A proposed safe harbor must show program requirements ensuring member operators provide substantially the same or greater protections as 312.2 to 312.8 and 312.10; an effective, mandatory mechanism for independent assessment of members' compliance including a comprehensive review, at least annually, of each member's information privacy and security policies, practices and representations (a seal program may provide it); and disciplinary actions for non-compliance (public reporting of actions, consumer redress, voluntary payments to the Treasury, referral of pattern-or-practice violators to the FTC or equally effective action). The application must include a detailed explanation of its business model and the technology and mechanisms for initial and continuing assessment of members' fitness, the full guidelines and commentary, a provision-by-provision comparison with 312.2 to 312.8 and 312.10, and a statement of how the guidelines, assessments and compliance consequences meet the Rule and provide effective enforcement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.