition of “Financial Institution.”  The Final Rule expands the definition of “financial institution” to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities, harmonizing the FTC’s Safeguards Rule with the safeguards rules of other federal agencies. Notably, this change brings “finders” (i.e., companies that bring together buyers and sellers of a product or service) within the scope of the Final Rule.

Key Terms and Examples. The Final Rule defines several terms, and includes related examples, in the Safeguards Rule itself, instead of incorporating such terms by reference from the FTC’s related Privacy of Consumer Financial Information Rule.

In addition to these updates, the FTC also is seeking comments on whether to make further changes to the Safeguards Rule, to require covered financial institutions to report certain data breaches and other security events to the Commission. The FTC accordingly issued a supplemental notice of proposed rulemaking. The public will have 60 days to comment on the notice after it is published in the Federal Register.