Standards for Safeguarding Customer Information, 70272-70314 [2021-25736]
Download as PDF
<![CDATA[
70272
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
FEDERAL TRADE COMMISSION
16 CFR Part 314
RIN 3084–AB35
Standards for Safeguarding Customer
Information
Federal Trade Commission.
Final rule.
AGENCY:
ACTION:
The Federal Trade
Commission (‘‘FTC’’ or ‘‘Commission’’)
is issuing a final rule (‘‘Final Rule’’) to
amend the Standards for Safeguarding
Customer Information (‘‘Safeguards
Rule’’ or ‘‘Rule’’). The Final Rule
contains five main modifications to the
existing Rule. First, it adds provisions
designed to provide covered financial
institutions with more guidance on how
to develop and implement specific
aspects of an overall information
security program, such as access
controls, authentication, and
encryption. Second, it adds provisions
designed to improve the accountability
of financial institutions’ information
security programs, such as by requiring
periodic reports to boards of directors or
governing bodies. Third, it exempts
financial institutions that collect less
customer information from certain
requirements. Fourth, it expands the
definition of ‘‘financial institution’’ to
include entities engaged in activities the
Federal Reserve Board determines to be
incidental to financial activities. This
change adds ‘‘finders’’—companies that
bring together buyers and sellers of a
product or service—within the scope of
the Rule. Finally, the Final Rule defines
several terms and provides related
examples in the Rule itself rather than
incorporates them from the Privacy of
Consumer Financial Information Rule
(‘‘Privacy Rule’’).
DATES:
Effective date: This rule is effective
January 10, 2022.
Applicability date: The provisions set
forth in § 314.5 are applicable beginning
December 9, 2022.
FOR FURTHER INFORMATION CONTACT:
David Lincicum (202–326–2773),
Katherine McCarron (202–326–2333), or
Robin Wetherill (202–326–2220),
Division of Privacy and Identity
Protection, Bureau of Consumer
Protection, Federal Trade Commission,
600 Pennsylvania Avenue NW,
Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
khammond on DSKJM1Z7X2PROD with RULES3
SUMMARY:
I. Background
Congress enacted the Gramm Leach
Bliley Act (‘‘GLB’’ or ‘‘GLBA’’) in 1999.1
1 Pubic
Law 106–102, 113 Stat. 1338 (1999).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
The GLBA provides a framework for
regulating the privacy and data security
practices of a broad range of financial
institutions. Among other things, the
GLBA requires financial institutions to
provide customers with information
about the institutions’ privacy practices
and about their opt-out rights, and to
implement security safeguards for
customer information.
Subtitle A of Title V of the GLBA
required the Commission and other
Federal agencies to establish standards
for financial institutions relating to
administrative, technical, and physical
safeguards for certain information.2
Pursuant to the Act’s directive, the
Commission promulgated the
Safeguards Rule (16 CFR part 314) in
2002. The Safeguards Rule became
effective on May 23, 2003.
The current Safeguards Rule requires
a financial institution to develop,
implement, and maintain a
comprehensive information security
program that consists of the
administrative, technical, and physical
safeguards the financial institution uses
to access, collect, distribute, process,
protect, store, use, transmit, dispose of,
or otherwise handle customer
information.3 The information security
program must be written in one or more
readily accessible parts.4 The safeguards
set forth in the program must be
appropriate to the size and complexity
of the financial institution, the nature
and scope of its activities, and the
sensitivity of any customer information
at issue.5 The safeguards must also be
reasonably designed to ensure the
security and confidentiality of customer
information, protect against any
anticipated threats or hazards to the
security or integrity of the information,
and protect against unauthorized access
to or use of such information that could
result in substantial harm or
inconvenience to any customer.6
In order to develop, implement, and
maintain its information security
program, a financial institution must
identify reasonably foreseeable internal
and external risks to the security,
confidentiality, and integrity of
customer information that could result
in the unauthorized disclosure, misuse,
alteration, destruction, or other
compromise of such information.7 The
financial institution must then design
and implement safeguards to control the
risks identified through the risk
2 See
15 U.S.C. 6801(b), 15 U.S.C. 6805(b)(2).
CFR 314.2(c).
4 16 CFR 314.3(a).
5 16 CFR 314.3(a), (b).
6 16 CFR 314.3(a), (b).
7 16 CFR 314.4(b).
3 16
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
assessment, and must regularly test or
otherwise monitor the effectiveness of
the safeguards’ key controls, systems,
and procedures.8 The Rule also requires
the financial institution to evaluate and
adjust its information security program
in light of the results of this testing and
monitoring, any material changes in its
operations or business arrangements, or
any other circumstances it knows or has
reason to know may have a material
impact on its information security
program.9 The financial institution must
also designate an employee or
employees to coordinate the information
security program.10
Finally, the current Safeguards Rule
requires financial institutions to take
reasonable steps to select and retain
service providers capable of maintaining
appropriate safeguards for customer
information and require those service
providers by contract to implement and
maintain such safeguards.11
II. Regulatory Review of the Safeguards
Rule
On September 7, 2016, the
Commission solicited comments on the
Safeguards Rule as part of its periodic
review of its rules and guides.12 The
Commission sought comment on a
number of general issues, including the
economic impact and benefits of the
Rule; possible conflicts between the
Rule and state, local, or other Federal
laws or regulations; and the effect on the
Rule of any technological, economic, or
other industry changes. The
Commission received 28 comments
from individuals and entities
representing a wide range of
viewpoints.13 Most commenters agreed
there is a continuing need for the Rule
and it benefits consumers and
competition.14
On April 4, 2019, the Commission
issued a notice of proposed rulemaking
(NPRM) setting forth proposed
amendments to the Safeguards Rule (the
‘‘Proposed Rule’’).15 In response, the
Commission received 49 comments
from various interested parties
8 16
CFR 314.4(c).
CFR 314.4(e).
10 16 CFR 314.4(a).
11 16 CFR 314.4(d).
12 Safeguards Rule, Request for Comment, 81 FR
61632 (Sept. 7, 2016).
13 The 28 public comments received prior to
March 15, 2019, are posted at: https://www.ftc.gov/
policy/public-comments/initiative-674.
14 See, e.g., Mortgage Bankers Association
(comment 39, NPRM); National Automobile Dealers
Association (Comment 40, NPRM); Data &
Marketing Association (comment 38, NPRM);
Electronic Transactions Association (comment 24,
NPRM); State Privacy & Security Coalition
(comment 26, NPRM).
15 FTC Notice of Proposed Rulemaking, 84 FR
13158 (April 4, 2019).
9 16
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
including industry groups, consumer
groups, and individual consumers.16 On
July 13, 2020, the Commission held a
workshop concerning the proposed
changes and conducted panels with
information security experts discussing
subjects related to the Proposed Rule.17
The Commission received 11 comments
following the workshop.18 After
reviewing the initial comments to the
Proposed Rule, conducting the
workshop, and then reviewing the
comments received following the
workshop, the Commission now issues
final amendments to the Safeguards
Rule.
khammond on DSKJM1Z7X2PROD with RULES3
III. Overview of Final Rule
As noted above, the Final Rule
modifies the current Rule in five
primary ways. First, the Final Rule
amends the current Rule to include
more detailed requirements for the
development and establishment of the
information security program required
under the Rule. For example, while the
current Rule requires financial
institutions to undertake a risk
assessment and develop and implement
safeguards to address the identified
risks, the Final Rule sets forth specific
criteria for what the risk assessment
must include, and requires the risk
assessment be set forth in writing. As to
particular safeguards, the Final Rule
requires that they address access
controls, data inventory and
classification, encryption, secure
development practices, authentication,
information disposal procedures,
change management, testing, and
incident response. And while the Final
Rule retains the requirement from the
current Rule that financial institutions
provide employee training and
appropriate oversight of service
providers, it adds mechanisms designed
to ensure such training and oversight
are effective. Although the Final Rule
has more specific requirements than the
current Rule, it still provides financial
16 The 49 relevant public comments received on
or after March 15, 2019, can be found at
Regulations.gov. See FTC Seeks Comment on
Proposed Amendments to Safeguards and Privacy
Rules, 16 CFR part 314, Project No. P145407,
https://www.regulations.gov/docket/FTC-20190019/document.
17 See FTC, Information Security and Financial
Institutions: An FTC Workshop to Examine
Safeguards Rule Tr. (July 13, 2020), https://
www.ftc.gov/system/files/documents/public_events/
1567141/transcript-glb-safeguards-workshopfull.pdf [hereinafter Safeguards Workshop Tr.].
18 The 11 relevant public comments relating to
the subject matter of the July 13, 2020, workshop
can be found at https://www.regulations.gov/
document/FTC-2020-0038-0001. This document
cites comments using the last name of the
individual submitter or the name of the
organization, followed by the number based on the
last two digits of the comment ID number.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
institutions the flexibility to design an
information security program
appropriate to the size and complexity
of the financial institution, the nature
and scope of its activities, and the
sensitivity of any customer information
at issue.
Second, the Final Rule adds
requirements designed to improve
accountability of financial institutions’
information security programs. For
example, while the current Rule allows
a financial institution to designate one
or more employees to be responsible for
the information security program, the
Final Rule requires the designation of a
single Qualified Individual. The Final
Rule also requires periodic reports to
boards of directors or governing bodies,
which will provide senior management
with better awareness of their financial
institutions’ information security
programs, making it more likely the
programs will receive the required
resources and be able to protect
consumer information.
Third, recognizing the impact of the
additional requirements on small
businesses, the Final Rule exempts
financial institutions that collect
information on fewer than 5,000
consumers from the requirements of a
written risk assessment, incident
response plan, and annual reporting to
the Board of Directors.
Fourth, the Final Rule expands the
definition of ‘‘financial institution’’ to
include entities engaged in activities the
Federal Reserve Board determines to be
incidental to financial activities. This
change brings ‘‘finders’’—companies
that bring together buyers and sellers of
a product or service—within the scope
of the Rule. Finders often collect and
maintain very sensitive consumer
financial information, and this change
will require them to comply with the
Safeguards Rule’s requirements to
protect that information. This change
will also bring the Rule into harmony
with other Federal agencies’ Safeguards
Rules, which include activities
incidental to financial activities in their
definition of financial institution.
Finally, the Final Rule includes
several definitions and related
examples, including of ‘‘financial
institution,’’ in the Rule itself rather
than incorporate them from a related
FTC rule, the Privacy of Consumer
Financial Information Rule, 16 CFR part
313. This will make the rule more selfcontained and will allow readers to
understand its requirements without
referencing the Privacy Rule.
PO 00000
Frm 00003
Fmt 4701
Sfmt 4700
70273
IV. Section-by-Section Analysis
General Comments
The Commission received 49
comments in response to the NPRM for
the Proposed Rule, from a diverse set of
stakeholders, including industry groups,
individual businesses, consumer
advocacy groups, academics,
information security experts,
government agencies, and individual
consumers. It also hosted a workshop on
the Proposed Rule, which included
approximately 20 security experts.
Some of the comments simply
expressed general support 19 or general
disapproval 20 of the Proposed Rule.
Many, however, offered detailed
responses to specific proposals in the
NPRM. In general, industry groups were
opposed to most or all of the Proposed
Rule, and consumer advocacy groups,
academics, and security experts were
generally in favor of the amendments.
The comments and workshop record are
discussed in the following Section-bySection analysis.
Sec. 314.1: Purpose and Scope
The Purpose and Scope section of the
current Rule generally states the Rule
implements the Gramm-Leach-Bliley
Act and applies to the handling of
customer information by financial
institutions over which the FTC has
jurisdiction. In its NPRM, the
Commission proposed adding a
definition of ‘‘financial institution’’
modeled on the definition included in
the Commission’s Privacy Rule (16 CFR
part 313) and a series of examples
providing guidance on what constitutes
a financial institution under the
Commission’s jurisdiction. Other than
expanding the definition of ‘‘financial
institution’’ as discussed below, the new
language was not meant to reflect a
substantive change to the Safeguards
Rule; rather, it was meant to allow the
Rule to be read on its own, without
reference to the Privacy Rule.21 The
Commission received no comments that
addressed this section specifically, and
19 See Encore Capital Group (comment 25,
NPRM); Justine Bykowski (comment 12, NPRM);
‘‘Peggy from Bloomington, MN’’ (comment 13,
NPRM); ‘‘Anonymous’’ (comment 20, NPRM).
20 ‘‘Jane Q. Citizen’’ (comment 14, NPRM).
21 In a separate final rule, published elsewhere in
this issue of the Federal Register, the Commission
is amending the Privacy Rule to reflect changes
made by the Dodd-Frank Act, limiting that rule to
certain auto dealers. Through that proceeding, the
Commission is also removing examples of financial
institutions from the Privacy Rule that are no longer
covered under the rule in the wake of these
changes.
E:\FR\FM\09DER3.SGM
09DER3
70274
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
the Commission adopts the language of
the Proposed Rule in the Final Rule.22
Sec. 314.2: Definitions
The Proposed Rule added a number of
definitions to § 314.2. The Proposed
Rule also retained paragraph (a), which
states terms used in the Safeguards Rule
have the same meaning as set forth in
the Privacy Rule.
The American Council on Education
(ACE) suggested all terms from the
Privacy Rule, such as ‘‘consumer,’’
‘‘customer,’’ and ‘‘customer
information,’’ be included in the Final
Rule in order to make the Final Rule
easier for regulated entities to
understand.23 On the other hand,
HITRUST recommended no definitions
from the Privacy Rule be duplicated in
the Safeguards Rule, reasoning that in
the event of a need to amend the terms,
it would require the amendment of two
rules rather than one.24
The Commission is persuaded
including all terms from the Privacy
Rule within the Safeguards Rule will
improve clarity and ease of use.
Accordingly, the Commission has
determined to delete paragraph (a),
since it is no longer necessary to state
all terms in the Safeguards Rule have
the same meaning as in the Privacy
Rule. It also adds the Privacy Rule
definitions of ‘‘consumer,’’ ‘‘customer,’’
‘‘customer relationship,’’ ‘‘financial
product or service,’’ ‘‘nonpublic
personal information,’’ ‘‘personally
identifiable financial information,’’
‘‘publicly available information,’’ and
‘‘you’’ to the definitions in the Final
Rule. No substantive change to these
definitions is intended.
khammond on DSKJM1Z7X2PROD with RULES3
Authorized User
The Proposed Rule added a definition
for the term ‘‘authorized user’’ as
paragraph (b). Proposed paragraph (b)
defined an authorized user of an
information system as any employee,
contractor, agent or other person that
participates in your business operations
and is authorized to access and use any
of your information systems and data.
This term was used in § 314.4(c)(10) of
the Proposed Rule, which required
financial institutions to implement
policies to monitor the activity of
‘‘authorized users’’ and detect
unauthorized access to customer
information.
22 Several commenters addressed the change to
the definition of ‘‘financial institution.’’ Those
comments are addressed in the discussion of the
definition of ‘‘financial institution’’ below.
23 American Council on Education (comment 24,
NPRM), at 7.
24 HITRUST, (comment 18, NPRM), at 2.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
definition of authorized user should
include users who can access both
‘‘information systems and data’’ and
users authorized to access either
information systems or data.
Accordingly, for clarification purposes,
the Commission modifies the definition
of authorized user in the Final Rule as
any employee, contractor, agent,
customer or other person that is
authorized to access any of your
information systems or data.
The Commission received one
comment on this proposed definition
from the National Automobile Dealers
Association (NADA), which suggested
the term ‘‘authorized user’’ was used
inconsistently and was too vague.25
NADA pointed out while ‘‘authorized
user’’ is a defined term, the term
‘‘authorized individual’’ was used in
proposed § 313.4(c)(1) (addressing
access controls for information systems)
and (c)(3) (addressing access controls for
physical data). NADA also argued the
inclusion of ‘‘other person that
participates in the business operations
of an entity’’ within the definition of
‘‘authorized user’’ was unclear and
created ambiguity in its application.26
The Commission agrees with NADA’s
points, and, in response, modifies the
Final Rule in two ways. First, the Final
Rule replaces the term ‘‘authorized
individual’’ with ‘‘authorized user’’ in
§ 313.4(c)(1). As described further
below, because the Final Rule combines
§ 313.4(c)(3) with § 313.4(c)(1), there is
no need to make a corresponding
change to that section.
Second, because the Commission
agrees the ambiguities in the definition
of ‘‘authorized user’’ from the Proposed
Rule could create confusion, it makes
several changes to the definition. It
deletes the phrase ‘‘other person that
participates in the business operations
of an entity.’’ The Commission agrees
this phrase was vague. The Commission
had intended it to cover any person the
financial institution allows to access
information systems or data, including,
for example, ‘‘customers’’ of the
financial institutions. For the purpose of
controlling authorized access and
detecting unauthorized access (which is
where the definition of ‘‘authorized
user’’ appears), financial institutions
should monitor anomalous patterns of
usage of their systems, not only by
employees and agents, but also by
customers and other persons authorized
to access systems or data. To clarify this
point, the Commission adds ‘‘customer
or other person’’ to the definition of
‘‘authorized users.’’
The Commission intends that the
definition of ‘‘authorized users’’ should
include anyone who the financial
institution authorizes to access an
information system or data, regardless of
whether that user actually uses the data.
Thus, for clarity, the Commission has
deleted the requirement that the
authorized user be authorized to use the
information system or data. Finally, the
In proposed paragraph (c), the
Commission defined security event as
an event resulting in unauthorized
access to, or disruption or misuse of, an
information system or information
stored on such information system. This
term was used in provisions requiring
financial institutions to establish a
written incident response plan designed
to respond to security events. It also
appeared in the provision requiring the
coordinator of a financial institution’s
information security program to provide
an annual report to the financial
institution’s governing body; the
required report must identify all
security events that took place that year.
Commenters expressed three main
concerns with this definition. The first
relates to whether the term ‘‘security
event’’ should be expanded to instances
in which there is unauthorized access
to, or disruption or misuse of,
information in physical form, as
opposed to electronic form. The
Proposed Rule used the term ‘‘security
event’’ instead of ‘‘cybersecurity event’’
to clarify that an information security
program encompasses information in
both digital and physical forms and that
unauthorized access to paper files, for
example, would also be a security event
under the Rule. The Money Services
Round Table (MSRT), however, noted
despite the use of the more general
‘‘security’’ in the defined term, the
definition itself is limited to events
involving information systems.27 The
Commission agrees this creates a
contradiction. Accordingly, the Final
Rule includes the compromise of
customer information in physical form
in the definition of ‘‘security event.’’
Second, some industry groups argued
a ‘‘security event’’ should occur only
when there is ‘‘unauthorized access’’ to
an information system, not in cases in
which there has been a ‘‘disruption or
misuse’’ of such systems (e.g., a
ransomware attack).28 These
25 National Automobile Dealers Association
(comment 46, NPRM), at 11–12.
26 National Automobile Dealers Association
(comment 46, NPRM), at 11–12.
27 Money Services Round Table (comment 53,
NPRM), at 5 n.14.
28 National Independent Automobile Dealers
Association (comment 48, NPRM), at 4; National
PO 00000
Frm 00004
Fmt 4701
Sfmt 4700
Security Event
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
commenters argued the disruption or
misuse of information systems is not
directly related to the protection of
customer information and is, therefore,
outside the Commission’s statutory
authority.29 The Commission disagrees.
Requiring a financial institution to
protect against disruption and misuse of
its information system is within the
Commission’s authority under the
GLBA, which directed the Commission
to promulgate a rule that required
financial institutions to ‘‘to protect
against any anticipated threats or
hazards to the security or integrity’’ of
customer information. A disruption or
misuse of an information system will be,
in many cases, a threat to the ‘‘integrity’’
of customer information. In addition,
disruption or misuse may also indicate
the existence of a security weakness that
could be exploited to gain unauthorized
access to customer information. For
example, an event in which ransomware
placed on a system is used to encrypt
customer information, rendering it
useless, raises the possibility similar
software could have been used to
exfiltrate customer information.
Accordingly, the Final Rule retains the
inclusion of ‘‘misuse or disruption’’
within the definition of ‘‘security
event.’’
Third, several commenters suggested
the definition of ‘‘security event’’ be
limited to events in which there is a risk
of consumer harm or some other
negative effect.30 Similarly, some
commenters argued the definition
should exclude events that involve
encrypted information in which the
encryption key was not compromised or
when there is evidence the information
accessed has not been misused.31 The
Commission declines to narrow the
provision in this manner. It believes a
financial institution should still engage
in its incident response procedures to
determine whether the event indicates a
weakness that could endanger customer
Automobile Dealers Association (comment 46,
NPRM), at 12–13; Consumer Data Industry
Association (comment 36, NPRM), at 3–4.
29 National Independent Automobile Dealers
Association (comment 48, NPRM), at 4; National
Automobile Dealers Association (comment 46,
NPRM), at 12–13.
30 HITRUST (comment 18, NPRM), at 3; American
Council on Education (comment 24, NPRM), at 7;
Mortgage Bankers Association (comment 26,
NPRM), at 4–5; Consumer Data Industry
Association (comment 36, NPRM), at 3–4; National
Automobile Dealers Association (comment 46,
NPRM), at 12–13; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 4.
31 Mortgage Bankers Association (comment 48,
NPRM), at 4–5; National Automobile Dealers
Association (comment 46, NPRM), at 12–13;
National Independent Automobile Dealers
Association (comment 48, NPRM) at 4; American
Council on Education (comment 24, NPRM), at 7.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
information and to respond accordingly.
The financial institution can then take
the appropriate steps in response.
