16 CFR 314.5 + 314.6. EFFECTIVE DATE (314.5): the FTC Safeguards Rule as amended in 2021 is in effect since 9 January 2022 + with January 2023 for elements requiring additional time (Qualified Individual + risk assessment + the 9 safeguard elements + continuous monitoring/pen test + incident response plan + Board reporting); the 2023 FTC NOTIFICATION REQUIREMENT (314.4(j)) became effective 13 May 2024. SMALL INSTITUTION EXEMPTION (314.6): financial institutions maintaining customer information concerning FEWER THAN 5,000 CONSUMERS qualify for SIMPLIFIED COMPLIANCE - they need not comply with all the detailed requirements but MUST: (a) DEVELOP + maintain a WRITTEN INFORMATION SECURITY PROGRAM addressing the standards of 314.3; (b) DESIGNATE A QUALIFIED INDIVIDUAL; (c) CONDUCT a WRITTEN RISK ASSESSMENT covering the 314.4(b) criteria; (d) DESIGN + IMPLEMENT SAFEGUARDS to control the risks identified; (e) OVERSEE SERVICE PROVIDERS; (f) EVALUATE + ADJUST the program. Small institutions are EXEMPT from 314.4(c)(1)-(9) detailed elements + 314.4(d)(1)(B) periodic assessment of service providers + 314.4(g)(5) annual penetration testing/semiannual vuln assessments + 314.4(h)(1)-(7) detailed IRP elements + 314.4(i) Qualified Individual annual Board reporting; but should still implement reasonable + appropriate safeguards. INTERAGENCY COORDINATION: with federal banking agencies (OCC + FRB + FDIC + NCUA) + SEC + CFPB + state insurance + state AGs + interagency Cyber Risk Self-Assessment Tool (CIRT-Tool). SECTORAL: with HIPAA (for health-related GLBA-covered) + FERPA (Higher Education Safeguards Rule) + CCPA/CPRA + state privacy laws + EU GDPR (where US institution serves EU customers).
This control maps to 73 controls across 37 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 73 it maps to, and the evidence behind each claim, over MCP and REST.