16 CFR 314.5 + 314.6. EFFECTIVE DATE (314.5): the FTC Safeguards Rule as amended in 2021 is in effect since 9 January 2022 + with January 2023 for elements requiring additional time (Qualified Individual + risk assessment + the 9 safeguard elements + continuous monitoring/pen test + incident response plan + Board reporting); the 2023 FTC NOTIFICATION REQUIREMENT (314.4(j)) became effective 13 May 2024. SMALL INSTITUTION EXEMPTION (314.6): financial institutions maintaining customer information concerning FEWER THAN 5,000 CONSUMERS qualify for SIMPLIFIED COMPLIANCE - they need not comply with all the detailed requirements but MUST: (a) DEVELOP + maintain a WRITTEN INFORMATION SECURITY PROGRAM addressing the standards of 314.3; (b) DESIGNATE A QUALIFIED INDIVIDUAL; (c) CONDUCT a WRITTEN RISK ASSESSMENT covering the 314.4(b) criteria; (d) DESIGN + IMPLEMENT SAFEGUARDS to control the risks identified; (e) OVERSEE SERVICE PROVIDERS; (f) EVALUATE + ADJUST the program. Small institutions are EXEMPT from 314.4(c)(1)-(9) detailed elements + 314.4(d)(1)(B) periodic assessment of service providers + 314.4(g)(5) annual penetration testing/semiannual vuln assessments + 314.4(h)(1)-(7) detailed IRP elements + 314.4(i) Qualified Individual annual Board reporting; but should still implement reasonable + appropriate safeguards. INTERAGENCY COORDINATION: with federal banking agencies (OCC + FRB + FDIC + NCUA) + SEC + CFPB + state insurance + state AGs + interagency Cyber Risk Self-Assessment Tool (CIRT-Tool). SECTORAL: with HIPAA (for health-related GLBA-covered) + FERPA (Higher Education Safeguards Rule) + CCPA/CPRA + state privacy laws + EU GDPR (where US institution serves EU customers).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.