Further, § 314.4(h) of the Final Rule,
which sets forth the requirement for an
incident response plan, requires the
incident response plan be designed to
respond only to security events
‘‘materially affecting the confidentiality,
integrity, or availability of customer
information,’’ limiting the impact of the
definition of ‘‘security event.’’
Accordingly, the Final Rule defines
security event as an event resulting in
unauthorized access to, or disruption or
misuse of, an information system,
information stored on such information
system, or customer information held in
physical form. The Proposed Rule
placed this definition as paragraph (c),
out of alphabetical order. The Final Rule
adopts it as paragraph (p), placing it in
alphabetical order with the other
definitions in § 314.2.
Encryption
Proposed paragraph (e) defined
encryption as the transformation of data
into a form that results in a low
probability of assigning meaning
without the use of a protective process
or key. This term was used in proposed
§ 314.4(c)(4), which generally required
financial institutions to encrypt
customer information. This definition
was intended to define the process of
encryption while not requiring any
particular technology or technique for
achieving the protection provided by
encryption.
NADA argued this definition should
be made more flexible by adding an
alternative so it would read ‘‘the
transformation of data into a form that
results in a low probability of assigning
meaning without the use of a protective
process or key or securing information
by another method that renders the data
elements unreadable or unusable’’
(emphasis added).32 On the other hand,
others argued the Proposed Rule’s
definition did not sufficiently protect
customer information.33 For example,
the Princeton University Center for
Information Technology Policy
(‘‘Princeton Center’’) suggested the Rule
should be changed ‘‘to clarify that
encryption must be consistent with
current cryptographic standards and
accompanied by appropriate safeguards
for cryptographic key material.’’ 34
32 National Automobile Dealers Association
(comment 46, NPRM), at 13.
33 American Council on Education (comment 24,
NPRM), at 7; Princeton University Center for
Information Technology Policy (comment 54,
NPRM), at 4.
34 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 4.
PO 00000
Frm 00005
Fmt 4701
Sfmt 4700
70275
Similarly, ACE argued the definition
should include ‘‘the transformation of
data in accordance with industry
standards.’’ 35
The Commission agrees the proposed
definition should be tethered to some
technical standard, without being too
prescriptive about what that standard is.
Under the proposed definition, as well
as NADA’s proposed definition,
financial institutions could have
claimed they were ‘‘encrypting’’ data if
they were aggregating it, scrambling it,
or redacting it in a way that made it
possible to re-identify the data through,
for example, the application of common
algorithms or programs. The
Commission does not believe this would
have provided consumers with
sufficient protection. The Commission
also agrees with the commenters who
stated the definition should signal that
encryption should be cryptographically
based.
Accordingly, the Final Rule defines
encryption as the transformation of data
into a form that results in a low
probability of assigning meaning
without the use of a protective process
or key, consistent with current
cryptographic standards and
accompanied by appropriate safeguards
for cryptographic key material. This
definition does not require any specific
process or technology to perform the
encryption but does require that
whatever process is used be sufficiently
robust to prevent the deciphering of the
information in most circumstances.
Financial Institution
Incidental Activity
The Proposed Rule made one
substantive change to the definition of
‘‘financial institution’’ it incorporated
from the Privacy Rule. The change was
designed to include entities
‘‘significantly engaged in activities that
are incidental to [] financial activity’’ as
defined by the Bank Holding Company
Act. This proposed change brought only
one activity into the definition that was
not covered before: the act of ‘‘finding’’
as defined in 12 CFR 225.86(d)(1). The
proposed revision to paragraph (f)
added an example of a financial
institution acting as a finder by
‘‘bringing together one or more buyers
and sellers of any product or service for
transactions that the parties themselves
negotiate and consummate.’’ This
example used the language set forth in
12 CFR 225.86(d)(1), which defines
‘‘finding’’ as an activity incidental to a
financial activity under the Bank
Holding Company Act. The Commission
35 American Council on Education (comment 24,
NPRM), at 7.
E:\FR\FM\09DER3.SGM
09DER3
70276
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
adopts this proposal without
modification.
The change to the definition of
‘‘financial institution’’ brings it into
harmony with other agencies’ GLB
rules.36 The change is supported by the
language of the Gramm-Leach-Bliley
Act.37 The Act defines a ‘‘financial
institution’’ as any institution ‘‘the
business of which is engaging in
financial activities as described in
section 1843(k) of title 12.’’ 38 That
section, in turn, describes activities that
are financial in nature as those the
Board has determined ‘‘to be financial
in nature or incidental to such financial
activity.’’ 39 The Final Rule’s definition
mirrors this language. The change will
not lead to a significant expansion of the
Rule coverage as it expands the
definition only to include entities
engaged in activity incidental to
financial activity, as determined by the
Federal Reserve Board. The Board has
determined only one activity to be
incidental to financial activity—‘‘acting
as a finder.’’ 40
Several commenters who addressed
this issue supported the inclusion of
activities incidental to financial
activities.41 Other commenters
expressed concern the proposed change
in the definition would expand the
Rule’s coverage to businesses that
should not be considered financial
institutions.42 They argued the
definition of the term ‘‘finder’’ is too
broad and companies that connect
buyers and sellers in non-financial
contexts would be swept
inappropriately into the definition of
‘‘financial institution.’’ The Association
of National Advertisers argued
advertising agencies could be
considered ‘‘finders’’ because they play
36 See 12 CFR 1016.3(l) (defining ‘‘financial
institution’’ for entities regulated by agencies other
than the FTC). See also 17 CFR 248.3(n) (defining
‘‘financial institution’’ to include ‘‘any institution
the business of which is . . . incidental to . . .
financial activities’’ for Security and Exchange
Commission’s rule implementing GLBA’s safeguard
provisions.).
37 15 U.S.C. 6801 et seq.
38 15 U.S.C. 6809(3).
39 12 U.S.C. 1843(k).
40 12 CFR 225.86.
41 Electronic Privacy Information Center
(comment 55, NPRM), at 9; Independent
Community Bankers of America (comment 35,
NPRM), at 3; National Automobile Dealers
Association (comment 46, NPRM), at 13–16.
42 Association of National Advertisers (comment,
Workshop), at 4–5; internet Association (comment,
Workshop), at 4–5; see also Anonymous (comment
15, NPRM) (questioning whether any governing
body would oversee any future determinations by
the Federal Reserve Board that activities are
incidental to financial activity).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
a role in connecting buyers and
sellers.43
In response, the Commission notes
the Federal Reserve Board describes
acting as a finder as ‘‘bringing together
one or more buyers and sellers of any
product or service for transactions that
the parties themselves negotiate and
consummate.’’ 44 The Board sets forth
several activities within the scope of
acting as a finder, such as ‘‘[i]dentifying
potential parties, making inquiries as to
interest, introducing and referring
potential parties to each other, []
arranging contacts between and
meetings of interested parties’’ and
‘‘[c]onveying between interested parties
expressions of interest, bids, offers,
orders and confirmations relating to a
transaction.’’ 45
Although this language is somewhat
broad, its scope is significantly limited
in the context of the Safeguards Rule.
First, the Safeguards Rule applies only
to transactions ‘‘for personal, family, or
household purposes.’’ 46 Therefore, only
finding services involving consumer
transactions will be covered. Second,
the Safeguards Rule applies only to the
information of customers, which are
consumers with which a financial
institution has a continuing
relationship.47 Therefore, it will not
apply to finders that have only isolated
interactions with consumers and do not
receive information from other financial
institutions about those institutions’
customers. This significantly narrows
the types of finders that will have
obligations under the Rule, excluding,
the Commission believes, most
advertising agencies and similar
businesses that generally do not have
continuing relationships with
consumers who are using their services
for personal or household purposes.
The Commission believes entities that
perform finding services for consumers
with whom they have an ongoing
relationship are properly considered
‘‘financial institutions’’ for purposes of
the Rule. Accordingly, the Commission
adopts the changes to the definition of
‘‘financial institution’’ as proposed.
Other Changes to Definition of
‘‘Financial Institutions’’
Other commenters suggested
modifying the definition of ‘‘financial
institution’’ 48 in different ways. The
43 Association of National Advertisers (comment
5, Workshop), at 5.
44 12 CFR 225.86 (d).
45 12 CFR 225.86 (d)(1)(i).
46 See Final Rule 16 CFR 314.2(b)(1).
47 16 CFR 314.1; Final Rule 16 CFR 314.2(c).
48 National Pawnbrokers Association (comment
32, NPRM), at 5–6 (arguing that transactionreporting vendors be included in definition);
PO 00000
Frm 00006
Fmt 4701
Sfmt 4700
Electronic Privacy Information Center
(EPIC) argued the definition should be
expanded by treating more activities as
financial activities.49 EPIC pointed out
information shared with social media
companies, retailers, apps, and devices
generally is not covered under the
Safeguards Rule. The Commission
understands the concern that many
businesses fall outside the coverage of
the Safeguards Rule, despite handling
sensitive consumer information, but the
Commission’s authority to regulate
activity under the Safeguards and
Privacy Rules is established by the
GLBA. The Rule’s application is limited
to financial institutions as defined by
that statute and cannot be extended
beyond that definition.50 The
institutions discussed by EPIC,
however, are still covered by the FTC
Act’s prohibition against deceptive or
unfair conduct, including with respect
to their use and protection of consumer
information.51
The National Federation of
Independent Business (NFIB) argued
individuals and sole proprietors should
be excluded from the definition of
‘‘financial institution’’ because an
individual cannot be an ‘‘institution.’’ 52
When the Privacy Rule was
promulgated in 2000, commenters also
suggested the definition should exclude
sole proprietors.53 The Commission
noted there was no basis to exclude sole
proprietors and ‘‘[w]hether or not a
National Consumer Law Center and others
(comment 58, NPRM), at 5 (arguing that consumer
reporting agencies be included explicitly in the
definition); see also American Escrow Association
(comment, Workshop), at 2–3 (requesting that the
Rule specifically set out the duties of real estate
settlement operations and other businesses that
handle but do not maintain sensitive information);
Beverly Enterprises, LLC (comment 3, NPRM), at 3–
4 (requesting that the Rule specifically set out
duties related to online notarizations); Yangxue Li
(comment 5, NPRM) (asking whether Rule would
set forth specific guidelines for different industries);
Slobadon Raybolka (comment 17, NPRM)
(suggesting that companies that perform online
background checks be covered by the rule); The
Clearing House (comment 49, NPRM) (suggesting a
separate set of more stringent rules for fintech
companies).
49 Electronic Privacy Information Center
(comment 55, NPRM), at 9.
50 See 15 U.S.C. 6801 (requiring agencies to
promulgate Rule establishing standards for financial
institutions); 15 U.S.C. 6809(3) (defining ‘‘financial
institutions’’ as an ‘‘institution the business of
which is engaging in financial activities as
described’’ in the Bank Holding Company Act).
51 In the Matter of Facebook, Inc., Docket No. C–
4365 (Apr. 28, 2020); FTC v. Wyndham Worldwide
Corporation, 799 F.3d 236 (3d Cir. 2015); FTC v. DLink Systems, Inc., Case No. 3:17–cv–00039–JD
(N.D. Cal. July 2, 2019); In the Matter of Twitter,
Inc., Docket No. C–4316 (Mar. 11, 2011).
52 National Federation of Independent Business
(comment 16, NPRM), at 2–3.
53 Privacy Rule, Final Rule, 65 FR 33645 (May 24,
2000) at 33656.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
commercial enterprise is operated by a
single individual is not determinative’’
of whether the enterprise is a financial
institution. The Commission has not
changed its position on this matter and
declines to make this change to the
definition of ‘‘financial institution.’’
The Final Rule adopts this definition
as proposed without change.
Information Security Program
Paragraph (i) of the Final Rule adopts
the existing Rule’s paragraph (c) and
does not alter the definition of
‘‘information security program.’’ The
Commission received no comments on
this definition, and accordingly, adopts
the current definition in the Final Rule.
khammond on DSKJM1Z7X2PROD with RULES3
Information System
Proposed paragraph (h) defined
information system as a discrete set of
electronic information resources
organized for the collection, processing,
maintenance, use, sharing,
dissemination or disposition of
electronic information, as well as any
specialized system such as industrial/
process controls systems, telephone
switching and private branch exchange
systems, and environmental control
systems. The term ‘‘information system’’
was used throughout the proposed
amendments to designate the systems
that must be covered by the information
security program.
The MSRT suggested this definition
was too narrow in some respects and too
broad in others.54 It argued the
definition of ‘‘information system’’ was
too narrow because it did not include
physical systems or employees and
would exclude them from some of the
provisions of the Rule. Specifically, the
MSRT argued that based on this
definition, the penetration tests required
by § 314.4(d)(2) would not be required
to test ‘‘potential human
vulnerabilities’’ such as social
engineering or phishing.55 The
Commission does not agree. Penetration
testing, as defined by the Final Rule, is
a process through which testers
‘‘attempt to circumvent or defeat the
security features of an information
system.’’ 56 One way such security
features are tested is through social
engineering and phishing.57 The fact
that the testing involves employees with
access to the information system, rather
54 Money Services Round Table (comment 53,
NPRM), at 5–6.
55 Id. at 5.
56 Final Rule § 314.2(j).
57 Indeed, Workshop participant Scott Wallace
noted, in conducting penetration testing, ‘‘the first
thing [he does]’’ is generally to ‘‘prepare for the
phishing campaign.’’ Remarks of Scott Wallace,
Safeguards Workshop Tr., supra note 17, at 131–32.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
than just the system itself, does not
exclude such tests from the definition of
‘‘penetration testing.’’ Attempted social
engineering and phishing are important
parts of testing the security of
information systems and would not be
excluded by this definition.
The MSRT also argued the definition
was too broad, and was joined by other
commenters in this concern.58 These
commenters shared a concern the
proposed definition would include
systems that are in no way connected to
customer information and would
require financial institutions to include
all systems in their possession,
regardless of their involvement with
customer information. The Commission
agrees the definition should be limited
to those systems that either contain
customer information or are connected
to systems that contain customer
information, and adds that limitation to
the Final Rule. The Rule does not limit
the definition to only those systems that
contain customer information, because a
common source of data breaches is a
vulnerability in a connected system that
an attacker exploits to gain access to the
company’s network and move within
the network to obtain access to the
system containing sensitive
information.59 Accordingly, the
definition of information system in the
Final Rule is modified to a discrete set
of electronic information resources
organized for the collection, processing,
maintenance, use, sharing,
dissemination or disposition of
electronic information containing
customer information or any such
system connected to a system
containing customer information, as
well as any specialized system such as
industrial/process controls systems,
telephone switching and private branch
exchange systems, and environmental
controls systems, that contains customer
information or that is connected to a
system that contains customer
information.
58 Money Services Round Table (comment 53,
NPRM), at 5; Consumer Data Industry Association
(comment 36, NPRM), at 4; American Council on
Education (comment 24, NPRM), at 7–8.
59 See Remarks of Serge Jorgensen, Safeguards
Workshop Tr., supra note 17, at 58–59 (noting
cybersecurity attacks can take advantage of systems
that are connected to the systems in which sensitive
information is stored); Remarks of Tom Dugas,
Safeguards Workshop Tr., supra note 17, at 138
(noting a vulnerability in one system can result in
the exposure of information maintained in another
system); see also Remarks of Rocio Baeza,
Safeguards Workshop Tr., supra note 17, at 106–07
(noting the heightened importance of encryption in
a context where numerous systems are connected);
Remarks of James Crifasi, Safeguards Workshop Tr.,
supra note 17, at 107–08 (same).
PO 00000
Frm 00007
Fmt 4701
Sfmt 4700
70277
Multi-Factor Authentication
Proposed paragraph (i) defined multifactor authentication as authentication
through verification of at least two of
the following types of authentication
factors: Knowledge factors, such as a
password; possession factors, such as a
token; or inherence factors, such as
biometric characteristics. This term was
used in proposed § 314.4(c)(6),60 which
required financial institutions to
implement multi-factor authentication
for individuals accessing networks that
contain customer information.
Several commenters argued the
definition should explicitly include
SMS text messages as an acceptable
example of a possession factor or
otherwise to be explicitly allowed.61
The Proposed Rule did not include SMS
text messages as an example of a
possession factor.62 Most commenters
who addressed this issue interpreted
this exclusion from the examples as
forbidding financial institutions from
using SMS text messages as a possession
factor for multi-factor authentication.
That is not the effect of this exclusion,
however. The language of the definition
neither prohibits nor recommends use
of SMS text messages. Indeed, SMS text
messages are not addressed at all. In
some cases, use of SMS text messages as
a factor may be the best solution
because of its low cost and easy use, if
its risks do not outweigh those benefits
under the circumstances.63 In other
instances, however, the use of SMS text
messages may not be a reasonable
solution, such as when extremely
sensitive information can be obtained
through the access method being
controlled, or when a more secure
method can be used for a comparable
price. A financial institution will need
to evaluate the balance of risks for its
situation. If, however, the Commission
were to explicitly allow use of SMS text
messages, this could be considered a
safe harbor that would not require the
company to consider risks associated
with use of SMS text as a factor in a
particular use case. Accordingly, the
Final Rule does not include SMS text
60 Section
314.4(c)(5) in the Final Rule.
Transactions Association (comment
27, NPRM), at 4; U.S. Chamber of Commerce
(comment 33, NPRM), at 9; CTIA (comment 34,
NPRM), at 7–9; Global Privacy Alliance (comment
38, NPRM), at 9; National Automobile Dealers
Association (comment 46, NPRM), at 29; National
Independent Automobile Dealers Association
(comment 48, NPRM), at 6.
62 See, e.g., NIST Special Publication 800–63B,
Digital Identity Guidelines, 5.1.3.3 (restricting use
of verification using the Public Switched Telephone
Network (SMS or voice) as an ‘‘out-of-band’’ factor
for multi-factor authentication).
63 See, e.g., Remarks of Wendy Nather, Safeguards
Workshop Tr., supra note 17, at 231–32.
61 Electronic
E:\FR\FM\09DER3.SGM
09DER3
70278
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
messages in the examples of possession
factors.
The final Rule adopts the proposed
definition of ‘‘multi-factor
authentication’’ without change as
paragraph (k) of this section.
khammond on DSKJM1Z7X2PROD with RULES3
Penetration Testing
Proposed paragraph (j) defined
penetration testing as a test
methodology in which assessors attempt
to circumvent or defeat the security
features of an information system by
attempting penetration of databases or
controls from outside or inside your
information systems. This term was
used in proposed § 314.4(d)(2), which
required financial institutions to
continually monitor the effectiveness of
their safeguards or to engage in annual
penetration testing. The Commission
received no comments concerning this
definition. The Final Rule adopts the
definition from the Proposed Rule as
paragraph (m) of this section.
Personally Identifiable Financial
Information
To minimize cross-referencing to the
Privacy Rule, as noted above, the
Commission is adding several
definitions to the Final Rule. One of
these definitions is ‘‘personally
identifiable financial information,’’
which is identical to the definition
currently contained in the Privacy Rule.
This term is included within the ambit
of ‘‘customer information,’’ in both the
existing Rule and the Final Rule.
The Princeton Center suggested
expanding the definition of ‘‘personally
identifiable financial information’’ from
the Privacy Rule to include ‘‘aggregate
information or blind data that does not
contain personal identifiers such as
account numbers, names, or
addresses.’’ 64 The Princeton Center
further suggested clarifying that, for
information to not be considered
‘‘personally identifiable financial
information,’’ the financial institution
must be required to demonstrate the
information is not ‘‘reasonably linkable’’
to individuals.
The Commission does not believe this
amendment is necessary. The definition
of ‘‘personally identifiable financial
information’’ is already a broad one.65 It
includes not just information associated
with types of personal information such
as a name or address or account
number, but also information linked to
a persistent identifier (‘‘any information
you collect through an Internet ‘cookie’
(an information collecting device from a
64 Princeton University Center for Information
Technology Policy (comment 54, NPRM) at 9–10.
65 See 16 CFR 313.3(o)(1).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
web server’’)).66 While there may be
some merit to limiting the exception for
aggregate information or blind data to
data that cannot be reasonably linkable
to an individual, for purposes of a rule
that can be periodically updated to keep
up with changing technology, the
current approach is more concrete and
enforceable, and less subject to
differences in interpretation.
Service Provider
Proposed paragraph (k) adopted the
existing Rule’s definition and does not
alter the definition of ‘‘service
provider.’’ The Commission received no
comments on this definition and adopts
it as paragraph (q) of the Final Rule.
Sec. 314.3: Standards for Safeguarding
Customer Information
Proposed § 314.3, which required
financial institutions to develop an
information security program
(paragraph (a)) and set forth the
objectives of the Rule (paragraph (b)),
was largely identical to the existing
Rule. It changed only the requirement
that ‘‘safeguards’’ be based on the
elements set forth in § 314.4, by
replacing ‘‘safeguards’’ with
‘‘information security program.’’ The
Commission received no comments on
this proposal and adopts it without
change in the Final Rule.
Sec. 314.4: Elements
Proposed § 314.4 altered the current
Rule’s required elements of an
information security program and added
several new elements.
