COPPA 312.8(a)-(b): § 312.8(a) and (b) Reasonable security and a written information security program

The operator must establish and maintain reasonable procedures to protect the confidentiality, security and integrity of children's personal information and, at a minimum, a written information security program with safeguards appropriate to the sensitivity of the information and the operator's size, complexity and activities: designating one or more employees to coordinate it; identifying and at least annually assessing internal and external risks and the sufficiency of safeguards; designing, implementing and maintaining safeguards based on the volume and sensitivity of the information and the likelihood of compromise; regularly testing and monitoring their effectiveness; and at least annually evaluating and modifying the program for identified risks, test results, new methods or other material circumstances.