FTC GLBA Safeguards Rule (16 CFR Part 314) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification: Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))

16 CFR 314.4(h-j). (h) WRITTEN INCIDENT RESPONSE PLAN: prepare WRITTEN INCIDENT RESPONSE PLAN designed to promptly respond to + recover from any security event materially affecting confidentiality + integrity + availability of customer information; the IRP must address: (1) goals of plan; (2) internal processes for responding to security events; (3) clear roles + responsibilities + decision-making authority; (4) external + internal information sharing + communications; (5) requirements for remediation of identified weaknesses in systems + controls; (6) documentation + reporting; (7) evaluation + revision of plan after security event. (i) QUALIFIED INDIVIDUAL ANNUAL BOARD REPORTING: at least annually, the Qualified Individual must report in writing to the Board (or senior officer responsible) on (1) overall status of information security program + compliance; (2) material matters related to the program including risk assessment + security events + service-provider arrangements + results of testing + recommendations for changes + Qualified Individual's certifications. (j) FTC BREACH NOTIFICATION (added 2023): if the institution becomes aware of a SECURITY EVENT involving NOTIFICATION TO 500 OR MORE CONSUMERS + the institution must notify the FTC as soon as possible + within 30 DAYS of discovery via the FTC's online notification form. The notification must include name + contact information + a brief description + the date(s) the event occurred + the date discovered + the number of consumers affected.