General Comments
The Commission received many
comments addressing the new elements,
both in favor of the changes and
opposed to them. The comments in
favor of the changes generally argued
these changes would protect consumers
by improving the data security of
institutions that hold their
information.67 Most of the comments
opposed to the proposed elements fell
into several categories, objecting: (1)
The proposed changes were too
prescriptive and did not allow financial
66 16
CFR 313.3(o)(2)(i)(F).
e.g., New York Department of Financial
Service (comment 40, NPRM), at 1 (arguing the
Proposed Rule would ‘‘further advance efforts to
protect financial institutions and consumers from
cybercriminals.’’); Princeton University Center for
Information Technology Policy (comment 54,
NPRM), at 1 (stating the Proposed Rule ‘‘would
significantly reduce data security risks for the
customers of financial institutions.’’); National
Consumer Law Center and others (comment 58,
NPRM), at 2 (stating requirements of Proposed Rule
are ‘‘reasonable and common-sense measures that
any company dealing with large amounts of
consumer personal information should take.’’).
67 See,
PO 00000
Frm 00008
Fmt 4701
Sfmt 4700
institutions sufficient flexibility in
managing their information security; (2)
the proposed amendments would be too
expensive for financial institutions,
particularly smaller institutions, to
adopt; and (3) some of the requirements
should not apply to all customer
information but should be limited to
some subset of especially ‘‘sensitive’’
customer information. The Commission
does not agree with these comments for
the reasons discussed below, and
accordingly, retains the general
approach of the Proposed Rule in the
Final Rule.
Flexibility
Many industry groups argued the new
proposed elements were too
prescriptive, lacked flexibility, would
quickly become outdated, and would
force financial institutions to engage in
activities that would not enhance
security.68 For example, the Electronics
Transactions Association argued the
Proposed Rule would ‘‘limit the ability
of industry to develop new and
innovative approaches to information
security.’’ 69 Similarly, CTIA
commented the Proposed Rule would
create a ‘‘prescriptive core of
requirements that covered businesses
must follow, irrespective of whether risk
assessments show they are
necessary.’’ 70
The Commission, however, believes
the elements provide sufficient
flexibility for financial institutions to
adopt information security programs
suited to the size, nature, and
complexity of their organization and
information systems. The elements for
the information security programs set
forth in this section are high-level
principles that set forth basic issues the
68 See, e.g., HITRUST (comment 18, NPRM), at 1–
2; American Council on Education (comment 24,
NPRM), at 2–4; Cristian Munarriz (comment 21,
NPRM); Electronic Transactions Association
(comment 27, NPRM), at 1–2; National Pawnbrokers
Association (comment 32, NPRM), at 3; CTIA
(comment 34, NPRM), at 5; Consumer Data Industry
Association (comment 36, NPRM), at 2; Wisconsin
Bankers Association (comment 37, NPRM), at 1–2;
Global Privacy Alliance (comment 38, NPRM), at 5–
6; Bank Policy Institute (comment 39, NPRM), at 2;
American Financial Services Association (comment
41, NPRM), at 4; National Association of Dealer
Counsel (comment 44, NPRM), at 1; ACA
International, (comment 45, NPRM), at 4; National
Automobile Dealers Association (comment 46,
NPRM), at 11; National Independent Automobile
Dealers Association (comment 48, NPRM), at 2–3;
Money Services Round Table (comment 53, NPRM),
at 1–4; Software & Information Industry Association
(comment 56, NPRM), at 1–3; Gusto and others
(comment 11, Workshop), at 2; Association of
National Advertisers (comment 5, Workshop), at 1–
3; internet Association (comment 9, Workshop), at
2–3.
69 Electronic Transactions Association (comment
27, NPRM), at 1–2.
70 CTIA (comment 34, NPRM), at 5.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
programs must address, and do not
prescribe how they will be addressed.
For example, the requirement that the
information security program be based
on a risk assessment sets forth only
three general items the assessment must
address: (1) Criteria for evaluating risks
faced by the financial institution; (2)
criteria for assessing the security of its
information systems; and (3) how the
identified risks will be addressed. Other
than meeting these basic requirements,
financial institutions are free to perform
their risk assessments in whatever way
they choose, using whatever method or
approach works best for them, as long
as the method identifies reasonably
foreseeable risks. The other elements are
similarly flexible. The two elements that
are more prescriptive, encryption and
multi-factor authentication, allow
financial institutions to adopt
alternative solutions when necessary.
Comments concerning individual
elements are addressed separately in the
more detailed analysis below.
khammond on DSKJM1Z7X2PROD with RULES3
Cost
Another common theme among the
comments from industry groups was the
proposed information security program
elements would be prohibitively
expensive, especially for smaller
businesses.71 Commenters argued the
Proposed Rule would have required
financial institutions to implement
expensive changes to their systems and
hire highly-compensated professionals
to do so.72 Industry groups were
71 American Council on Education (comment 24,
NPRM), at 13–14; Wisconsin Bankers Association
(comment 37, NPRM), at 1–2; American Financial
Services Association (comment 41, NPRM), at 4;
National Association of Dealer Counsel (comment
44, NPRM), at 1; National Automobile Dealers
Association (comment 46, NPRM), at 11; National
Independent Automobile Dealers Association,
(comment 48, NPRM), at 3; Gusto and others
(comment 11, Workshop), at 2–4; National
Pawnbrokers Association (comment 3, NPRM), at 2;
see also Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 72–74 (describing
study that found compliance would be expensive
for automobile dealers).
72 See, e.g., Slides Accompanying Remarks of
James Crifasi, FTC, ‘‘NADA Cost Study: Average
Cost Per U.S. Franchised Dealership,’’ Event
Materials, Information Security and Financial
Institutions: An FTC Workshop to Examine
Safeguards Rule (July 13, 2020) https://www.ftc.gov/
system/files/documents/public_events/1567141/
slides-glb-workshop.pdf (hereinafter Safeguards
Workshop Slides), at 25 (estimating an upfront cost
of $293,975 per dealership, and an recurring annual
cost of $276,925); see also Remarks of James Crifasi,
Safeguards Workshop Tr., supra note 17, at 72–75;
Remarks of Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 78 (estimating the
average annual salary of a CISO can range from
$180,000 to upwards of $400,000); Slides
Accompanying Remarks of Lee Waters, ‘‘Estimated
Costs of Proposed Changes,’’ Safeguards Workshop
Slides, at 26 (estimating the annual costs of a
security program to include: Multi-factor
authentication, $50 for smart card readers, and $10
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
particularly concerned about the
requirement that financial institutions
designate a single qualified individual
to coordinate their information security
programs, arguing this would require
hiring professionals that were both
expensive, with salaries of more than
$100,000 suggested by some, and in
limited supply.73 Overall, several
commenters argued some financial
institutions would be unable to afford to
bring themselves into compliance with
the Proposed Rule.74
The Commission recognizes properly
securing information systems can be an
expensive and technically difficult task.
However, the Commission believes the
additional costs imposed by the
Proposed Rule are mitigated for several
reasons and, ultimately, those costs are
justified in order to protect customer
information as required by the GLBA.75
each for smart cards; a CISO, either an in-house
CISO, $180,000, an in-house cybersecurity analyst,
$76,000, or an outsourced cybersecurity contractor,
between $120,000 and $240,000; penetration
testing, average cost $4,800; and physical security,
$215,000 for construction, and $10,000 to $20,000
for new or upgraded locks); see also Remarks of Lee
Waters, Safeguards Workshop Tr., supra note 17, at
75–76.
73 See, e.g., Slides Accompanying Remarks of Lee
Waters, ‘‘Estimated Costs of Proposed Changes,’’
Safeguards Workshop Slides, supra note 72, at 26
(estimating costs of an in-house CISO to be
$180,000 annually, and an in-house cybersecurity
analyst to be $76,000 annually; and estimating an
outsourced cybersecurity contractor would cost
between $120,000 to $240,000 annually); see also
Remarks of Lee Waters, Safeguards Workshop Tr.,
supra note 17, at 75–76; Remarks of Brian
McManamon, Safeguards Workshop Tr., supra note
17, at 78 (estimating that the average annual salary
of a CISO can range from $180,000 to upwards of
$400,000).
74 See Remarks of Lee Waters, Safeguards
Workshop Tr., supra note 17, at 119–20 (noting
when small businesses have to spend money to hire
third-party vendors and security experts to comply
with regulations, that affects consumer prices and
small business profit margins); Slides
Accompanying Remarks of James Crifasi, ‘‘NADA
Cost Study: Average Cost Per U.S. Franchised
Dealership,’’ Safeguards Workshop Slides, supra
note 72, at 25; see also Remarks of James Crifasi,
supra note 17, at 73 (noting the requirements ‘‘start
becoming a little bit unaffordable here.’’).
75 The Small Business Administration’s Office of
Advocacy commented it was concerned the FTC
had not gathered sufficient data as to either the
costs or benefits of the proposed changes for small
financial institutions. Office of Advocacy, U.S.
Small Business Administration (comment 28,
NPRM), at 3–4. The FTC shares the Office of
Advocacy’s interest in ensuring that regulatory
changes have an evidentiary basis. Many of the
questions on which the FTC sought public
comment, both in the regulatory review and in the
proposed Rule context, specifically related to the
costs and benefits of existing and proposed Rule
requirements. Following the initial round of
commenting, the Commission conducted the FTC
Safeguards Workshop and solicited additional
public comments with the explicit goal of gathering
additional data relating to the costs and benefits of
the proposed changes. See Public Workshop
Examining Information Security for Financial
Institutions and Information Related to Changes to
PO 00000
Frm 00009
Fmt 4701
Sfmt 4700
70279
First, for almost 20 years, financial
institutions have been required under
the current Safeguards Rule to have
information security programs in place.
The current Safeguards Rule requires
financial institutions to ‘‘develop,
implement, and maintain a
comprehensive [written] information
security program . . . appropriate to
[the financial institutions’] size and
complexity, the nature and scope of
[their] activities, and the sensitivity of
any customer information at issue.’’ 76
This comprehensive program must be
coordinated by one or more individuals
and based on a risk assessment.77 As
such, financial institutions complying
with the current Rule will not be
required to establish an information
security program from scratch. Instead,
they can compare their existing
programs to the revised Rule, and
address any gaps. The Commission
believes many of the requirements set
forth in the Final Rule are so
fundamental to any information security
program that the information security
programs of many financial institutions
will already include them if those
programs are in compliance with the
current Safeguards Rule.
Second, a number of commenters who
raised concerns about the costs imposed
by the Rule believed the Proposed Rule
would have required the hiring of a
highly-compensated expert to serve as a
Chief Information Security Officer
(CISO).78 It is correct the Proposed Rule
would have modified the current
requirement of designating an
‘‘employee or employees to coordinate
your information security program’’ by
requiring the designation of a single
qualified individual responsible for
the Safeguards Rule, 85 FR 13082 (Mar. 6, 2020).
As detailed throughout this document, the
Commission believes there is a strong evidentiary
basis for the issuance of the final Rule.
76 16 CFR 314.3.
77 16 CFR 314.4.
78 Several speakers at the Safeguards Workshop
also raised this concern. See, e.g., Slides
Accompanying Remarks of James Crifasi, ‘‘NADA
Cost Study: Average Cost Per U.S. Franchised
Dealership,’’ in Safeguards Workshop Slides, supra
note 72, at 25 (estimating appointing a CISO to
increase program accountability would be a onetime, up-front cost of $27,500, with a recurring
annual cost of $51,000); Remarks of James Crifasi,
Safeguards Workshop Tr., supra note 17, at 72–75;
Slides Accompanying Remarks of Lee Waters,
‘‘Estimated Costs of Proposed Changes,’’ in
Safeguards Workshop Slides, supra note 72, at 26
(estimating costs of an in-house CISO to be
$180,000 annually, and an in-house cybersecurity
analyst to be $76,000 annually; and estimating that
an outsourced cybersecurity contractor would cost
between $120,000 to $240,000 annually); Remarks
of Lee Waters, Safeguards Workshop Tr., supra note
17, at 75–76; Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 78
(estimating that the average annual salary of a CISO
can range from $180,000 to upwards of $400,000).
E:\FR\FM\09DER3.SGM
09DER3
70280
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
overseeing and implementing the
security program. This individual was
referred to in the Proposed Rule as a
Chief Information Security Officer or
‘‘CISO.’’ As discussed in detail below,
the Final Rule does not use this term,
though the concept is the same: The
person designated to coordinate the
information security program need only
be ‘‘qualified.’’ No particular level of
education, experience, or certification is
prescribed by the Rule. Accordingly,
financial institutions may designate any
qualified individual who is appropriate
for their business. Only if the
complexity or size of their information
systems require the services of an expert
will the financial institution need to
hire such an individual.79
Finally, the Commission believes
while large financial institutions may
well incur substantial costs to
implement complex information
security programs, there are much more
affordable solutions available for
financial institutions with smaller and
simpler information systems. For
example, there are very low-cost or even
free vulnerability assessment programs
available: ‘‘virtual CISO’’ services
enable a third party to provide security
support for many companies, splitting
the cost of information security
professionals among them; many
applications and hardware have built-in
encryption requirements; 80 and there
are affordable multi-factor
authentication solutions aimed at
businesses of various sizes.
Considering these points, although
there will undoubtedly be expenses
involved for some, or even many,
financial institutions to update their
programs, the Commission believes
these expenses are justified because of
the vital importance of protecting
customer information collected,
maintained, and processed by financial
institutions. Congress recognized the
importance of securing consumers’
sensitive financial information when it
passed the GLBA, which required the
FTC to promulgate the Safeguards Rule.
79 See, e.g., Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 89–90
(noting the size of a financial institution and the
amount and nature of the information it holds factor
into an appropriate information security program);
see also Slides Accompanying Remarks of Rocio
Baeza, ‘‘Models for Complying to the Safeguards
Rule Changes,’’ in Safeguards Workshop Slides,
supra note 72, at 27–28 (describing three different
compliance models: In-house, outsource, and
hybrid, with costs ranging from $199 per month to
more than $15,000 per month); Remarks of Rocio
Baeza, Safeguards Workshop Tr., supra note 17, at
81–83 (describing three compliance models in more
detail).
80 See Remarks of Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 78 (describing
virtual CISO services).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
The importance, as well as the
difficulty, of protecting customer
information has only increased in the
more than twenty years since the
passage of the GLBA. The Commission
believes the amendments to the
Safeguards Rule are necessary to ensure
the purposes of the GLBA are satisfied,
and so consumers can have confidence
financial institutions are providing
reasonable safeguards to protect their
information.
‘‘Sensitive’’ Customer Information
Several industry groups also
suggested significant portions of the
Proposed Rule should not apply to all
customer information, but rather only to
some subset of particularly ‘‘sensitive’’
customer information, such as account
numbers or social security numbers.81
These commenters generally argued the
definition of ‘‘customer information’’ is
too broad, as it will include information
the commenters felt is not particularly
sensitive, such as name and address,
and does not justify extensive
safeguards.82
The Commission does not agree that
some portion of customer information is
not entitled to the protections required
by the Final Rule. The Safeguards Rule
defines ‘‘customer information’’ as ‘‘any
record containing nonpublic personal
information’’ about a customer handled
or maintained by or on behalf of a
financial institution.83 The Final Rule
defines ‘‘nonpublic personal
information’’ as ‘‘personally identifiable
financial information,’’ but does not
include information that is ‘‘publicly
available.’’ Although this definition is
broad, the Commission believes
information covered by it is rightfully
considered sensitive and should be
protected accordingly. The businesses
regulated by the Safeguards Rule are not
just any businesses, but are financial
institutions and are responsible for
handling and maintaining financial
information that is both important to
consumers and valuable to attackers
who try to obtain the information for
financial gain. Even the fact that a
consumer is a customer of a particular
financial institution is generally
nonpublic and can be sensitive. For
example, the revelation of a customer
81 See, e.g., Electronic Transactions Association
(comment 27, NPRM), at 2–4; CTIA (comment 34,
NPRM), at 10; Global Privacy Alliance (comment
38, NPRM), at 7–8; American Financial Services
Association (comment 41, NPRM), at 5; ACA
International (comment 45, NPRM), at 13; Money
Services Round Table (comment 53, NPRM), at 6–
7.
82 See, e.g., Electronic Transactions Association
(comment 27, NPRM), at 2; Global Privacy Alliance
(comment 38, NPRM), at 7.
83 16 CFR 314.2(b).
PO 00000
Frm 00010
Fmt 4701
Sfmt 4700
relationship between a consumer and a
particular type of financial institution,
such as debt collectors or payday
lenders, may make those customers’
information more vulnerable to
compromise by facilitating social
engineering or similar attacks. The
nature of the relationship between
customers and their financial
institutions makes all nonpublic
information held by the financial
institution inherently sensitive and
worthy of the level of protection set
forth in the Rule.
Although the Commission believes all
customer information should be
safeguarded by financial institutions
and declines to exclude any portion of
that information from protection under
any of the provisions of the Rule, it
notes the Rule does contemplate
financial institutions will consider the
sensitivity of particular information in
designing their information security
programs and safeguards. The elements
required by this section are generally
flexible enough to allow financial
institutions to treat various pieces of
information differently. For example,
paragraph (c)(1) requires information
security programs to include safeguards
that address access control of customer
information. The paragraph requires
financial institutions to develop
measures to ensure only authorized
users access customer information, but
does not prescribe any particular
measures that must be adopted. When
designing these measures, a financial
institution may design a system in
which more sensitive information is
protected by more stringent access
controls. Even in the more specific
provisions of the Rule, there is
flexibility to address the relative
sensitivity of information. For example,
in § 313.4(c)(5)’s requirement that
customer information be protected by
multi-factor authentication, financial
institutions have flexibility to
implement the multi-factor
authentication depending on the
sensitivity of the information. The
financial institution may select factors
such as SMS text messages to access less
sensitive information, but determine
more sensitive information should be
protected by other, more secure, factors
for authentication.
Third-Party Standards and Frameworks
In addition, in the NPRM, the
Commission asked whether the
Safeguards Rule should incorporate
outside standards, such as the National
Institute of Standards and Technology
(‘‘NIST’’) framework, either as required
elements of an information security
program or as a safe harbor that would
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
treat compliance with such a standard
as compliance with the Safeguards Rule.
Some commenters advocated for the
adoption of an outside standard into the
Safeguards Rule.84 Cisco Systems, Inc.
suggested the Safeguards Rule should be
connected to NIST guidance, arguing
this would allow the Rule to evolve as
NIST’s guidance evolves.85 An
anonymous commenter suggested the
Rule should comply with ‘‘international
standard ISO/IEC 27001.’’ 86 The
National Consumer Law Center argued
certain financial institutions with
particularly sensitive customer
information should be required to
comply with guidelines issued by NIST
and the Federal Financial Institutions
Examination Council (FFIEC).87 Other
commenters acknowledged the value of
outside standards but were opposed to
the Rule requiring compliance with
them.88
Some commenters suggested while
compliance with outside standards
should not be required, compliance
should serve as a ‘‘safe harbor’’ for
compliance with the Rule.89 On the
other hand, Consumer Reports noted
while such standards can be helpful
guidance, they should not be a safe
harbor for compliance with the Rule
because financial institutions must take
steps to ensure they are responding to
changing information security threats
regardless of the requirements of an
outside framework.90
The Commission declines to change
the Rule to incorporate or reference a
particular security standard or
framework for a variety of reasons. First,
it is not clear the more detailed
frameworks would apply well to
financial institutions of various sizes
84 Cisco Systems, Inc. (comment 51, NPRM), at 4;
National Consumer Law Center and others
(comment 58), at 2; Anonymous (comment 2,
Workshop).
85 Cisco Systems, Inc. (Comment 51, NPRM), at 4.
86 Anonymous (comment 2, Workshop). The ISO/
IEC 27001 standard is an information security
standard issued by the International Organization
for Standardization. See ISO/IEC 27001 Information
Security Management, ISO, https://www.iso.org/
isoiec-27001-information-security.html (last
accessed 15 Dec. 2020).
87 National Consumer Law Center and others
(comment 58, NPRM), at 2.
88 HITRUST (comment 18, NPRM), at 2; see also
Consumer Reports (comment 52, NPRM), at 6–7
(discouraging the adoption of outside standards as
a safe harbor for companies).
89 Mortgage Bankers Association (comment 26,
NPRM), at 2 (suggesting Rule be modified so
financial institutions that use the NIST
Cybersecurity Framework would be in de facto
compliance with the Rule); see also National
Pawnbrokers Association (comment 32, NPRM), at
6–7 (advocating for the adoption of safe harbors for
small financial institutions without detailing what
should be required to qualify for the safe harbor).
90 Consumer Reports (comment 52, NPRM), at 6–
7.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
and industries. In addition, mandating
companies follow a particular security
standard or framework would reduce
the flexibility built into the Rule.
Similarly, the Commission declines to
make compliance with an outside
standard a safe harbor for the Rule. In
such a scenario, the use of safe harbors
would not greatly enhance regulatory
stability or predictability for financial
institutions because the Commission
would be required to actively monitor
whether those standards continued to
provide equivalent protections for
Safeguards compliance and modify the
Rule if a standard became inadequate. In
addition, in investigating possible
violations of the Rule, the Commission
would be required to independently
verify whether the financial institution
had in fact complied with the outside
framework, which would require
substantial effort and expense on the
part of the Commission and the target of
the investigation.
Specific Elements
In addition to these generally
applicable comments, commenters
addressed many of the individual
elements set forth by this section. These
elements are discussed in more detail
below.
Paragraph (a)—Designation of a Single
Qualified Individual
Proposed paragraph (a) changed the
current requirement that institutions
designate an ‘‘employee or employees to
coordinate your information security
program’’ to instead require the
financial institution to designate ‘‘a
qualified individual responsible for
overseeing and implementing your
information security program and
enforcing your information security
program.’’ 91 This individual was
referenced in the Proposed Rule as a
Chief Information Security Officer or
‘‘CISO.’’
