The Federal Trade Commission (FTC) announced it is extending the deadline for companies to comply with some of the changes to its financial data security safeguard rules. The Safeguards Rule requires non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to develop, implement, and maintain a comprehensive security program to keep their customers’ information safe.
The FTC approved changes to the Safeguards Rule in October 2021, which included more specific criteria for what safeguards financial institutions must implement as part of their information security programs.
While many of the provisions of the rule went into effect 30 days after publication in the Federal Register, some sections of the rule were set to go into effect Dec. 9, 2022. These sections are the portions of the rule which have received the six-month extension.
These specific sections include requirements that covered financial institutions:
- Designate a qualified individual to oversee their information security program.
- Develop a written risk assessment.
- Limit and monitor who can access sensitive customer information.
- Encrypt all sensitive information.
- Train security personnel.
- Develop an incident response plan.
- Periodically assess the security practices of service providers.
- Implement multi-factor authentication or another method with equivalent protection for any individual accessing customer information.
The commission is extending the deadline based on numerous requests and reports, including a letter from the Small Business Administration’s Office of Advocacy, that there is a shortage of qualified personnel to implement information security programs and that supply chain issues may lead to delays in obtaining necessary equipment for upgrading security systems.
The new deadline for complying with the relevant updated requirements is now June 9, 2023.