Can I Take a DIY Approach to the FTC Safeguards Rule?

-
https://www.bluelightit.com/wp-content/uploads/2023/01/blu-diy-approach-ftc-sagefuards-rule.jpg

DIY FTC Safeguards Rule

Does Your Firm Have The Right Cyber Security Program?

If you’re a tax preparer dealing in personally identifiable information (PII), you’ve likely seen articles related to the newly updated FTC Safeguards Rule.1

The rule will take effect soon, specifying that “financial institutions [must] develop, implement and maintain an information security program with administrative, technical and physical safeguards designed to protect customer information.”You must implement a cyber security program to protect your clients’ data. The rule denotes explicitly nine tenants to follow under the law.

We’ve interviewed Amir Sachs, CEO of Blue Light IT and bestselling author of cyber security guides, to help explain in more detail what you can do as an individual to implement an FTC Safeguards Rule-compliant cyber security program.

Is it possible to take a DIY approach to comply with the new requirements of the FTC Safeguards Rule?

“Yes and no: There are nine steps for the FTC Safeguards Rule. The first one is to appoint a qualified person, anyone can be qualified to do that, the only requirement is the person needs to be familiar with real-world know-how of how information is stored and processed in the business. They don’t need to be experts, they don’t need to have any college degrees. If the person knows how and where information is stored, they can become the qualified person.”

How do I know that I’ve appointed or outsourced to the right individual?

“If you are appointing internally, all they need to know is how you store and process data. If you’re appointing externally, then you should appoint somebody that displays knowledge about cyber security and takes interest in your business other than just getting their bill padded at the end of the month. This is an ongoing engagement, this is not a one-off engagement.”

What is involved in a risk assessment, and can I do it myself?

“A risk assessment has two portions: an interview section and a technical analysis. We discover the current security position of the company, we establish a baseline of where they are at the moment and identify high-risk security flaws, which offer easy access to hackers.

The questions we ask help us understand the risk to the business operation, and we estimate the financial impact of a security breach. The CSRA (cyber security risk assessment) is designed to investigate the existing business practices, test staff readiness and analyze business technology infrastructure to determine whether the people, processes and technology are aligned to repel cyber attacks and aligned internally with what they need to do.

The results will give management of the company the facts regarding their business so ownership can make an informed decision regarding next steps.”

The risk assessment is designed to accomplish three goals:

  1. Determine the state of the existing cyber security and information security processes and any best practices within the organization.
  2. Identify any existing security gaps. 
  3. Provide the executive team with a current picture of the organization’s ability and readiness to withstand a cyber attack.

“The report that they get at the end of the assessment will highlight any gaps they have in their security and provide steps to remediate. They could take those steps and provide them to any IT company that does cyber security and the IT company will be able to implement and close the gaps. The technical analysis is done remotely.

The risk assessment is optional if the company is small and has less than 5,000 consumer records. Anyone who would go for a do-it-yourself approach is probably not going to have more than 5,000 users and therefore they are exempt. If they have more than 5,000, they should not be doing it themselves.”

Next Steps

If you’d like to learn more about the rest of the tenants of the FTC Safeguards Rule, come to our free educational webinar on January 19, 2023 at 11 AM Eastern. And, if you have any questions related to cyber security or would like to schedule a risk assessment, contact us or book a meeting. 

Entrust your business to a team of reliable and responsive experts: You won’t regret it.

  1. https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know

The post Can I Take a DIY Approach to the FTC Safeguards Rule? appeared first on Blue Light IT.



from: https://www.bluelightit.com/diy-approach-ftc-safeguards-rule/

Comments

Post a Comment

Popular posts from this blog

Top IT Security Tips for Small Businesses

-
Image
Small businesses are increasingly at risk of falling victim to cyber-attacks and data breaches. With the growing reliance on technology, it’s crucial for small business owners to prioritize IT security measures to protect their sensitive information and maintain the trust of their customers. We’ll outline IT tips for small businesses, empowering you with the knowledge needed to safeguard your company against potential online threats. From implementing strong password protocols to investing in reliable antivirus software, these strategies will help fortify your organization’s defenses and mitigate any vulnerabilities that could leave you susceptible to a costly breach. If you’re looking for IT security for your business, you’ve come to the right place. Don’t wait until it’s too late! Find out how our Boca Raton IT solutions can improve your productivity, security, and efficiency. Cybersecurity in a Nutshell Cybersecurity is a critical aspect of running a small business today. It’s
Read more

FTC Safeguards Rule – What You Need to Know

-
Image
https://www.bluelightit.com/wp-content/uploads/2022/12/FTC-Safeguards-Rule.jpg The FTC Safeguards Rule may be completely new to you or maybe you have some familiarity. Either way, you probably have questions and are wondering what you need to know. Here are a few answers to frequent questions. What is the FTC Safeguards Rule? The FTC Safeguards Rule “requires covered financial institutions to develop, implement and maintain an information security program with administrative, technical and physical safeguards designed to protect customer information.” In other words, tax preparers must implement cyber security plans to protect client data, with a looming deadline of mid-2023. Failure to do so may result in an FTC investigation. Learn how to comply with these rules and read more guidance on data security in IRS Publication 4557, Safeguarding Taxpayer Data. When will the rule take effect? On June 9, 2023, the FTC will start enforcing the Safeguards Rule to ensure that entities
Read more

Why Your Business Is a Target for Cyber Attacks

-
Image
https://www.bluelightit.com/wp-content/uploads/2023/01/hacker-choosing-target-through-code.jpg If your business faces cyber threats, you’re not alone. According to a 2016 report by the Ponemon Institute, almost half of the companies worldwide have been affected by cyber-attacks that cost them an average of $7 million in lost productivity, legal fees, and other expenses. But what does this mean for your business? As the initial quote says, “while no company is immune to cyberattacks, the severity varies widely.” That means there are firms whose bottom line has been taken down temporarily or permanently due to these digital intrusions. Here are the reasons why your business is a target for cyber attacks. Your Data is a Goldmine The cyber-threat landscape has changed a lot in the last few years. The world’s largest center of innovation and talent, Silicon Valley, is a target because it has so much treasure trove to steal. On average, the digital bad guys are accessing more than 110 m
Read more