The notice of proposed rulemaking for
the Proposed Rule emphasized the use
of the term ‘‘CISO’’ was for clarity in the
Proposed Rule.92 Despite the use of the
term ‘‘CISO,’’ the Proposed Rule did not
require financial institutions to actually
grant that title to the designated
individual. Commenters that responded
to this proposal, however, generally
assumed the person designated to
coordinate and oversee a financial
institution’s information security
program would be required to have the
qualifications, duties, responsibilities,
and accompanying pay of a CISO as that
position is generally understood in the
91 Section
92 84
PO 00000
314.4(a).
FR 13165.
Frm 00011
Fmt 4701
Sfmt 4700
70281
information security field.93 The
position of CISO is generally limited to
large companies with fairly complex
information security systems, so the
salary of this position is often very
high.94 Accordingly, many commenters
argued hiring a CISO would be
prohibitively expensive for many
financial institutions.95 Additionally,
commenters argued the hiring of such
an in-demand professional would be
difficult because of a general shortage of
such professionals available for hiring.96
By using the term ‘‘CISO,’’ the
Commission did not intend to require
all financial institutions hire a highly
qualified professional with an extremely
high salary, regardless of the financial
institutions’ size or complexity. The
Proposed Rule required only that
financial institutions designate a
‘‘qualified individual’’ to oversee and
enforce their information security
program, without specifying any
particular level of experience,
education, or compensation, or
requiring any particular duties outside
of overseeing the financial institution’s
information security program and other
requirements specifically set forth in the
Rule.97 The use of the term ‘‘CISO’’ in
the Proposed Rule, however, caused
confusion about the requirements of this
section. Accordingly, the Final Rule
replaces the term ‘‘CISO’’ with
‘‘Qualified Individual’’ to refer to the
individual designated under this section
of the Rule.
The use of the term ‘‘Qualified
Individual’’ is meant to clarify the only
requirement for this designated
individual is that he or she be qualified
to oversee and enforce the financial
institution’s information security
program. What qualifications are
necessary will depend upon the size
and complexity of a financial
institution’s information system and the
volume and sensitivity of the customer
information the financial institution
93 U.S. Chamber of Commerce (comment 33,
NPRM), at 10; National Automobile Dealers
Association (comment 46), at 17–19; National
Independent Automobile Dealers Association
(comment 48, NPRM), at 5; ACA International
(Comment 45, NPRM), at 8.
94 See. e.g., Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 78 (estimating the
average annual salary of a CISO can range from
$180,000 to upwards of $400,000).
95 National Automobile Dealers Association
(comment 46, NPRM), at 17–19; National
Independent Automobile Dealers Association
(comment 48, NPRM), at 5; U.S. Chamber of
Commerce (comment 33, NPRM), at 10; ACA
International (comment 45, NPRM), at 8.
96 National Automobile Dealers Association
(comment 46, NPRM), at 18–19; U.S. Chamber of
Commerce (comment 33, NPRM), at 10; ACA
International (comment 45, NPRM), at 8.
97 84 FR 13175.
E:\FR\FM\09DER3.SGM
09DER3
70282
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
possesses or processes. The Qualified
Individual of a financial institution with
a very small and simple information
system will need less training and
expertise than a Qualified Individual for
a financial institution with a large,
complex information system. The exact
qualifications will depend on the nature
of the financial institution’s information
system. Each financial institution will
need to evaluate its own information
security needs and designate an
individual with appropriate
qualifications to meet those needs.
The Commission believes, in many
cases, financial institutions’ current
coordinators, whether their own
employees or third-party contractors,
may be qualified for this role.98 Because
the current Safeguards Rule requires
financial institutions to designate an
‘‘employee or employees to coordinate
your information security program,’’
financial institutions in compliance
with that Rule will already have one or
more information security coordinators.
Although the current Rule does not
expressly require that these coordinators
be qualified for that position, the
current Rule requires a financial
institution to maintain ‘‘appropriate’’
safeguards, regularly test those
safeguards, and evaluate and adjust the
information security program in light of
that testing.99 In order to effectively
comply with these ongoing
requirements, a financial institution’s
coordinator must have some level of
information security training and
knowledge and, therefore, will likely be
an appropriate Qualified Individual
under the Final Rule. Accordingly, in
many cases this amendment to the Rule
will not require any additional hiring
expenses.
In addition to explicitly requiring that
the information security program
coordinator be qualified for the role, the
Commission proposed to require the
designation of a single employee, as
opposed to the multiple coordinators
allowed by the existing Rule. Some
commenters objected to this proposal on
the grounds that it would interfere with
financial institutions’ flexibility in
98 Remarks of James Crifasi, Safeguards Workshop
Tr., supra note 17, at 74 (stating car dealerships can
rely on existing staff for this role); Remarks of Lee
Waters, Safeguards Workshop Tr., supra note 17, at
78–79 (stating any dealership with any IT staff at
all would have someone who could assume the role
of ‘‘qualified individual,’’ perhaps requiring some
additional research or outside help); Remarks of
Rocio Baeza, Safeguards Workshop Tr., supra note
17, at 81–82 (stating companies may use an existing
employee for the role and ‘‘for any areas where
there may be skill gaps, that can be supplemented
with either certifications or some type of
education.’’).
99 16 CFR 314.4.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
organizing their information security
personnel.100 For example, the
Consumer Data Industry Association
(‘‘CDIA’’) commented the designation of
a single coordinator would interfere
with financial institutions’ ability to
organize their program ‘‘to share
responsibilities among different
personnel with different strengths.’’ 101
Similarly, ACA International argued this
requirement would prevent financial
institutions from having multiple staff
members share responsibilities for
information security programs.102
Other commenters argued the
designation of a single individual as the
coordinator of the information security
program provides no proven benefits
over the use of multiple coordinators.103
Similarly, NADA argued that, while the
appointment of a single qualified
individual might improve
accountability, improving
accountability does not improve
security.104 On the other hand, a group
of consumer and advocacy groups
including the National Consumer Law
Center (‘‘NCLC’’) argued appointing a
single individual as the coordinator of
the information security program can
increase security and prevent security
events based on lack of accountability
and poor coordination.105
The Commission retains the
requirement to designate a single
qualified individual, because it believes
there are clear benefits to the
designation of a single coordinator.
Designating a single coordinator to
oversee an information security program
clarifies lines of reporting in enforcing
the program, can avoid gaps in
responsibility in managing data
100 National Independent Automobile Dealers
Association (comment 48, NPRM), at 5; Consumer
Data Industry Association (comment 36, NPRM), at
5; National Association of Dealer Counsel (comment
44, NPRM), at 2; ACA International (comment 45,
NPRM), at 7–8; Money Services Round Table
(comment 53, NPRM), at 10; Gusto and others
(Comment 11, Workshop), at 2; see also Remarks of
James Crifasi, Safeguards Workshop TR, supra note
17, at 74 (stating ‘‘when we’re talking about a small
and medium business [. . .] we really need to see
that ‘qualified individual’ be a mix of folks’’).
101 Consumer Data Industry Association
(comment 36, NPRM), at 5.
102 ACA International (comment 45, NPRM), at 7–
8. NPA raised similar concerns. National
Pawnbrokers Association (comment 3, Workshop),
at 2.
103 Consumer Data Industry Association
(comment 36, NPRM), at 5; National Automobile
Dealers Association (comment 46, NPRM), at 19;
ACA International (comment 45, NPRM), at 8.
104 National Automobile Dealers Association
(comment 46, NPRM), at 19.
105 National Consumer Law Center and others
(comment 58, NPRM), at 3 (arguing that a clear line
of reporting with a single responsible individual
could have prevented the Equifax consumer data
breach).
PO 00000
Frm 00012
Fmt 4701
Sfmt 4700
security, and improve
communication.106
The Commission disagrees with the
commenter who stated improved
accountability does not lead to
improved security. The goal of
improving accountability is to ensure
information security staff and financial
institution management give the
necessary attention and resources to
information security. In addition, an
individual that has clear responsibility
for the strength of a financial
institution’s information security
program will be accountable to improve
the program and ensure it protects
customer information.107
The major breach that occurred at
national consumer reporting agency
Equifax in 2017 demonstrates the
importance of clear lines of reporting
and accountability in management of
information security programs. The U.S.
House Committee on Oversight and
Government Reform issued a report on
the breach that identified Equifax’s
organization as one of the major causes
of the breach.108 The report indicated
Equifax’s division of responsibility for
information security between two
individuals that reported to two
different company officers contributed
to failures of communication, oversight,
and enforcement that led to millions of
consumers’ data being compromised.109
Increasing accountability for individuals
and organizations can directly lead to
improved security for customer
information.
Finally, the Commission does not
believe the requirement to designate a
single Qualified Individual would
106 Remarks of Adrienne Allen, Safeguards
Workshop Tr., supra note 17, at 182–84 (stating that
without a single responsible individual,
information security staff ‘‘can fall into traps of
each relying on someone else to make a hard call
. . . [In a program without a single coordinator]
issues can sometimes fall through the cracks.’’);
Remarks of Michele Norin, Safeguards Workshop
Tr., supra note 17, at 184–85 (‘‘I think it’s extremely
important to have a person in front of the
information security program. I think that there are
so many components to understand, to manage, to
keep an eye on. I think it’s difficult to do that if
it’s part of someone else’s job. And so I found that
it’s extremely helpful to have a person in charge of
that program just from a pure basic management
perspective and understanding perspective.’’).
107 See, e.g., Federal Trade Commission Staff
Comment on the Preliminary Draft for the NIST
Privacy Framework: A Tool for Improving Privacy
through Enterprise Risk Management (Oct. 24,
2019), at 12–14 (suggesting NIST clarify that one
person should be in charge of the program). https://
www.ftc.gov/system/files/documents/advocacy_
documents/ftc-staff-comment-preliminary-draftnist-privacy-framework/p205400nistprivacy
frameworkcomment.pdf.
108 U.S. House, Committee on Oversight and
Government Reform, Majority Staff Report, The
Equifax Data Breach, at 55–62, 115th Congress (Dec.
2018).
109 Id.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
prevent the approach of having multiple
people responsible for different aspects
of the program, as some commenters
asserted. While the Qualified Individual
appointed as the coordinator of the
information security program would
have ultimate responsibility for
overseeing and managing the
information security program, financial
institutions may still assign particular
duties and responsibilities to other staff
members.110 A financial institution may
organize its personnel in teams or share
decision making between individuals.
Moreover, the Rule does not require this
be the Qualified Individual’s sole job—
he or she may have other duties. The
Rule requires only that one individual
assume the ultimate responsibility for
overseeing and enforcing the program.
Accordingly, the Final Rule requires
designation of a single Qualified
Individual, as proposed, but no longer
uses the term ‘‘CISO.’’
khammond on DSKJM1Z7X2PROD with RULES3
Third-Party Coordinators
The Proposed Rule stated that the
Qualified Individual would not need to
be an employee of the financial
institution, but could be an employee of
an affiliate or a service provider. This
change was intended to accommodate
financial institutions that may prefer to
retain an outside expert, lack the
resources to employ a qualified person
to oversee a program, or decide to pool
resources with affiliates to share staff to
manage information security. The
Proposed Rule required, however, that
to the extent a financial institution used
a service provider or affiliate, the
financial institution must still: (1)
Retain responsibility for compliance
with the Rule; (2) designate a senior
member of its personnel to be
responsible for direction and oversight
of the Qualified Individual; and (3)
require the service provider or affiliate
to maintain an information security
program that protects the financial
institution in accordance with the Rule.
The Commission received one
comment on this aspect of the
provision. NADA argued that, because a
senior member of a financial
institution’s personnel must be
responsible for the oversight of a thirdparty Qualified Individual, the
supervising individual would need to be
an expert in information security, and
the financial institution would still be
required to hire an expensive employee
to supervise the third-party Qualified
110 See Remarks of Adrienne Allen, Safeguards
Workshop Tr., supra note 17, at 189–90 (noting
that, even where there is a single point person,
decision makers rarely operate ‘‘in a vacuum.’’).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
Individual.111 The Rule, however, does
not require individuals responsible for
overseeing third-party Qualified
Individuals to be information security
experts themselves. The senior
personnel that oversees the third-party
Qualified Individual is charged with
supervising and monitoring the thirdparty so the financial institution is
aware of its data security needs and the
safeguards being used to protect its
information systems. This person does
not need to be qualified to coordinate
the information security program him or
herself. Technical staff are frequently
supervised by employees or officers
with limited technical expertise.112 The
Rule requires only the same
responsibilities a supervisor would have
in overseeing an in-house information
security coordinator of a financial
institution. Accordingly, the
Commission adopts the proposed
paragraph without modification.
Proposed Paragraph (b)
The NPRM proposed amending
paragraph (b) to clarify a financial
institution must base its information
security program on the findings of its
risk assessment by adding an explicit
statement that financial institutions’
‘‘information security program [shall be
based] on a risk assessment.’’ 113 In
addition, the Proposed Rule removed
existing § 314.4(b)’s requirement that
the risk assessment must include
consideration of specific risks 114
because these specific risks are set forth
elsewhere in the Proposed Rule.115 The
Commission received no comments on
this paragraph and adopts paragraph (b)
as proposed.
Written Risk Assessment
Paragraph (b)(1) of the Proposed Rule
required the risk assessment be written
and include: (1) Criteria for the
evaluation and categorization of
111 National Automobile Dealers Association
(comment 46, NPRM), at 18.
112 See Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 79–80 (stating that,
in his work as a third-party information security
service provider, he is often overseen by executives
without technical backgrounds); see also Remarks
of Rocio Baeza, Safeguards Workshop Tr., supra
note 17, at 105–06 (noting distinction in how
executives and technical staff may understand their
organizations’ use of encryption); Remarks of
Karthik Rangarajan, Safeguards Workshop Tr.,
supra note 17, at 196 (discussing challenges
inherent in discussing technical issues with board
members who lack a technical background)and at
211 (noting organizations can successfully manage
their relationships with third-party service
providers without ‘‘becom[ing] experts’’ in the
services provided).
113 Proposed 16 CFR 314.4(b).
114 Proposed 16 CFR 314.4(b)(1), (2), and (3).
115 See, e.g., Proposed 16 CFR 314.4(c)(2) and (10)
and (e).
PO 00000
Frm 00013
Fmt 4701
Sfmt 4700
70283
identified security risks or threats the
financial institution faces; (2) criteria for
the assessment of the confidentiality,
integrity, and availability of the
financial institution’s information
systems and customer information,
including the adequacy of the existing
controls in the context of the identified
risks or threats to the financial
institution; and (3) requirements
describing how identified risks will be
mitigated or accepted based on the risk
assessment and how the information
security program will address the
financial institution’s risks. Commenters
raised several concerns about the
Proposed Rule’s provisions on risk
assessment, none of which merit
changes to the Proposed Rule.
First, some commenters objected to
the level of specificity of the Proposed
Rule, with some arguing the
requirements were too specific, and
others arguing the requirements were
not specific enough. With respect to the
Proposed Rule being too specific,
commenters such as ACA and U.S.
Chamber of Commerce argued it
removed financial institutions’
flexibility in performing risk
assessments.116 The U.S. Chamber of
Commerce contended, because the
criteria are too specific, a risk
assessment performed using them
would not be ‘‘sufficiently risk
based.’’ 117 CDIA expressed concern it
was unclear ‘‘what level of specificity is
required’’ in the written risk assessment
and if detailed risk assessments are
required, they ‘‘could themselves
become a roadmap for a security
breach.’’ 118
In contrast, several other commenters
recommended the Rule set forth more
specific criteria for risk assessments.
Inpher suggested the Commission add a
requirement that risk assessments
require financial institutions to examine
‘‘technologies that are deployed by
[financial institutions’] information
security systems, and evaluate the
feasibility’’ of adopting ‘‘privacy
enhancing technologies’’ that would
better address vulnerabilities and thwart
threats.119 Inpher also recommended the
Rule require financial institutions to
conduct privacy impact assessments
with ‘‘specific guidelines to review
internal data protection standards and
adherence to fair information
116 ACA International (comment 45, NPRM), at
12; U.S. Chamber of Commerce (comment 33,
NPRM), at 10.
117 U.S. Chamber of Commerce (comment 33,
NPRM), at 10.
118 Consumer Data Industry Association
(comment 36, NPRM), at 5.
119 Inpher, Inc. (comment 50, NPRM), at 4.
E:\FR\FM\09DER3.SGM
09DER3
70284
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
principles.’’ 120 The Princeton Center
suggested the Rule require risk
assessments to include threat modeling
and adopt the concept of defense in
depth.121 HALOCK Security Labs
recommended the Rule specifically
require ‘‘a) That risk assessments should
evaluate the likelihood of magnitudes of
harm that result from threats and errors,
b) That risk assessments should
explicitly estimate foreseeable harm to
consumers as well as to the covered
financial institutions, c) That risk
mitigating controls are commensurate
with the risks they address, [and] d)
That risk assessments estimate
likelihoods and impacts using available
data.’’ 122
The Commission believes the
Proposed Rule’s provisions on risk
assessment strike the right balance
between specificity and flexibility. The
amendments provide only a high-level
list of criteria the risk assessment must
address. They essentially require that
the financial institution identify and
evaluate risks to its systems, evaluate
the adequacy of its existing controls for
addressing these risks, and identify how
these risks can be mitigated. These are
core requirements of any riskassessment.123 The Rule does not
require any specific methodology or
approach for performing the assessment.
Financial institutions are free to perform
the risk assessment using the method
most suitable for their organization as
long as that method meets the general
requirements set forth in the Rule. 124
And while the Commission agrees the
additional requirements suggested by
some commenters may be beneficial in
many, or even most, risk assessments, it
khammond on DSKJM1Z7X2PROD with RULES3
120 Id.
121 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 2.
122 HALOCK Security Labs (comment 4,
Workshop) at 2. See Rocio Baeza (comment 12,
Workshop) at 2–3 (suggesting a detailed list of
requirements for the risk assessment).
123 See, e.g., Remarks of Chris Cronin, Safeguards
Workshop Tr., supra note 17, at 25 (stating that
evaluating the likelihoods and impacts of potential
security risks and evaluating existing controls is an
important component of a risk assessment);
Remarks of Serge Jorgensen, Safeguards Workshop
Tr., supra note 17, at 29–30 (emphasizing the
importance of risk assessments as tools for adjusting
existing security measures to account for both
current and future security threats); Nat. Inst. of Sci.
& Tech., U.S. Dept. of Com., Special Publication
800–30 Rev. 1, Guide for Conducting Risk
Assessments 1 (2012) (describing the purpose of
risk assessments as the identification of and
prioritization of risk in order to inform decision
making and risk response).
124 ACA International further argued because risk
assessment criteria are generally understood, they
do not need to be included in the Final Rule. ACA
International (comment 45, NPRM). The
Commission believes it is helpful to be clear about
the criteria the risk assessment must contain, even
if those criteria are commonly understood.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
believes a more flexible requirement
will better allow financial institutions to
find the risk assessment method that
best fits their organization and will
better accommodate changes in
recommended approaches in the future.
In response to CDIA’s concern about
the risk assessment providing a
roadmap for bad actors, certainly, the
written risk assessment will include
details about a financial institution’s
systems that could assist an attacker if
obtained by the attacker. Accordingly,
the risk assessment should be protected
as any other sensitive information
would be. The Commission does not
view this concern as a reason not to
create such a document. Indeed, the
concern would apply to any written
document that provides information
regarding a financial institution’s
information security procedures, from a
network diagram to written security
code.
Second, some commenters argued
implementing the risk-assessment
provision as proposed would be too
expensive and difficult for financial
institutions.125 For example, NADA
argued the contemplated risk
assessment would be very costly
because the criteria set out in paragraph
(b)(1) are ‘‘well outside the scope of
expertise of anyone but the most
sophisticated IT professionals.’’ 126 In
response, although the Commission
declines to modify the provision, it
addresses NADA’s concern in § 314.6 by
exempting financial institutions that
maintain information concerning fewer
than 5,000 consumers from the specific
requirements of paragraph (b)(1), and
from the requirement to memorialize the
risk assessment in writing. For those
financial institutions that do not qualify
for this exemption, the Commission
believes they will be able to perform the
required risk assessment in a manner
that is practical and affordable for their
institution. There are many resources
available to financial institutions to aid
in risk assessment, including service
providers that can assist institutions of
various sizes.127
125 National Association of Dealer Counsel
(comment 44, NPRM), at 3; National Automobile
Dealers Association (comment 46, NPRM), at 20.
126 National Automobile Dealers Association
(comment 46, NPRM), at 20.
127 See, e.g., Slides Accompanying Remarks of
Rocio Baeza, in Safeguards Workshop Slides, supra
note 72, at 27–28 (describing three different
compliance models: In-house, outsource, and
hybrid, with costs ranging from $199 per month to
more than $15,000 per month); Slides
Accompanying the Remarks of Brian McManamon,
‘‘Sample Pricing,’’ in Safeguards Workshop Slides,
supra note 72, at 29 (estimating the cost of
cybersecurity services based on number of
endpoints: $2K–$5K per month for 25–250
endpoints; $5K–$15K for 250–750 endpoints;
PO 00000
Frm 00014
Fmt 4701
Sfmt 4700
While acknowledging there will be
some cost to conducting a risk
assessment, the Commission believes a
properly conducted risk assessment is
an essential part of a financial
institution’s information security
program. The entire Safeguards Rule,
both as it currently exists and as
amended, requires that the information
security program be based on a risk
assessment. An information security
program cannot properly guard against
risks to customer information if those
risks have not been identified and
assessed.128 The Commission believes
this requirement properly emphasizes
the importance of robust risk
assessments, while providing financial
institutions sufficient flexibility in
performing these assessments. Finally,
the Commission notes, because the
current Rule also requires that a risk
assessment be performed, financial
institutions that have complied with the
current Rule have already conducted a
risk assessment. And, even if that risk
assessment was not memorialized in
writing, the work conducted for that risk
assessment should be useful in
performing future risk assessments.
Third, NADA objected to the
requirement that the risk assessment
describe how each identified risk will
be ‘‘mitigated or accepted,’’ arguing it is
not clear when it is appropriate to
‘‘accept a risk.’’ 129 NADA argued that
documenting a decision to accept a risk
would ‘‘create a record that can be
distorted and second guessed after the
fact,’’ and ‘‘context is lost when it is
written and reviewed after an incident
has occurred.’’ 130 The Rule does not
require a financial institution to mitigate
every risk identified, no matter how
remote or insignificant. Instead, the
Rule allows a financial institution to
accept a risk, if its assessment of the risk
reveals that the chance it will produce
a security event is very small, if the
consequences of the risk are minimal, or
the cost of mitigating the risk far
outweighs the benefit. In those cases,
the financial institution may choose to
accept the risk. A financial institution
concerned that its decision to accept a
risk will later be questioned may choose
to set forth whatever context or
$15K–$30K for 750–1,000 endpoints; and $30K–
$50K for 1,500–2,500 endpoints); see also Remarks
of Brian McManamon, Safeguards Workshop Tr.,
supra note 17, at 83–85.
128 See Remarks of Chris Cronin, Safeguards
Workshop Tr., supra note 17, at 48–49 (noting all
information security frameworks and guidelines are
based on risk analysis).
129 National Automobile Dealers Association
(comment 46, NPRM) at 20.
130 Id.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
explanation it sees fit in the written
assessment.
Finally, while several commenters
supported the idea of conducting
‘‘periodic’’ risk assessments as required
by the Proposed Rule,131 NADA
objected it is unclear how often
financial institutions need to conduct
risk assessments under this section. 132
In order to be effective, a risk
assessment must be subject to periodic
reevaluation to adapt to changes in both
financial institutions’ information
systems and changes in threats to the
security of those systems. The
Commission declines, however, to set
forth a specific schedule for risk
assessments. The Commission believes
it would not be appropriate to set forth
an inflexible schedule for periodic risk
assessments because each financial
institution must set its own schedule
based on the needs and resources of its
institution.
The Final Rule adopts § 314.4(b) as
proposed.
khammond on DSKJM1Z7X2PROD with RULES3
Paragraph (c)
Proposed paragraph (c) retained the
existing Rule’s requirement for financial
institutions to design and implement
safeguards to control the risks identified
in the risk assessment. In addition, it
added more detailed requirements for
what the safeguards must address (e.g.,
access controls, data inventory,
disposal, change management,
monitoring). These specific
requirements represent elements of an
information security program that the
Commission views as essential and
should be addressed by all financial
institutions.133
As a preliminary matter, Global
Privacy Alliance (GPA) argued all of
these elements should be made optional
131 Inpher, Inc. (comment 50, NPRM), at 3; Global
Privacy Alliance (comment 38, NPRM), at 11.
132 National Automobile Dealers Association
(comment 46, NPRM), at 20.
133 NADA disagreed with the Commission’s
statement in the NPRM for the Proposed Rule that
‘‘most financial institutions already implement’’ the
specific requirements in paragraph (c), stating that
many financial institutions ‘‘do not currently
implement some or all of these measures.’’ National
Automobile Dealers Association (comment 46,
NPRM), at 20. The Commission continues to believe
most financial institutions institute some form of
most of these measures, such as access control,
secure disposal, and monitoring authorized users,
based on its enforcement and business outreach
experience. While NADA’s statement that some
financial institutions implement none of the
measures may be true, this underlines the necessity
of making these elements explicit requirements
under the Rule, as these elements are necessary for
a reasonable information security program for all
financial institutions. Indeed, a financial institution
that utilizes none of these elements and exercises
no access control, no secure disposal procedures,
and does not monitor users of its systems is
unlikely to be in compliance with the current Rule.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
and financial institutions should be
required only to take these elements
‘‘into consideration’’ when designing
their information security programs.134
While the Commission agrees it is
important that the Rule allow financial
institutions flexibility in designing their
information security programs, these
elements are such important parts of
information security that each program
must address them. For example, an
information security program that has
no access controls or does not contain
any measures to monitor the activities of
users on the systems cannot be said to
be protecting the financial institution’s
systems. The Final Rule, therefore,
continues to require each information
security program to contain safeguards
that address these elements, with
modifications described below.
Access Controls
Proposed paragraph (c)(1) required
financial institutions to ‘‘place access
controls on information systems,
including controls to authenticate and
permit access only to authorized
individuals to protect against the
unauthorized acquisition of customer
information and to periodically review
such access controls.’’
Commenters suggested a number of
modifications to this provision. First,
GPA argued this provision should
require controls on access to
information, rather than on information
systems.135 Second, several commenters
suggested adding further safeguards to
the ‘‘access control’’ requirement. For
example, the Princeton Center argued
the Rule should adopt the ‘‘Principle of
Least Privilege,’’ a principle that no user
should have access greater than is
necessary for legitimate business
purposes.136 Reynolds and Reynolds
Company (Reynolds) suggested the Rule
clarify that financial institutions must
‘‘vet, control, and monitor user access to
sensitive information.’’ 137 Consumer
Reports argued paragraph (c)(1) should
be amended to control access not just to
authorized users, but to further limit
access to when such access is
reasonably necessary.138 ACE argued
that any requirement for physical access
control allow financial institutions to
determine which locations should have
restricted access, rather than limiting
physical access to every building and
134 Global
Privacy Alliance (comment 38, NPRM),
at 6.
135 Global Privacy Alliance (comment 38, NPRM),
at 9–10.
136 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 4–5.
137 Reynolds and Reynolds Company (comment 7,
Workshop), at 7.
138 Consumer Reports (comment 52, NPRM), at 7.
PO 00000
Frm 00015
Fmt 4701
Sfmt 4700
70285
office within, say, a college campus.139
Finally, some commenters argued the
proposed language was too vague,140
particularly as it applied to vendorsupplied services.141
In response to the comments, the
Commission makes a number of changes
to this provision in the Final Rule. First,
the Commission clarifies that the Rule
requires access controls, not just for
information systems, but for all
customer information, whether it is
housed in information systems or in
physical locations. To streamline the
Rule, the Final Rule combines the
separate physical access controls
requirement found in proposed
paragraph (c)(3) with this paragraph.
Physical access controls will generally
be most important in situations in
which sensitive customer information is
kept in physical form (such as hardcopy loan applications, or printed
consumer reports). It may also require
physical restrictions to access machines
that contain customer information (e.g.,
locked doors and/or key card access to
a computer lab).142 The Commission
declines to make any changes in
response to ACE’s concern that every
physical location will need to be
protected—as the Rule states, physical
controls must be implemented to protect
unauthorized access to customer
information. Where no customer
information exists, the Rule would not
require physical controls.
Second, the Commission agrees with
the commenters who advocated that the
Rule implement the principle of least
privilege. The Commission does not
believe it is appropriate, for example,
for larger companies to give all
139 American Council on Education (comment 24,
NPRM), at 10.
140 National Automobile Dealers Association
(comment 46, NPRM), at 23; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 5; American Council on Education
(comment 24, NPRM), at 10;
141 National Independent Automobile Dealers
Association (comment 48, NPRM), at 5; American
Council on Education (comment 24, NPRM), at 10.
142 NIADA suggested instituting physical access
controls would cost a dealership $215,000 because
each computer would need to have its own lockable
cubicle and there would need to be lockable offices
for all desks. See Remarks of Lee Waters, Safeguards
Workshop Tr., supra note 17, at 76. As originally
promulgated, the Rule already requires financial
institutions implement ‘‘physical safeguards that
are appropriate to your size and complexity.’’ 16
CFR 314.3. The Final Rule’s requirement is
consistent with that longstanding requirement. If
computers have technical safeguards preventing
unauthorized users from accessing customer
information, they usually will not need to be in a
lockable area, particularly if they are not generally
left unattended and are not likely to be stolen.
Similarly, desks would need to be in lockable
offices only if they contain accessible paper records.
A lockable file cabinet may be a more economical
solution.
E:\FR\FM\09DER3.SGM
09DER3
70286
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
employees and service providers access
to all customer information. Such
overbroad access could create additional
harm in the event of an intruder gaining
access to a system by impersonating an
employee or service provider.
Accordingly, the Commission clarifies
this in the Final Rule by adding a
requirement that not only must a
financial institution implement access
controls, but it should also restrict
access only to customer information
needed to perform a specific function.
As to the suggestion the Commission
impose monitoring requirements for
access, that requirement exists in
paragraph (c)(8). And as to the
suggestion the requirement is too vague
as to service providers, the Commission
believes the Final Rule is clear: When a
vendor accesses the financial
institution’s data or information
systems, the financial institution must
ensure appropriate access controls are
in place. Separately, under paragraph
(f), the financial institution must
reasonably oversee the vendor’s
safeguards, which would necessarily
include access controls for the vendor’s
system.
Finally, as to the suggestion the
provision is vague generally, as
discussed above, the Final Rule seeks to
preserve flexibility in its provisions,
both so that financial institutions can
design programs appropriate for their
systems and so that changes in
technology or security practices will not
render the Rule obsolete. The
Commission believes maintaining less
prescriptive requirements is the best
way to achieve the goal of flexibility and
protecting customer information.143
Accordingly, the Commission
combines paragraphs (c)(1) and (3) from
the Proposed Rule into revised
paragraph (c)(1) of the Final Rule, which
requires implementing and periodically
reviewing access controls on customer
information, including technical and, as
appropriate, physical controls to (1)
authenticate and permit access only to
authorized users to protect against the
unauthorized acquisition of customer
information and (2) limit authorized
users’ access only to customer
information that they need to perform
their duties and functions, or, in the
143 NPA expressed concern about the effect of the
Rule on pawnbrokers who the commenter stated are
required by law to allow law enforcement access to
their physical records. National Pawnbrokers
Association (comment 32, NPRM), at 7. Nothing in
the Rule conflicts with any such requirements. Law
enforcement appropriately accessing customer
information under a law that requires that access
would be considered authorized use under those
circumstances.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
case of customers, to access their own
information.144
System Inventory
In the NPRM, the Commission
proposed to require the financial
institution to ‘‘[i]dentify and manage the
data, personnel, devices, systems, and
facilities that enable [the financial
institution] to achieve business
purposes in accordance with their
relative importance to business
objectives and [the financial
institution’s] risk strategy.’’ 145 This
requirement was designed to ensure the
financial institution inventoried the
data in its possession, inventoried the
systems on which that data is collected,
stored, or transmitted, and had a full
understanding of the relevant portions
of its information systems and their
relative importance.146 The Commission
retains this provision in the Final Rule
without modification.
Commenters raised two general
objections to this provision. First, some
commenters argued it was too vague and
that it was not clear how such an
inventory should be conducted or what
systems should be included.147 The
Commission believes the language
provides effective guidance while still
allowing a variety of approaches by
financial institutions in identifying
systems involved in their businesses.
This provision requires a financial
institution to identify all ‘‘data,
personnel, devices, systems, and
facilities’’ that are a part of its business
and to determine their importance to the
financial institution. This inventory of
systems must include all systems that
are a part of the business so the
financial institution can locate all
customer information it controls, the
systems connected to that information,
and how they are connected. This
inventory forms the basis of an
information security program because a
system cannot be protected if the
financial institution does not
understand its structure or know what
data is stored in its systems.
Second, ACE suggested the scope of
this provision should be limited to
144 As noted above, the Commission is also
changing the term ‘‘authorized individuals’’ to
‘‘authorized users.’’
145 Proposed 16 CFR 314.4(c)(2).
146 See, e.g., Complaint at 11, FTC v. Wyndham
Worldwide Corp., No. CV 2:12–cv–01365–SPL (D.
Ariz. June 26, 2012) (alleging company failed to
provide reasonable security by, among other things,
failing to inventory computers connected to its
network).
147 National Automobile Dealers Association
(comment 46, NPRM), at 23–24; American Financial
Services Association (comment 41, NPRM), at 5;
American Council on Education (comment 24,
NPRM), at 10.
PO 00000
Frm 00016
Fmt 4701
Sfmt 4700
systems ‘‘directly related to the privacy
and security of ‘customer
information.’ ’’ 148 The Commission
declines to make this change because
the purpose of this provision is to allow
financial institutions to obtain a clear
picture of their systems and to identify
where customer information is kept and
how it can be accessed. An inventory
must examine all systems in order to
identify all systems that contain
customer information or are connected
to systems that do. If a financial
institution does not first examine all
systems and instead limits the inventory
to systems it considers to be directly
related to security, it could give an
incomplete picture of the financial
institution’s systems and could result in
some customer information or ways to
connect to that information being
overlooked.149
The Commission adopts paragraph
(c)(2) of the Proposed Rule as final,
without modifications.
Access to Physical Location
Proposed paragraph (c)(3) would have
required that financial institutions
restrict access to physical locations
containing customer information only to
authorized individuals. The Final Rule
combines this section with proposed
paragraph (c)(1) in order to eliminate
redundancy and clarify that access
controls must consider both electronic
and physical access.
Encryption
Proposed paragraph (c)(4) required
financial institutions to encrypt all
customer information, both in transit
over external networks and at rest. The
Proposed Rule allowed financial
institutions to use alternative means to
protect customer information, subject to
review and approval by the financial
institution’s Qualified Individual.
Several commenters supported the
inclusion of an encryption
requirement.150 In fact, some suggested
148 American Council on Education (comment 24,
NPRM), at 10.
149 Another commenter criticized proposed
paragraph (c)(2) because some financial institutions
‘‘have no control’’ over which networks they
transmit customer information. National
Pawnbrokers Association (comment 32, NPRM), at
7. Paragraph (c)(2) does not require a financial
system to identify all networks over which it may
transmit customer information. See also, infra, this
document’s discussion of NPA’s comments on
§ 314.4(f) of the Final Rule, noting financial
institutions are generally not required to oversee
other entities’ service providers over which they
have no control.
150 Inpher, Inc. (comment 50, NPRM), at 4;
Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 3;
Electronic Privacy Information Center (comment 55,
NPRM), at 8; National Consumer Law Center and
others (comment 58, NPRM), at 3.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
the Proposed Rule did not go far enough
in requiring encryption. Inpher
suggested the Rule should require
encryption of customer information
when in use, in addition to when in
transit or at rest.151 The Princeton
Center suggested requiring encryption of
data while in transit over internal
networks, in addition to requiring it for
external networks, noting the blurring of
the distinction between internal and
external networks.152
In contrast, others argued encryption
could be too expensive and technically
challenging for some financial
institutions and should not be required
in all cases.153 Indeed, GPA argued the
Rule should not require encryption at
all, financial institutions should be free
to adopt other protective measures for
customer information, and the Rule
should allow financial institutions to
‘‘determine the controls that are most
appropriate for protecting the sensitive
information that they handle.’’ 154
Similarly, some commenters argued
financial institutions should be required
to encrypt customer information only
when the risk to the customer
information justifies it.155 Others
suggested encryption in more limited
circumstances, such as on systems ‘‘to
which unauthorized individuals may
have access,’’ 156 for sensitive data,157 or
for data in transit.158 The Mortgage
Bankers Association argued encryption
at rest is unnecessary because customer
information at rest in a financial
institution’s system is sufficiently
protected by controlling access to the
151 Inpher,
Inc. (comment 50, NPRM), at 4.
University Center for Information
Technology Policy (comment 54, NPRM), at 3.
153 National Pawnbrokers Association (comment
32, NPRM), at 3; U.S. Chamber of Commerce
(comment 33, NPRM), at 11; CTIA (comment 34,
NPRM) at 10; Wisconsin Bankers Association
(comment 37, NPRM), at 2.
154 Global Privacy Alliance (comment 38, NPRM),
at 7–8.
155 Bank Policy Institute (comment 39, NPRM), at
14; Mortgage Bankers Association (comment 26,
NPRM), at 6; Global Privacy Alliance (comment 38,
NPRM), at 7–8.
156 Bank Policy Institute (comment 39, NPRM), at
14.
157 U.S. Chamber of Commerce (comment 33,
NPRM), at 11; American Financial Services
Association (comment 41, NPRM), at 5; ACA
International (comment 45, NPRM), at 13; CTIA
(comment 34, NPRM), at 10.
158 Mortgage Bankers Association (comment 26,
NPRM), at 6; Wisconsin Bankers Association
(comment 37, NPRM), at 2; American Financial
Services Association (comment 41, NPRM), at 5;
Ken Shaurette (comment 19, NPRM), (suggesting
the Commission consider whether ‘‘databases,
applications and operating systems are prepared to
fully support full encryption without significant
performance impact or ability to continue to
function.’’); National Automobile Dealers
Association (comment 46, NPRM), at 25–26
(arguing the terms ‘‘at rest’’ and ‘‘in transit’’ are
unclear).
khammond on DSKJM1Z7X2PROD with RULES3
152 Princeton
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
system.159 Two commenters stated
guidelines issued by the Federal
Financial Institutions Examination
Council (FFIEC) do not require most
banks to encrypt data at rest, unless the
institution’s risk assessment indicates
such encryption is necessary.160
The Commission declines to modify
the encryption requirement from the
Proposed Rule. As to the comments that
suggest the requirement should be
relaxed, the Commission notes there are
numerous free or low cost encryption
solutions available to financial
institutions, particularly for data in
transit,161 that make encryption a
feasible solution in most situations. For
data at rest, encryption is now cheaper,
more flexible, and easier than ever
before.162 In many cases, widely used
software and hardware have built-in
encryption capabilities.163
In response to the argument that the
Rule should not require encryption at
159 Mortgage Bankers Association (comment 26,
NPRM), at 6.
160 Wisconsin Bankers Association (comment 37,
NPRM), at 2 (discussing FFIEC Information
Technology Booklet); American Financial Services
Association (comment 41, NPRM), at 5 (discussing
FFIEC Cybersecurity Assessment Tool).
161 See Remarks of Matthew Green, Safeguards
Workshop Tr, supra note 17, at 225 (noting website
usage of encryption is above 80 percent; ‘‘Let’s
Encrypt’’ provides free TLS certificates; and costs
have gone down to the point that if a financial
institution is not using TLS encryption for data in
motion, it is making an unusual decision outside
the norm); Remarks of Rocio Baeza, Safeguards
Workshop Tr., supra note 17, at 106 (‘‘[T]he
encryption of data in transit has been standard.
There’s no pushback with that.’’); see also National
Pawnbrokers Association (comment 3, Workshop),
at 2 (‘‘[I]n states that allow us to use technology for
the receipt of information from consumer customers
and software to print our pawn tickets and store
information, we believe our members have access
through their software providers to protections that
comply with the Safeguards Rule.’’).
162 See Remarks of Wendy Nather, Safeguards
Workshop Tr., supra note 17, at 267 (‘‘we have a
lot more options, a lot more technologies today than
we did before that are making both of these
solutions, both encryption and MFA, easier to use,
more flexible, in some cases cheaper, and we
should be encouraging their adoption wherever
possible.’’); Remarks of Matthew Green, Safeguards
Workshop Tr., supra note 17, at 265–66 (‘‘I think
that we’re in a great time when we’ve reached the
point where we can actually mandate that
encryption be used. I mean, years ago—I’ve been in
this field for 15, you know, 20 years now, I guess.
And, you know, encryption used to be this exotic
thing that was very, very difficult to use, very
expensive and not really feasible for securing
information security systems. And we’ve reached
the point where now it is something that’s come to
be and we can actually build well. So I’m really
happy about that.’’).
163 See Remarks of Randy Marchany, Safeguards
Workshop Tr., supra note 17, at 229–30 (noting
encryption is already built into the Microsoft Office
environment and a number of Microsoft products,
such as Spreadsheets, Excel, Docs, and PowerPoint,
support that encryption feature). Other applications
that have encryption built in include database
applications; app platforms iOS and Android; and
development frameworks for web applications on
banking sites.
PO 00000
Frm 00017
Fmt 4701
Sfmt 4700
70287
rest because FFIEC guidelines do not
require it, the Commission notes the
Safeguards Rule is very different from
the guidelines issued by the FFIEC. The
depository financial institutions
regulated by the banking agencies are
subject to regular examinations by their
regulator. The guidelines created by the
FFIEC are designed to be used by the
examiner, as part of those examinations,
to evaluate the security of the financial
institution; the examiner thus has a
direct role in regularly verifying the
financial institution has taken
appropriate steps to protect its customer
information. In contrast, the Safeguards
Rule regulates covered financial
institutions directly and must be usable
by those entities to determine
appropriate information security
without any interaction between the
financial institution and the
Commission. The Commission does not
have the ability to examine each
financial institution and work with that
institution to ensure their information
security is appropriate. Therefore, a
requirement that institutions encrypt
information by default is appropriate for
the Safeguards Rule, as the Commission
believes encryption of customer
information at rest is appropriate in
most cases.
Finally, while some commenters
suggested eliminating the encryption
requirement for certain types of data
(e.g., non-sensitive) or certain categories
of data (e.g., data at rest), the
Commission notes, as discussed in more
detail above, the fact that an individual
is a customer of a financial institution
alone may be sensitive. In any event, the
Rule provides financial institutions with
flexibility to adopt alternatives to
encryption with the approval of the
Qualified Individual.
Similarly, the Commission declines to
extend the encryption requirement to
data in use or to data transmitted over
internal networks, as some commenters
suggested. The Commission does not
believe the technology that would
encrypt data while in use (as opposed
to in transit or at rest) has been adopted
widely enough at this time to justify
mandating its use by all financial
institutions under the FTC’s
jurisdiction. As to encryption of data
transmitted over internal networks, the
Commission acknowledges, due to
changes in network design and the
growth of cloud and mobile computing,
the distinction between internal and
external networks is less clear than it
once was. However, the Commission
believes requiring all financial
institutions to encrypt all
communications over internal networks
would be unduly burdensome at this
E:\FR\FM\09DER3.SGM
09DER3
70288
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
time. There remain significant costs and
technical hurdles to encrypting
transmissions on internal networks that
would not be reasonable to impose on
all financial institutions, especially
smaller institutions with simpler
systems that might realize less benefit
from this approach. While the
Commission encourages financial
institutions to consider whether it
would be appropriate for them to
encrypt the transmission of customer
information over internal networks, it
declines to require this for all financial
institutions.164
Commenters pointed to three
additional concerns about encryption,
none of which the Commission finds
persuasive. First, the Bank Policy
Institute commented the encryption
requirement would in fact weaken
security by blocking surveillance of the
information by the financial institution
and requiring the ‘‘broad distribution’’
of encryption keys.165 The Commission
does not believe an encryption
requirement would weaken security.
Encryption is almost universally
recommended by security experts and
included in most security standards.166
Further, new tools have been developed
to address the issue the Bank Policy
Institute has raised. Many financial
institutions have monitoring tools on
the edge of their networks to monitor
data leaving the network. It used to be
the case these network monitoring tools
could not see the content of encrypted
data as it left the corporate network and
was transmitted to the internet.
However, there are now tools available
that can see the data as it departs the
network, even if the data is
encrypted.167 Any marginal security
costs of encryption are far outweighed
by the benefits of rendering customer
information unreadable.
Second, some commenters argued
financial institutions should be able to
implement alternatives to encryption
164 The Commission believes transmissions of
customer information to remote users or to cloud
service providers should be treated as external
transmissions, as those transmissions are sent out
of the financial institution’s systems.
165 Bank Policy Institute (comment 39, NPRM), at
13–14.
166 See, e.g., Payment Card Industry (PCI) Data
Security Standard Requirements and Security
Assessment Procedures Version 3.2.1, PCI Security
Standards Council (May 2018), https://
www.pcisecuritystandards.org/document_library
(last accessed 30 Nov. 2020) (Requirement 4 encrypt
transmission of cardholder data across open, public
networks).
167 See, e.g., Encrypted Traffic Management,
Broadcom Inc., https://www.broadcom.com/
products/cyber-security/network/encrypted-trafficmanagement (last accessed 30 Nov. 2020); SSL
Visibility, F5, Inc., https://www.f5.com/solutions/
application-security/ssl-visibility (last accessed 30
Nov. 2020).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
without obtaining approval from the
Qualified Individual.168 The New York
Insurance Association expressed
concern financial institutions might feel
they need to encrypt all customer
information because of the risk that the
alternative controls approved by the
Qualified Individual would be ‘‘second
guessed’’ in the event unencrypted data
is compromised.169 The Commission,
however, believes this concern is a core
element of information security based
on risk assessment. Every aspect of an
information security program is based
on the judgment of the financial
institution and its staff. The Qualified
Individual’s decision concerning
alternate controls, like other decisions
by the financial institution and its staff,
will be subject to review in any
enforcement action to determine
whether the decision was appropriate. If
the Qualified Individual is not required
to make a formal decision, it is much
more likely a decision not to encrypt
information will be made even if there
is no compensating control, or even
made without the Qualified Individual’s
knowledge.
Third, the National Pawnbrokers
Association (‘‘NPA’’) expressed concern
that if pawnbrokers are required to
encrypt customer information they may
fall out of compliance with state and
local regulations concerning transaction
reporting.170 NPA stated pawnbrokers
are often required by state or local law
to report every pawn transaction, along
with nonpublic personally identifiable
consumer information, to law
enforcement, and the agencies that
receive this information ‘‘prefer to take
this information electronically and in
unencrypted forms.’’ 171 The
Commission believes if transmitting the
information in unencrypted form is a
preference of the agencies and not a
requirement, then pawnbrokers can
comply with both the Safeguards Rule
and these laws by encrypting any
transmissions that include customer
information. If there are cases where a
required transmission of customer
information cannot be encrypted for
technical reasons, then the
pawnbroker’s Qualified Individual will
need to work with the law enforcement
agency to implement alternative
compensating controls to ensure the
168 Bank Policy Institute (comment 39, NPRM), at
14; New York Insurance Association (comment 31,
NPRM), at 1.
169 New York Insurance Association (comment
31, NPRM) at 1.
170 National Pawnbrokers Association (comment
3, Workshop), at 2–3.
171 Id. at 2.
PO 00000
Frm 00018
Fmt 4701
Sfmt 4700
customer information remains secure
during these transmissions.172
The Final Rule adopts this paragraph
as paragraph (c)(3) without revision.
Secure Development Practices
Proposed paragraph (c)(5) required
financial institutions to ‘‘[a]dopt secure
development practices for in-house
developed applications utilized’’ for
‘‘transmitting, accessing, or storing
customer information.’’ In this
paragraph, the Commission proposed
requiring financial institutions to
address the security of software they
develop to handle customer
information, as distinct from the
security of their networks that contain
customer information.173 In addition,
the Proposed Rule required ‘‘procedures
for evaluating, assessing, or testing the
security of externally developed
applications [financial institutions]
utilize to transmit, access, or store
customer information.’’ This provision
required financial institutions to take
steps to verify that applications they use
to handle customer information are
secure.174
Some commenters argued evaluating
the security of externally developed
software would be too expensive or
impractical for some financial
institutions,175 while others raised
different concerns. The American
Council on Education suggested, in
cases in which a financial institution
cannot obtain access to a software
provider’s code or technical
172 NADA suggested it is not clear how the
encryption requirement will apply to customer
information held on a service provider’s system or
on the systems of the subcontractors of the service
provider. National Automobile Dealers Association
(comment 46, NPRM), at 21–22. The Commission
believes the Final Rule lays out a financial
institution’s obligations in this situation: It requires
customer information be encrypted unless
infeasible. Section 314.4(e), in turn, requires
financial institutions to require service providers to
implement and maintain appropriate safeguards by
contract and to periodically assess the continued
adequacy of those measures. A financial institution
that uses a service provider to store and process
customer information must require that service
provider to encrypt that information and
periodically determine whether it continues to do
so. If it is infeasible for the service provider to meet
these requirements then the financial institution’s
Qualified Individual must work with the service
provider to develop compensating controls or cease
doing business with the service provider.
173 See, e.g., Complaint, FTC v. D-Link Systems,
Inc., No. 3:17–CV–00039–JD (N.D. Cal. March 20,
2017) (alleging company failed to provide
reasonable security when it failed to adequately test
the software on its devices).
174 See, e.g., Complaint, Lenovo, FTC No. 152–
3134 (January 2, 2018) (alleging company failed to
provide reasonable security by failing to properly
assess and address security risks caused by thirdparty software).
175 American Council on Education (comment 24,
NPRM), at 11; National Automobile Dealers
Association (comment 46, NPRM), at 26–27.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
infrastructure, then evaluating the
security of its software is infeasible.176
NADA further suggested in order to
evaluate the security of software,
financial institutions would need to hire
an expensive IT professional.177
The Commission does not agree with
these assertions. Evaluating the security
of software does not require access to
the source code of that software or
access to the provider’s infrastructure.
For example, a provider can supply the
steps it took to ensure the software was
secure, whether it uses encryption to
transmit information, and the results of
any testing it conducted. In addition,
there are third party services that assess
software. An institution can also set up
automated searches regarding
vulnerabilities, patches, and updates to
software listed on the financial
institution’s inventory. The exact nature
of the evaluation required will depend
on the size of the financial institution
and the amount and sensitivity of
customer information associated with
the software. If the software will be used
to handle large amounts of extremely
sensitive information, then a more
thorough evaluation will be warranted.
Likewise, the nature of the software
used will also affect the evaluation.
Software that has been thoroughly
tested by third parties may need little
more than a review of the test results,
while software that has not been widely
used and tested will require closer
examination.
The Commission adopts proposed
paragraph (c)(5) as paragraph (c)(4) of
the Final Rule.
khammond on DSKJM1Z7X2PROD with RULES3
Multi-Factor Authentication
Proposed paragraph (c)(6) required
financial institutions to ‘‘implement
multi-factor authentication for any
individual accessing customer
information’’ or ‘‘internal networks that
contain customer information.’’ 178 The
Proposed Rule would have allowed
financial institutions to adopt a method
other than multi-factor authentication
that offers reasonably equivalent or
more secure access controls with the
written permission of its Qualified
Individual. In the Final Rule, the
Commission retains the general
requirements of proposed paragraph
(c)(6) as paragraph (c)(5), with some
modifications described below.
Although several commenters
expressed support for including a multifactor authentication requirement in the
176 American Council on Education (comment 24,
NPRM), at 11.
177 National Automobile Dealers Association
(comment 46, NPRM), at 26–27.
178 Proposed 16 CFR 314.4(c)(6).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
Final Rule,179 others opposed such a
requirement. For example, ACE argued
a blanket requirement mandating multifactor authentication for all institutions
of all sizes and complexities is not the
best solution.180 The National
Independent Automobile Dealers
Association (NIADA) commented the
costs of multi-factor authentication
would be too high for some financial
institutions because it would need to be
built into their information systems
from scratch.181 NIADA also argued
adopting multi-factor authentication
would disrupt a financial institution’s
activities as employees had to ‘‘jump
through multiple hoops to log in.’’ 182
Cisco Systems, Inc. argued that while
multi-factor authentication is an
effective safeguard, it should not be
specifically required by the Rule
because, while it is currently good
security practice, in the future multifactor authentication may become
outdated, and that allowing financial
institutions to satisfy the Rule in this
way could result in inadequate
protection.183
Other commenters did not dispute the
benefits of multi-factor authentication
generally, but argued the Rule should
limit the multi-factor authentication
requirement. Some of these commenters
stated the Rule should only require
multi-factor authentication when the
financial institution’s risk assessment
justifies it.184 Others argued there
should be a distinction between internal
access and external access. For example,
some commenters argued the Rule
should not require multi-factor
authentication when a user accesses
customer information from an internal
network,185 because there are other
179 Justine Bykowski (comment 12, NPRM);
Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 6–7;
Electronic Privacy Information Center (comment 55,
NPRM), at 8; National Consumer Law Center and
others (comment 58, NPRM), at 2; see also Remarks
of Wendy Nather, Safeguards Workshop Tr., supra
note 17, at 240–41 (discussing the security poverty
line).
180 American Council on Education (comment 24,
NPRM), at 11–12.
181 National Independent Automobile Dealers
Association (comment 48, NPRM), at 6; see also Ken
Shaurette (comment 19, NPRM) (questioning
whether multi-factor authentication is appropriate
for all financial institutions).
182 National Independent Automobile Dealers
Association (comment 48, NPRM), at 6.
183 Cisco Systems, Inc. (comment 51, NPRM), at
2–4.
184 Bank Policy Institute (comment 39, NPRM), at
11–13; Global Privacy Alliance (comment 38,
NPRM), at 8.
185 Electronic Transactions Association (comment
27, NPRM), at 3 n.1; U.S. Chamber of Commerce
(comment 33, NPRM), at 11; CTIA (comment 34,
NPRM), at 11; Global Privacy Alliance (comment
38, NPRM), at 8; Bank Policy Institute (comment 39,
NPRM), at 12; National Automobile Dealers
PO 00000
Frm 00019
Fmt 4701
Sfmt 4700
70289
controls on internal access that make
multi-factor authentication
unnecessary.186 Another commenter
stated requiring multi-factor
authentication when a customer
accesses their information from an
external network could create problems
for some institutions.187 Finally, the
Princeton Center argued the Rule should
be amended to clarify that multi-factor
authentication should be required for
internal and external networks.188
Finally, CTIA took issue with the
proposed requirement that the Qualified
Individual be permitted to approve
‘‘reasonably equivalent or more secure’’
controls if multi-factor authentication is
not feasible, suggesting instead that
Qualified Individuals be permitted to
approve ‘‘effective alternative
compensating controls.’’ 189
The Commission disagrees with the
commenters who stated the Rule should
not include a multi-factor
authentication requirement. As to costs,
many affordable multi-factor
authentication solutions are available in
the marketplace.190 Most financial
institutions will be able to find a
solution that is both affordable and
workable for their organization. In the
cases when that it is not possible, the
Association (comment 46, NPRM), at 28; National
Independent Automobile Dealers Association
(comment 48, NPRM), at 6; New York Insurance
Association (comment 31, NPRM), at 1.
186 CTIA (comment 34, NPRM), at 11; Electronic
Transactions Association (comment 27, NPRM), at
3 n.1; U.S. Chamber of Commerce (comment 33,
NPRM), at 11.
187 American Council on Education (comment 24,
NPRM), at 11.
188 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 6–7;
see also Remarks of Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 102 (stating his
company TECH LOCK supports requiring multifactor authentication for users connecting from
internal networks).
189 CTIA (comment 34, NPRM), at 11–12; see also
Electronic Transactions Association (comment 27,
NPRM) at 3 (suggesting use of the term ‘‘alternative
compensating controls’’).
190 See, e.g., Slides Accompanying Remarks of
Brian McManamon, ‘‘MFA/2FA Pricing (Duo),’’ in
Safeguards Workshop Slides, supra note 72, at 30
(setting forth prices for multi-factor/two-factor
services from Duo, including free services for up to
ten users); Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 102–03;
Slides Accompanying Remarks of Lee Waters,
‘‘Estimated Costs of Proposed Changes,’’ in
Safeguards Workshop Slides, supra note 72, at 26
estimating costs of MFA to be $50 for smartcard or
fingerprint readers, and $10 each per smartcard);
Slides Accompanying Remarks of Wendy Nather,
‘‘Authentication Methods by Industry,’’ in
Safeguards Workshop Slides, supra note 72, at 37
(chart showing the use of MFA solutions such as
Duo Push, phone call, mobile passcode, SMS
passcode, hardware token, Yubikey passcode, and
U2F token in industries such as financial services
and higher education); Remarks of Wendy Nather,
Safeguards Workshop Tr., supra note 17, at 233–34.
E:\FR\FM\09DER3.SGM
09DER3
70290
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
Rule allows financial institutions to
adopt reasonably equivalent controls.191
As to potential disruptions requiring
multi-factor authentication may cause,
the Commission notes that many
organizations, both financial institutions
and otherwise, currently require
employees to use multi-factor
authentication without major
disruption.192 Many multi-factor
authentication systems are available that
do not materially increase the time it
takes to log into a system as compared
to the use of only a password.193 In
short, multi-factor authentication is an
extremely effective way to prevent
unauthorized access to a financial
institution’s information system,194 and
its benefits generally outweigh any
increased time it takes to log into a
system. In those situations when the
need for quick access outweighs the
security benefits of multi-factor
authentication, the Rule allows the use
of reasonably equivalent controls.
Finally, although the Commission
agrees the Rule should not lock
financial institutions into using
outmoded or obsolete technologies, the
basic structure of using multiple factors
to identify a user is unlikely to be
rendered obsolete in the near future.
The Rule’s definition of multi-factor
authentication addresses only this
principle and does not require any
particular technology or technique to
achieve it. This should allow it to
accommodate most changes in
information security practices. In the
event of an unforeseen change to the
information security environment that
191 See also Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 103–04 (noting
even where legacy systems do not support multifactor authentication, alternative measures can be
used and ‘‘it’s things that can easily be done.’’)
192 See, e.g., Remarks of Randy Marchany,
Safeguards Workshop Tr., supra note 17, at 236–38
(describing how Virginia Tech implemented multifactor authentication in 2016 for its more than
156,000 users); Slides Accompanying Remarks of
Wendy Nather, ‘‘Authentication Methods by
Industry,’’ in Safeguards Workshop Slides, supra
note 72, at 37 demonstrating the types of multifactor authentication used by health care, financial
services, higher education and the Federal
Government); Remarks of Wendy Nather,
Safeguards Workshop Tr., supra note 17, at 233–35.
193 See Remarks of Wendy Nather, Safeguards
Workshop Tr., supra note 17, at 234 (describing
how a phone call to a landline is popular in some
segments).
194 See, e.g., Remarks of Matthew Green,
Safeguards Workshop Tr., supra note 17, at 266
(explaining passwords are not enough of an
authentication feature but when MFA is used and
deployed, the defenders can win against attackers);
id. at 239 (describing how because smart phones
have modern secure hardware processors, biometric
sensors and readers built in, increasingly
consumers can get the security they need through
the devices they already have by storing
cryptographic authentication keys on the devices
and then using the phone to activate them).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
would discount the value of multi-factor
authentication, the Commission will
adjust the Rule accordingly.195
The Commission agrees with the
commenter who stated multi-factor
authentication is justified both when
external users, such as customers, and
internal users, such as employees,
access an information system. Multifactor authentication can prevent many
attacks focused on using stolen
passwords from both employees and
customers to access customer
information. Other common attacks on
information systems, such as social
engineering or brute force password
attacks, target employee credentials and
use those credentials to get access to an
information system.196 These attacks
can usually be stopped through the use
of multi-factor authentication.
Accordingly, the Final Rule requires
multi-factor authentication whenever
any individual—employee, customer or
otherwise—accesses an information
system. If a financial institution
determines it is not the best solution for
its information system, it may adopt
reasonably equivalent controls with the
approval of the Qualified Individual.
The Commission recognizes the
language of the Proposed Rule may have
created some confusion by its use of the
term ‘‘internal networks’’ to define the
systems affected by the multi-factor
authentication requirement, instead of
the term ‘‘information systems’’ as used
other places in the Rule.197 In addition,
195 The Mortgage Bankers Association expressed
concern the Proposed Rule would not allow the use
of a single-sign on process, where a user is given
access to multiple applications with the use of one
set of credentials. Mortgage Bankers Association
(comment 26, NPRM), at 7. The Commission does
not view the Rule as preventing such a system, if
the user has used multi-factor authentication to
access the system and the system is designed to
ensure any user of a given application has been
subjected to multi-factor authentication.
196 See Remarks of Pablo Molina, Safeguards
Workshop Tr., supra note 17, at 30 (mentioning
‘‘phishing,’’ or social engineering, as a common
type of cybersecurity attack); Remarks of Lee
Waters, Safeguards Workshop, supra note 17, at 91
(same); Remarks of Michele Norin, Safeguards
Workshop Tr., supra note 17, at 179 (same); see also
Cyber Div., Fed. Bureau of Investigation, Private
Industry Notification No. 20200303–001, Cyber
Criminals Conduct Business Email Compromise
through Exploitation of Cloud-Based Email
Services, Costing U.S. Businesses Over Two Billion
Dollars, (March 2020), https://www.ic3.gov/media/
news/2020/200707-4.pdf, at 1–2, (last accessed 1
Dec. 2020) (‘‘Between January 2014 and October
2019, the Internet Crime Complaint Center (IC3)
received complaints totaling over $2.1 billion in
actual losses from [Business Email Compromise
(‘‘BEC’’)] scams targeting the largest [cloud-based
email] platforms. Losses from BEC scams overall
have increased every year since IC3 began tracking
the scam in 2013 and have been reported in all 50
states and in 177 countries.’’).
197 Consumer Data Industry Association
(comment 36, NPRM), at 6–7; Cisco Systems, Inc.
(comment 51, NPRM), at 3–4.
PO 00000
Frm 00020
Fmt 4701
Sfmt 4700
the Commission agrees with
commenters that argued separating the
multi-factor authentication into two
sentences created confusion.198
Accordingly, the Commission modifies
paragraph (c)(5) of the Final Rule, which
was proposed as paragraph (c)(6), to
require financial institutions to
‘‘[i]mplement multi-factor
authentication for any individual
accessing any information system,
unless your Qualified Individual has
approved in writing the use of
reasonably equivalent or more secure
access controls.’’
Finally, the Commission declines to
adopt CTIA’s proposed alternative that
would allow Qualified Individuals to
approve ‘‘effective alternative
compensating controls,’’ even if they are
not ‘‘reasonably equivalent or more
secure’’ than multi-factor
authentication. Given the important role
multi-factor authentication has in access
control, any alternative measure should
provide at least as much protection as
multi-factor authentication.199
Audit Trails
Proposed paragraph (c)(7) required
information security programs to
include audit trails designed to detect
and respond to security events.200 Audit
trails are chronological logs that show
who has accessed an information system
and what activities the user engaged in
during a given period.201
Some commenters supported this
requirement.202 The Princeton Center
noted audit trails are ‘‘crucial to
designing effective security measures
198 Bank
Policy Institute (comment 39, NPRM), at
11.
199 NADA argued, for financial institutions that
have appointed a third party to act as their
information security coordinator, this provision
would require the institution to turn over
decisionmaking to someone ‘‘with no stake in the
business outcome.’’ National Automobile Dealers
Association (comment 46, NPRM), at 29–30. This
concern misinterprets the role of the Qualified
Individual. Whether the Qualified Individual is
inside the company or at a third-party company,
that individual will report to and be supervised by
senior management of a financial institution (unless
the Qualified Individual is the head of the financial
institution). If a Qualified Individual recommends
a safeguard that would not be practical for the
business, the financial institution is not required to
adopt this safeguard but can use an alternative
adequate safeguard that will be functional. Indeed,
when it comes to third parties, the Rule specifically
requires someone in the financial institution direct
and oversee the third party.
200 Proposed 16 CFR 314.4(c)(7).
201 See Information Technology Laboratory
Computer Security Resource Center, Glossary,
National Institute of Standards and Technology,
https://csrc.nist.gov/glossary/term/audit-trail (last
accessed Dec. 2, 2020).
202 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 8;
Electronic Privacy Information Center (comment 55,
NPRM), at 8.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
that allow institutions to detect and
respond to security incidents.’’ 203 It
also stated audit trails ‘‘help understand
who has accessed the system and what
activities the user has engaged in.’’ 204
Other commenters argued this
requirement imposed unclear
obligations or would not improve
security.205 For example, GPA
commented the Proposed Rule conflated
the use of logs to reconstruct past events
and the active use of logs to monitor
user activity.206 The American Financial
Services Association argued adding
logging capabilities to some legacy
systems would be expensive and
difficult.207 Another commenter argued
the increased use of cloud storage
would mean that financial institutions
might not have access to any audit
trails.208 In addition, NADA argued it
did not believe maintenance of logs
would increase security but would
instead create records that could be
sought by parties ‘‘seeking to place
blame’’ for breaches.209
The Commission believes logging user
activity is a crucial component of
information security because in the
event of a security event it allows
financial institutions to understand
what was accessed and when. However,
the term ‘‘audit trails’’ may have been
unclear in this context. In order to
clarify that logging user activity is a part
of the user monitoring process, the Final
Rule does not include paragraph (c)(7)
of the Proposed Rule and instead
modifies the user monitoring provision
to include a requirement to log user
activity.210 By putting the ‘‘monitoring’’
and ‘‘logging’’ requirements together,
the Final Rule provides greater clarity
on the comment raised by the GPA:
Financial institutions are expected to
use logging to ‘‘monitor’’ active users
and reconstruct past events.
Disposal Procedures
Proposed paragraph (c)(8) required
financial institutions to develop
procedures for the secure disposal of
203 Princeton
khammond on DSKJM1Z7X2PROD with RULES3
University Center for Information
Technology Policy (comment 54, NPRM), at 8.
204 Id.
205 National Automobile Dealers Association
(comment 46, NPRM), at 30–31; National
Independent Automobile Dealers Association
(comment 48, NPRM), at 6; American Financial
Services Association (comment 41, NPRM), at 6;
Global Privacy Alliance (comment 38, NPRM), at
11.
206 Global Privacy Alliance (comment 38, NPRM),
at 11.
207 American Financial Services Association
(comment 41, NPRM), at 6.
208 American Council of Education (comment 24,
NPRM), at 12.
209 National Automobile Dealers Association
(comment 46, NPRM), at 30–31.
210 See Final Rule, 16 CFR 314.4(c)(8).
customer information that is no longer
necessary for their business operations
or other legitimate business purposes.211
The Proposed Rule allowed the
retention of information when retaining
the information is required by law or
where targeted disposal is not feasible.
Some commenters supported the
inclusion of a disposal requirement as
proposed or suggested that the disposal
requirements should be strengthened.212
Consumer Reports argued financial
institutions should be required to
dispose of customer information when it
is no longer needed for the business
purpose for which it was gathered.213
The Princeton Center suggested the Rule
require disposal after a set period unless
the company can demonstrate a current
need for the data and that financial
institutions periodically review their
data practices to minimize their data
retention.214
Several other commenters opposed
the disposal requirement as set forth in
the Proposed Rule. Some argued the
requirement to dispose of information
goes beyond the Commission’s authority
under the GLB Act.215 NADA argued the
GLB Act does not ‘‘contain[ ] any
authority to require financial
institutions to delete any information’’
and a requirement to have procedures to
delete information for which a company
has no legitimate business purpose
would constitute a ‘‘new privacy
regime.’’ 216 The American Financial
Services Association (AFSA) stated the
requirement was too prescriptive and
the Rule should allow financial
institutions to retain information as long
as that retention complies with the
retention policy created by the financial
institution.217 AFSA further argued the
proposed requirement exceeds the
Federal banking standards, pointing to
the FFIEC Cybersecurity Assessment
Tool, which sets disposal of records
‘‘according to documented requirements
and within expected time frames’’ as a
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
211 Proposed
16 CFR 314.4(c)(8).
University Center for Information
Technology Policy (comment 54, NPRM), at 8;
Electronic Privacy Information Center (comment 55,
NPRM), at 8; Consumer Reports (comment 52,
NPRM), at 7.
213 Consumer Reports (comment 52, NPRM), at 7–
8.
214 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 8–9.
215 National Automobile Dealers Association
(comment 46, NPRM), at 31; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 6.
216 National Automobile Dealers Association
(comment 46, NPRM), at 31–32.
217 American Financial Service Association
(comment 41, NPRM), at 6.
212 Princeton
PO 00000
Frm 00021
Fmt 4701
Sfmt 4700
70291
baseline requirement for access and data
management.218
Yet other commenters suggested
modifying the requirement. NADA
argued that if there was to be a disposal
requirement, then it should be modeled
after the Disposal Rule, which requires
businesses to properly dispose of
consumer reports, but does not have an
explicit requirement to dispose of
information on any particular
schedule.219 ACE suggested modifying
the Proposed Rule to require disposal of
information only where there is no
longer any ‘‘legitimate purpose’’ rather
than any ‘‘legitimate business
purpose.’’ 220 It argued in some cases a
financial institution may have legitimate
purposes for retaining information that
are not readily defined as ‘‘business’’
purposes, such as the retention of data
by educational institutions for
institutional research or student
analytics.221
The Commission believes requiring
the disposal of customer information for
which the financial information has no
legitimate business purpose is within
the authority granted by the GLB Act to
protect the security of customer
information. The disposal of records,
both physical and digital, can result in
exposure of customer information if not
performed properly.222 Similarly, if
records are retained when they are no
longer necessary, there is a risk those
records will be subject to unauthorized
access. The risk of unauthorized access
may be reasonable where the retention
of data provides some benefit. In
situations where the information is no
longer needed for a legitimate business
purpose, though, the risk to the
customer information becomes
unreasonable because the retention is no
longer benefiting the customer or
financial institution. Disposing of
unneeded customer information,
therefore, is a vital part of protecting
customer information and serves the
purpose of the GLB Act.223
218 Cybersecurity Assessment Tool, FFIEC,
https://www.ffiec.gov/pdf/cybersecurity/FFIEC_
CAT_May_2017_Cybersecurity_Maturity_June2.pdf
at 37 (last visited December 3, 2020).
219 National Automobile Dealers Association
(comment 46, NPRM), at 32.
220 American Council on Education (comment 24,
NPRM), at 12.
221 Id.
222 See, e.g., Complaint, Rite Aid Corp., FTC No.
072–3121 (November 22, 2010) (alleging company
failed to provide reasonable data security when it
failed to implement policies and procedures to
dispose securely of personal information).
223 As to the Princeton Center’s suggestion
financial institutions periodically review their
disposal practices (Princeton University Center for
Information Technology Policy (comment 54,
NPRM), at 8–9), the Commission believes this
E:\FR\FM\09DER3.SGM
Continued
09DER3
70292
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
The Commission disagrees with
commenters who suggested narrowing
the disposal requirement or doing away
with it altogether. As noted above,
although no disposal requirement
appears in FFIEC guidelines, those
guidelines represent a different
regulatory approach and are not an
appropriate model for the Safeguards
Rule.
Finally, as to setting retention periods
or narrowing the legitimate business
purposes for which financial
institutions may retain customer
information, the Commission recognizes
financial institutions need some
flexibility. Whereas customers may
want to, for example, access and transfer
older data in some circumstances, in
other circumstances, retaining such data
would not be consistent with any
legitimate business purpose. The
Commission believes the Princeton
Center’s recommendation that
companies be required to delete
information after a set period unless the
information is still needed for a
legitimate business purpose properly
balances the needs of financial
institutions with the need to protect
customer information. Thus, the
Commission modifies proposed
paragraph (c)(6) to require the deletion
of customer information two years after
the last time the information is used in
connection with providing a product or
service to the customer unless the
information is required for a legitimate
business purpose as paragraph (c)(6)(i)
of the Final Rule. In addition, paragraph
(c)(6)(ii) of the Final Rule requires
financial institutions to periodically
review their policies to minimize the
unnecessary retention of information.
Change Management
Proposed paragraph (c)(9) required
financial institutions to adopt
procedures for change management.224
Change management procedures govern
the addition, removal, or modification
of elements of an information system.225
This paragraph required financial
institutions to develop procedures to
assess the security of devices, networks,
and other items to be added to their
information system, or the effect of
removing such items or otherwise
modifying the information system. For
example, a financial institution that
adds additional servers or other
requirement is already encompassed in the
requirement contained in § 314.4(g) to periodically
review their safeguards overall.
224 Proposed 16 CFR 314.4(c)(9).
225 See, e.g., Change Management, Rutgers OIT
Information Security Office, https://rusecure.
rutgers.edu/content/change-management (last
accessed 1 Dec. 2020).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
machines to its information system
would need to evaluate the security of
the new devices and the effect of adding
them to the existing network.
Some commenters supported this
requirement,226 while others stated it
was too broad and would impose
unnecessary burdens on financial
institutions.227 In particular, NADA
argued financial institutions that have
not made changes in their systems ‘‘for
some time’’ should not be required to
create procedures for change
management.228 ACE argued including a
change management requirement is
unnecessary because such a requirement
is ‘‘generally incorporated into an
organization’s IT operations’’ for nonsecurity purposes and the security
considerations of those changes will be
considered as part of those
procedures.229
Alterations to an information system
or network introduce heightened risk of
cybersecurity incidents; 230 thus, it is
important to expressly require change
management to be a part of an
information security program. The
Commission agrees with ACE that many
financial institutions will already have
change management procedures in
place. If those procedures adequately
consider security issues involved in the
change, then they may satisfy this
requirement.
As to the comment a financial
institution that has not made changes to
its environment in some time should
not be required to have change
management processes, the Commission
disagrees. Few information systems can
remain unchanged for a significant
period of time, given the changing
technical requirements for business and
security. Indeed, NADA acknowledges
financial institutions will need to
‘‘adapt[] their programs to keep up with
changes in data security.’’ 231 For this
226 Electronic Privacy Information Center
(comment 55, NPRM), at 8; National Consumer Law
Center and others, (comment 58, NPRM) at 3.
227 American Council on Education (comment 24,
NPRM), at 12–13; National Automobile Dealers
Association (comment 46, NPRM), at 33.
228 National Automobile Dealers Association
(comment 46, NPRM), at 32–33.
229 American Council on Education (comment 24,
NPRM), at 12.
230 See Remarks of Rocio Baeza, Safeguards
Workshop Tr., supra note 17, at 95 (‘‘[E]very time
there is a change to any of these [network]
environments, that is creating additional risk.’’);
Remarks of Scott Wallace, Safeguards Workshop
Tr., supra note 17, at 147–48 (giving an example of
an incident in which network changes led to the
exposure of sensitive information); Remarks of
Matthew Green, Safeguards Workshop Tr., supra
note 17, at 252 (noting it is ‘‘a little dangerous’’ to
make ‘‘major changes’’ to an information system at
a time of heightened stress).
231 National Automobile Dealers Association
(comment 46, NPRM), at 33 n.96.
PO 00000
Frm 00022
Fmt 4701
Sfmt 4700
reason, all financial institutions must
have procedures for when the changes
occur. As with all of the requirements
of the Rule, though, the exact nature of
these procedures will vary depending
on the size, complexity and nature of
the information system. A simple
system may have equally simple change
management procedures.
The Commission adopts this proposed
paragraph as paragraph (c)(7) of the
Final Rule without change.
System Monitoring
Proposed paragraph (c)(10) required
financial institutions to implement
policies and procedures designed ‘‘to
monitor the activity of authorized users
and detect unauthorized access or use
of, or tampering with, customer
information by such users.’’ 232 The
Proposed Rule required financial
institutions to take steps to monitor
those users and their activities related to
customer information in a manner
adapted to the financial institution’s
particular operations and needs.
NADA stated this requirement would
create unnecessary expense because it
would require financial institutions to
‘‘continually monitor all authorized
use’’ and would mean ‘‘yet more new
employees or third-party IT
consultants.’’ 233 The Commission
disagrees, however, noting that
monitoring of system use can be
automated.234 There is no requirement a
separate staff member would be
required to exclusively monitor system
use.
In addition, one commenter stated
monitoring the use of paper files is
impossible and should be excluded
from this provision.235 The Commission
acknowledges monitoring of paper
records is qualitatively different than
the monitoring of electronic records.
This requirement goes hand in hand
with limiting access to documents,
whether electronic or paper. For
example, if an institution has a file room
and access to the room is limited to
particular employees (e.g., the payroll
office), the institution should have
measures in place to ensure those access
controls are in fact being utilized (e.g.,
sign in with front desk, logging of key
card access, security camera).
As discussed above, this paragraph is
amended to also require the logging of
user activity, but is otherwise adopted
as proposed as paragraph (c)(8).
232 Proposed
16 CFR 314.4(c)(10).
Automobile Dealer Association
(comment 46, NPRM), at 33.
234 See Remarks of Nicholas Weaver, Safeguards
Workshop Tr., supra note 17, at 124–25.
235 American Financial Services Association
(comment 41, NPRM), at 6.
233 National
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
Proposed Paragraph (d)
Proposed paragraph (d)(1) retained
the current Rule’s requirement that
financial institutions ‘‘[r]egularly test or
otherwise monitor the effectiveness of
the safeguards’ key controls, systems,
and procedures, including those to
detect actual and attempted attacks on,
or intrusions into, information
systems.’’
Proposed paragraph (d)(2) provided
further detail to this requirement by
stating the monitoring must take the
form of either ‘‘continuous monitoring’’
or ‘‘periodic penetration testing and
vulnerability assessments.’’ The
proposal explained continuous
monitoring is any system that allows
real-time, ongoing monitoring of an
information system’s security, including
monitoring for security threats,
misconfigured systems, and other
vulnerabilities.236 For those who elected
to engage in periodic penetration testing
and vulnerability assessment, the
proposal required penetration testing at
least once annually (or more frequently
if called for in the financial institution’s
risk assessment) and vulnerability
assessments at least twice a year.237
Some commenters thought the
proposal went too far in requiring
continuous monitoring or penetration
and vulnerability testing, while others
thought the proposal did not go far
enough. On one hand, ACE argued
continuous monitoring is too
burdensome and difficult for some
financial institutions,238 particularly
those with ‘‘highly decentralized
systems,’’ such as colleges and
universities, which could be required to
monitor their entire system.239 ACE
further suggested the Rule should not
prescribe any particular testing
methodology or schedule and should
allow financial institutions to develop a
testing approach appropriate for the
financial institution.240 The NPA
commented penetration and
vulnerability testing would be too
expensive for small pawnbrokers with
small staffs and a small customer base,
where their members would be ‘‘likely
to notice a penetration of our
records.’’ 241 One commenter stated the
requirements for monitoring and testing
236 Financial institutions that choose the option of
continuous monitoring would also be satisfying
§ 314.4(c)(8).
237 Proposed 16 CFR 314.4(d)(1) and (2).
238 American Council on Education (comment 24,
NPRM), at 13–14.
239 American Council on Education (comment 24,
NPRM), at 13.
240 American Council on Education (comment 24,
NPRM), at 14.
241 National Pawnbrokers Association (comment
3, Workshop), at 2.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
were ‘‘overlapping and confusing’’ and
suggested the Commission avoid
confusion by including continuous
monitoring, penetration testing,
vulnerability scanning, periodic risk
assessment reviews, and logging as
optional components of an information
security program to be included on an
as-needed basis.242 Some commenters
recommended the testing requirement
be limited to electronic data and
exclude monitoring of physical data.243
The American Financial Services
Association argued the testing of
physical safeguards required by
paragraph (d)(1) ‘‘would be
impossible.’’ 244 Finally, CTIA argued,
for entities that choose the approach of
penetration and vulnerability testing,
these tests should be required less
regularly.245
On the other hand, the Princeton
Center suggested, rather than requiring
either continuous monitoring or
penetration testing, the Rule should
require both. It noted continuous
monitoring is very effective at detecting
problems with, and threats to, ‘‘off-theshelf systems’’ but penetration testing is
better at ‘‘for checking the interaction
between systems, proprietary systems,
or subtle security issues.’’ 246 Similarly,
the MSRT was concerned that the
Proposed Rule suggested annual
penetration testing alone could protect
financial institutions, rather than serve
as a supplement to proper
monitoring.247
The Commission agrees with
commenters who pointed out the
difficulty of applying certain testing
requirements to physical safeguards.
Although the general testing
requirement set forth in paragraph (d)(1)
should apply to physical safeguards
(e.g., testing effectiveness of physical
locks), the continuous monitoring,
vulnerability assessment, and
penetration testing in paragraph (d)(2) is
not relevant to information in physical
242 Global Privacy Alliance (comment 38, NPRM),
at 10–11.
243 National Independent Automobile Dealers
Association (comment 48, NPRM), at 6; American
Financial Services Association (comment 41,
NPRM), at 6.
244 American Financial Services Association
(comment 41, NPRM), at 6.
245 CTIA (comment 34, NPRM) at 12–13 (arguing
penetration testing should be required only once
every two years and vulnerability testing be
required only once a year).
246 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 5.
247 Money Services Round Table (comment 53,
NPRM), at 9; see also Gusto and others (Comment
11, Workshop), at 2 (arguing penetration testing and
vulnerability assessments both have their
weaknesses and financial institutions should
develop a testing program that it is appropriate for
them).
PO 00000
Frm 00023
Fmt 4701
Sfmt 4700
70293
form. Accordingly, the final version of
paragraph (d)(2) is limited to safeguards
on information systems.
The Commission also agrees biannual
vulnerability testing may not be
sufficient to detect new threats. Thus,
given the relative ease with which
vulnerability assessments can be
performed, it modifies the Final Rule to
require financial institutions to perform
assessments when there is an elevated
risk of new vulnerabilities having been
introduced into their information
systems, in addition to the required
biannual assessments.
Beyond these modifications, the
Commission believes the proposal
struck the right balance between
flexibility and protection of customer
information, and adopts the proposed
provision as final. For commenters
concerned about costs of testing and
continuous monitoring, the Commission
notes the Rule requires one, not both.
Although many financial institutions
may choose to use both, the
Commission agrees the costs of
requiring both for all financial
institutions may not be justified. 248 As
to arguments that the testing required by
the Rule is too frequent and will
therefore be too costly, the Commission
does not agree vulnerability assessments
will be costly. Indeed, there are
resources for free and automated
vulnerability assessments.249 And
although the Commission acknowledges
penetration testing can be a somewhat
lengthy and costly process for large or
complex systems,250 a longer period
between penetration tests will leave
information systems vulnerable to
attacks that exploit weaknesses
normally revealed by penetration
testing.
Two other portions of the Final Rule
should help financial institutions
concerned about the costs of monitoring
and testing. First, because the
Commission is limiting the definition of
‘‘information system’’ in the Final Rule,
financial institutions will be able to
limit this provision’s application by
segmenting their network and
conducting monitoring or testing only of
systems that contain customer
information or that are connected to
such systems. Second, this requirement
does not apply to those institutions that
248 The Commission believes a system for
continuous monitoring will include some form of
vulnerability assessment as part of monitoring the
information system.
249 Remarks of Frederick Lee, Safeguards
Workshop Tr., supra note 17, at 139–40.
250 See id. at 129–30 (noting the cost of a
penetration test can increase significantly
depending on the complexity of the system to be
tested and the scope of the test).
E:\FR\FM\09DER3.SGM
09DER3
70294
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
maintain records on fewer than 5,000
individuals. Accordingly, for example,
it should not apply to businesses small
enough for staff to personally know a
majority of customers.
Finally, the Commission does not
believe the testing requirements are
duplicative of other provisions of the
Final Rule. The provision relating to
additional risk assessments,
§ 314.4(b)(2), requires a financial
institution to reevaluate its risks and to
determine if safeguards should be
modified or added—it does not require
testing to detect threats and technical
vulnerabilities in the existing system.
Section 313.4(c)(8)’s requirement that
financial institutions monitor users’
activity in an information system is
focused on one aspect of information
security—detecting and preventing
unauthorized access and use of the
system. The requirement of this
paragraph, on the other hand, is focused
on testing the overall effectiveness of a
financial institution’s safeguards. It is
broader than paragraph (c)(8)’s
requirement and is necessary to ensure
financial institutions test the strength of
their safeguards as a whole.
Accordingly, the Final Rule requires
financial institutions to perform
vulnerability assessments at least once
every six months and, additionally,
whenever there are material changes to
their operations or business
arrangements and whenever there are
circumstances they know or have reason
to know may have a material impact on
their information security program.
Proposed Paragraph (e)
Proposed paragraph (e) set forth a
requirement that financial institutions
implement policies and procedures ‘‘to
ensure that personnel are able to enact
[the financial institution’s] information
security program.’’ This requirement
included four components: (1) General
employee training; (2) use of qualified
information security personnel; (3)
specific training for information security
personnel; and (4) verification that
security personnel are taking steps to
maintain current knowledge on security
issues.
khammond on DSKJM1Z7X2PROD with RULES3
General Employee Training
Proposed paragraph (e)(1) required
financial institutions to provide their
personnel with ‘‘security awareness
training that is updated to reflect risks
identified by the risk assessment.’’ 251
While one commenter specifically
supported the inclusion of this training
251 Proposed
VerDate Sep<11>2014
16 CFR 314.4(e)(1).
18:18 Dec 08, 2021
Jkt 256001
requirement,252 the U.S. Chamber of
Commerce argued the Rule should not
have any specific training requirements
at all.253 NADA stated the requirement
that the training be ‘‘updated to reflect
risks identified by the risk assessment’’
will require companies to develop
individualized training programs to suit
their financial institution and that such
a process would be expensive and
unnecessary because ‘‘general security
awareness’’ is generally enough for most
financial institutions.254
Given the current Rule includes a
similar training requirement and
training remains a vital part of effective
information security, the Commission
declines to eliminate it. The
Commission believes the Final Rule’s
training requirement retains the same
flexibility as the existing Rule and
allows financial institutions to adopt a
training program appropriate to their
organization.
The Commission disagrees with
NADA’s concern the requirement to
update training programs would be too
expensive. Without a requirement that
the training program be updated based
on an assessment of risks, employees
may be subject to the same training year
after year, which might reflect obsolete
threats, as opposed to addressing
current ones. The Commission
interprets this provision to require only
that the training program be updated as
necessary based on changes in the
financial institution’s risk assessment.
The provision also gives financial
institutions the flexibility to use
programs provided by a third party, if
that program is appropriate for the
financial institution. In order to clarify
updates are required only when needed
by changes in the financial institution or
new security threats, though, the Final
Rule states training programs need to be
updated only ‘‘as necessary.’’
Information Security Personnel
Proposed paragraph (e)(2) required
financial institutions to ‘‘[u]tiliz[e]
qualified information security
personnel,’’ employed either by them or
by affiliates or service providers,
‘‘sufficient to manage [their] information
security risks and to perform or oversee
the information security program.’’ 255
This proposed provision was designed
252 Electronic Privacy Information Center
(comment 55, NPRM), at 8.
253 U.S. Chamber of Commerce (comment 33,
NPRM), at 12; see also American Financial Services
Association (comment 41, NPRM), at 6 (stating the
Commission should acknowledge that a training
program for a small financial institution will be
different than a program for a larger program).
254 National Automobile Dealers Association
(comment 46, NPRM), at 34.
255 Proposed 16 CFR 314.4(e)(2).
PO 00000
Frm 00024
Fmt 4701
Sfmt 4700
to ensure information security
personnel used by financial institutions
are qualified for their positions and
information security programs are
sufficiently staffed.
Some commenters argued this
provision was too vague because it does
not define what personnel are necessary
and what ‘‘qualified’’ means.256 NADA
argued hiring additional staff to meet
this requirement could be prohibitively
expensive.257
As discussed in relation to the
appointment of a ‘‘Qualified
Individual,’’ the Commission believes a
more specific definition of ‘‘qualified’’
would not be appropriate because each
financial institution has different needs
and different levels of training,
experience, and expertise will be
appropriate for the information security
staff of each institution. The term
‘‘qualified’’ conveys only that staff must
have the abilities and expertise to
perform the duties required by the
information security program.258 The
Commission declines to include a more
prescriptive set of qualification
requirements in the Final Rule.259
As to the concern about expense, the
Commission acknowledges hiring
employees or retaining third parties to
maintain financial institutions’
information security programs can be a
substantial expense. But the expense is
necessary to effectuate Congressional
intent that financial institutions
implement reasonable safeguards to
protect customer information. The Rule
requires only that a financial institution
have personnel ‘‘sufficient’’ to manage
its risk and to maintain its information
security program. A financial institution
is required only to have the staff
necessary to maintain its information
security. An information security
program that is not properly maintained
cannot offer the protection it is designed
to provide. A financial institution that
256 National Automobile Dealers Association
(comment 46, NPRM), at 35; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 7.
257 National Automobile Dealers Association
(comment 46, NPRM), at 35.
258 NADA also asks whether this provision would
require financial institutions to hire more personnel
if they do not have enough qualified staff. Id. The
Final Rule does require the hiring of additional
personnel if existing personnel are not enough to
maintain the financial institution’s information
security program.
259 One commenter, on the other hand, approved
of the decision not to define ‘‘qualified’’ in the
Proposed Rule, but argued the requirement in its
totality was unclear because it did not set forth
‘‘how the Commission would hold covered entities
accountable.’’ American Council on Education
(comment 24, NPRM) at 14. The Commission
believes the term ‘‘qualified’’ provides a clear
enough requirement to allow a financial
institution’s compliance to be evaluated.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
does not comply with this requirement,
by definition, has insufficient staffing,
and thus, cannot reasonably protect
customer information.
Although the expense is necessary,
the level of expense is mitigated by
several factors. First, existing financial
institutions should already have
information security personnel (either
in the form of employees or third-party
service providers) qualified to perform
the duties necessary to maintain
reasonable security in order to comply
with the requirements of the current
Rule. Depending on the skills of those
employees, additional staffing may not
be necessary to meet the demands of the
Final Rule. Second, the required staffing
will vary greatly based on the size and
complexity of the information system. A
financial institution with an extremely
simple system may not require even a
single full time employee. Finally, the
Rule allows the use of service providers
to meet this requirement. This can
significantly reduce costs as services
exist to share the expense of qualified
personnel and offer information security
support at significantly less than the
cost of employing a single qualified
employee.260 The Commission
continues to believe utilizing qualified
and sufficient information security
personnel is a vital part of any
information security program and
accordingly, adopts proposed paragraph
(e)(2) in the Final Rule without
modification.
khammond on DSKJM1Z7X2PROD with RULES3
Training of Security Personnel
The Proposed Rule also required
financial institutions to ‘‘[p]rovid[e]
information security personnel with
security updates and training sufficient
to address relevant security risks.’’ 261
This is separate from paragraph (e)(1)’s
requirement to train all personnel
generally.
Some commenters argued providing
ongoing training could be too costly for
some financial institutions.262 The
Commission disagrees. Maintaining
awareness of emerging threats and
260 See, e.g., Slides Accompanying Remarks of
Rocio Baeza, ‘‘Models for Complying to the
Safeguards Rule Changes,’’ in Safeguards Workshop
Slides, supra note 72, at 27–28 (describing three
different compliance models: In-house, outsource,
and hybrid, with costs ranging from $199 per month
to more than $15,000 per month); see also remarks
of Rocio Baeza, Safeguards Workshop Tr., supra
note 17, at 81–83; slides Accompanying Remarks of
Brian McManamon, ‘‘Sample Pricing,’’ in
Safeguards Workshop Slides, supra note 72, at 29
(estimating the cost of cybersecurity services based
on number of endpoints); Remarks of Brian
McManamon, Safeguards Workshop Tr., supra note
17, at 83–85.
261 Proposed 16 CFR 314.4(e)(3).
262 National Automobile Dealers Association
(comment 46, NPRM), at 35.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
vulnerabilities is a critical aspect of
information security. In order to
perform their duties, security personnel
must be educated on the changing
nature of threats to the information
systems they maintain. There are
resources that will allow smaller
institutions to meet this requirement at
little or no cost, such as published
security updates, online courses, and
educational publications.263 For
financial institutions that utilize service
providers to meet information security
needs, the service provider is likely to
include assurances that provided
personnel will be trained in current
security practices. The Commission
views the use of such a service provider
as meeting this requirement, as the
financial institution is ‘‘providing’’ the
service as part of the price it pays to the
service provider. Thus, the Final Rule
adopts paragraph (e)(3) as proposed.264
Verification of Current Knowledge
Proposed paragraph (e)(4) required
financial institutions to ‘‘[v]erify[ ] that
key information security personnel take
steps to maintain current knowledge of
changing information security threats
and countermeasures.’’ 265 This
requirement was intended to
complement the proposed requirement
regarding ongoing training of data
security personnel, by requiring
verification such training has taken
place.
NADA argued this requirement
should not apply to smaller financial
institutions, stating the examples set
forth in the Proposed Rule would be
difficult for some smaller financial
institutions to perform.266 The examples
provided with the Proposed Rule were
that a financial institution could: (1)
Offer incentives or funds for key
personnel to undertake continuing
education that addresses recent
developments, (2) include a requirement
to stay abreast of security research as
part of their performance metrics, or (3)
conduct an annual assessment of key
personnel’s knowledge of threats related
to their information system. The
Commission believes smaller financial
institutions can take advantage of any of
these methods, particularly ‘‘requiring
263 See, e.g., Federal Trade Commission,
Cybersecurity for Small Business, https://
www.ftc.gov/tips-advice/business-center/smallbusinesses/cybersecurity (last accessed 1 Dec.
2020); Remarks of Kiersten Todt, Safeguards
Workshop Tr. at 86–88 (describing the resources of
the Cyber Readiness Institute).
264 The Clearing House suggested the Rule should
require background checks on employees. The
Clearing House (Comment 49, NPRM) at 19.
265 Proposed 16 CFR 314.4(e)(4).
266 National Automobile Dealers Association
(comment 46, NPRM), at 35–36.
PO 00000
Frm 00025
Fmt 4701
Sfmt 4700
70295
key personnel to undertake continuing
education’’ as part of that personnel’s
duties. If they outsource responsibility
for data security to service providers,
they can simply include these
requirements in their contracts.
The Commission believes the rapidly
changing nature of information security
mandates this requirement, in order that
information security leadership can
properly supervise the information
security program. Accordingly, the Final
Rule adopts proposed paragraph (e)(4)
without change.
Proposed Paragraph (f)
Proposed paragraphs (f)(1) and (2)
retained the current Rule’s requirement,
found in existing paragraphs (d)(1) and
(2), to oversee service providers, and
added a paragraph (f)(3), requiring
financial institutions also periodically
assess service providers ‘‘based on the
risk they present and the continued
adequacy of their safeguards.’’ 267 The
current Rule expressly requires an
assessment of service providers’
safeguards only at the onboarding stage;
proposed paragraph (f)(3) required
financial institutions to monitor their
service providers on an ongoing basis to
ensure they are maintaining adequate
safeguards to protect customer
information they possess or access.268
Several commenters argued it would
be costly and difficult for some financial
institutions to periodically assess their
service providers.269 These commenters
were particularly concerned with
smaller financial institutions’ ability to
‘‘monitor’’ larger service providers.270
The Internet Association commented
the requirement to periodically assess
service providers would be too onerous
for the service providers themselves,
arguing the requirement would place
‘‘service providers under constant
surveillance by their financial
institution clients.’’ 271 HITRUST
suggested the Rule should state the
periodic assessment requirement may be
satisfied by requiring service providers
to obtain and maintain information
267 Proposed
16 CFR 314.4(g).
Clearing House wrote in support of this
element of the Proposed Rule, noting it would bring
the Safeguards Rule’s provisions relating to service
provider oversight into better alignment with
security guidelines for banks. The Clearing House
(comment 49, NPRM), at 14.
269 National Automobile Dealers Association
(comment 46, NPRM), at 37; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 7; see also Wangyang Shen (comment 3,
Privacy Rule) (noting difficulty of supervising cloud
services).
270 National Automobile Dealers Association
(comment 46, NPRM), at 22; National Association
of Dealer Counsel (comment 44, NPRM), at 3.
271 Internet Association (comment 9, Workshop),
at 3–4.
268 The
E:\FR\FM\09DER3.SGM
09DER3
70296
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
security certifications provided by third
parties and based on proper information
security frameworks.272 In contrast,
Consumer Reports took issue with the
Rule requiring only ‘‘assessment’’ of
service providers, and argued financial
institutions should be required to
monitor their service providers for
compliance.273 Yet other commenters
expressed confusion over the term
‘‘service provider,’’ asking whether it
would cover national consumer
reporting agencies that smaller financial
institutions would be hard-pressed to
assess.274
The Commission retains the service
provider oversight requirement from
proposed paragraph (f) without
modification. Some high profile
breaches have been caused by service
providers’ security failures,275 and the
Commission views the regular
assessment of the security risks of
service providers as an important part of
maintaining the strength of a financial
institution’s safeguards.
The Commission disagrees with the
commenters who expressed concerns
this provision, and particularly the
assessment requirement, would impose
undue costs on financial institutions.
The Rule would require financial
institutions only to assess the risks
service providers present and evaluate
whether they continue to provide the
safeguards required by contract, which
need not include extensive investigation
of a service provider’s systems. In the
case of large service providers, this
oversight may consist of reviewing
public reports of insecure practices,
changes in the services provided, or
security failures in the services
provided. In other circumstances, such
as where a large company hires a vendor
to secure sensitive customer
information, certifications, reports, or
even third-party audits may be
appropriate. The exact steps required
depend both on the size and complexity
of the financial institution and the
nature of the services provided by the
service provider. For this reason, the
Commission declines to adopt the
272 HITRUST
(comment 18, NPRM), at 3–4.
Reports (comment 52, NPRM) at 7.
274 American Financial Services Association
(comment 41, NPRM), at 7.
275 For example, in 2013, attackers were
reportedly able to use stolen credentials obtained
from a third-party service provider to access a
customer service database maintained by national
retailer Target Corporation, resulting in the theft of
information relating to 41 million customer
payment card accounts. Kevin McCoy, Target to pay
$18.5M for 2013 data breach that affected 41
million consumers, USA Today, May 23, 2017,
https://www.usatoday.com/story/money/2017/05/
23/target-pay-185m-2013-data-breach-affectedconsumers/102063932/.
khammond on DSKJM1Z7X2PROD with RULES3
273 Consumer
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
suggestion to allow a financial
institution to accept an information
security certification from the service
provider to satisfy the service provider
oversight requirement. The fact that a
company maintains an information
security certification may be a
significant part of assessing the
adequacy of a service provider’s
safeguards, but the Commission
declines to prescribe a one-size-fits all
approach, given the variation in size
and complexity of financial institutions
and their service providers.
To avoid imposing undue costs on
financial institutions, the Commission
declines to require ongoing monitoring,
rather than periodic assessment, as
recommended by Consumer Reports.
The Commission believes periodic
assessment strikes the right balance
between protecting consumers and
imposing undue costs on financial
institutions. The Commission
acknowledges financial institutions may
have limited bargaining power in
obtaining services from large service
providers and limited ability to demand
access to a service provider’s systems. In
those cases, any sort of hands-on
assessment of the provider’s systems
may not be possible.
As to the concern the assessment
requirement will impose undue burdens
on the service providers themselves, the
Commission does not believe this
concern justifies a modification to the
proposed requirement. First, the Rule
does not require ‘‘constant surveillance’’
by financial institutions—they are
required only to ‘‘periodically assess’’
the risks presented by service providers.
Second, as discussed above, the
supervision of service providers is a
vitally important aspect of information
security, and while there may be some
burdens on the service providers
associated with being supervised, these
are necessary burdens. A financial
institution must be sure a service
provider is protecting the information of
its customers, and any expenses this
involves are a necessary part of fulfilling
this duty.
Finally, as to concerns about potential
ambiguities in the definition of service
provider, the amendments preserve the
definition in the current Rule. Thus,
entities subject to this requirement
under the Final Rule will remain the
same as under the existing Rule and
may include consumer reporting
agencies. As discussed above, even
larger service providers such as national
CRAs can be subjected to some form of
review by financial institutions.276
276 The National Pawnbrokers Association
expressed concern they cannot control vendors of
PO 00000
Frm 00026
Fmt 4701
Sfmt 4700
The Commission adopts proposed
paragraph (f) in the Final Rule without
modification.
Proposed Paragraph (g)
Paragraph (g) of the Proposed Rule
retained the language of existing
paragraph (e) in the current Rule, which
requires financial institutions to
evaluate and adjust their information
security programs in light of the result
of testing required by this section,
material changes to their operations or
business arrangements, or any other
circumstances they know or have reason
to know may have a material impact on
their information security program. The
Commission received no comments on
this paragraph and adopts the language
of the Proposed Rule.
Proposed Paragraph (h)
Proposed paragraph (h) required
financial institutions to establish
written incident response plans that
addressed (1) the goals of the plan; (2)
the internal processes for responding to
a security event; (3) the definition of
clear roles, responsibilities and levels of
decision-making authority; (4) external
and internal communications and
information sharing; (5) identification of
requirements for the remediation of any
identified weaknesses in information
systems and associated controls; (6)
documentation and reporting regarding
security events and related incident
response activities; and (7) the
evaluation and revision as necessary of
the incident response plan following a
security event.
Several commenters supported the
proposal to require an incident response
plan.277 The Credit Union National
Association observed an incident
response plan ‘‘helps ensure that an
entity is prepared in case of an incident
by planning how it will respond and
what is required for the response.’’ 278
Consumer Reports noted a rapid
response to a security event can limit
damage caused by the event.279 The
local law enforcement agencies to whom they are
required to provide customer information. National
Pawnbrokers Association (comment 32, NPRM), at
2. However, the Rule does not require financial
institutions oversee service providers employed by
other entities over which they have no control.
277 Consumer Reports (comment 52, NPRM), at 6;
Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 7;
Electronic Privacy Information Center (comment 55,
NPRM), at 8; Credit Union National Association
(comment 30, NPRM), at 2; Heartland Credit Union
Association (comment 42, NPRM), at 2; National
Association of Federally-Insured Credit Unions
(comment 43, NPRM), at 1; HITRUST (comment 18,
NPRM), at 2.
278 Credit Union National Association (comment
30, NPRM), at 2.
279 Consumer Reports (comment 52, NPRM), at 6.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
Princeton Center commented ‘‘a written
incident response plan is an essential
component of a good security
system.’’ 280 HITRUST commented
incident response plans can help
organizations ‘‘to better allocate limited
resources.’’ 281 The South Carolina
Department of Consumer Affairs
suggested the provision go further by
requiring the incident response plan
include a process for notifying senior
information security personnel of the
event.282
Other commenters opposed requiring
an incident response plan or objected to
particular aspects of the requirement.
Some commenters suggested requiring
financial institutions to have incident
response plans is outside the
Commission’s authority under the GLB
Act.283 NADA argued the requirement
for an incident response plan was
overbroad in light of the broad
definition of security event,284 and the
requirement was vague as to what the
plan should include.285
Other commenters argued the
requirement was too burdensome. ACE
argued ‘‘the range of security events that
might occur and their potential impacts
on institutional capacity to recover’’
make establishing an incident response
plan that will allow an institution to
‘‘respond to, and recover from, any
security event materially affecting . . .
customer information’’ impossible.286
The Mortgage Bankers Association
(‘‘MBA’’) suggested ‘‘institutions of
smaller sizes may not necessarily be
capable of addressing all seven of the
proposed goals.’’ 287 Further, the MBA
argued an incident response plan
requirement had ‘‘the potential to
cripple small businesses under the
pressure of repeatedly checking the
boxes for potentially harmless
events.’’ 288
Finally, some commenters raised
questions about what it means for
khammond on DSKJM1Z7X2PROD with RULES3
280 Princeton
University Center for Information
Technology Policy (comment 54, NPRM), at 7.
281 HITRUST (comment 18, NPRM), at 2.
282 South Carolina Department of Consumer
Affairs (comment 47, NPRM), at 2.
283 National Automobile Dealer Association
(comment 46, NPRM), at 38; National Independent
Automobile Dealers Association (comment 48,
NPRM), at 7.
284 National Automobile Dealer Association
(comment 46, NPRM), at 38.
285 National Automobile Dealer Association
(comment 46, NPRM), at 12, 38–39. NPA also asked
for greater detail on what constitutes an ‘‘incident.’’
National Pawnbroker Association (comment 32,
NPRM), at 4.
286 American Council on Education (comment 24,
NPRM), at 15.
287 Mortgage Bankers Association (comment 26,
NPRM), at 4.
288 Mortgage Bankers Association (comment 26,
NPRM), at 4.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
customer information to be in a
financial institution’s ‘‘possession’’ for
purposes of the incident response plan
requirement. ACE argued the
requirement does not adequately
account for customer information held
in cloud storage operated by third
parties, asserting such information is
not technically within the financial
institution’s possession.289 ACE
suggested the provision should apply to
customer information for which the
financial institution is responsible,
instead.290 Relatedly, the NPA
expressed concern pawnbrokers might
be subject to liability under the
Proposed Rule when law enforcement
agencies or their third-party vendors
make public disclosures of customer
information pawnbrokers are obligated
to report.291
The Commission retains the
requirement for financial institution to
develop and implement an incident
response plan, with one modification
described below. The Commission
believes the creation of an incident
response plan is directly related to
safeguarding customer information and
is within its authority under the GLBA.
The requirement to create an incident
response plan focuses on preparing
financial institutions to respond
promptly and appropriately to security
events, and mitigating any weaknesses
in their information systems in the
process. By responding quickly and
promptly mitigating weaknesses,
financial institutions can stop ongoing
or future compromise of customer
information.292 A well-organized
response to a security event can limit
the number of consumers affected by an
outside attacker by promptly identifying
the attack and taking steps to stop the
attack.
The Commission disagrees with the
commenters who stated this
requirement was too burdensome. The
Final Rule requires incident response
plans address ‘‘security event[s]
materially affecting the confidentiality,
integrity, or availability of customer
information in [a financial institution’s]
control.’’ Significantly, the plan must
address events that ‘‘materially’’ affect
customer information. Thus, the
required incident response plan does
289 American Council on Education (comment 24,
NPRM), at 15.
290 Id.
291 National Pawnbroker Association (comment
32, NPRM), at 4.
292 See Remarks of Serge Jorgenson, Safeguards
Workshop Tr., supra note 17, at 52 (observing a
prompt response to an incident can prevent a
‘‘threat actor running around in my environment for
days, months, years, and able to access anything
they want.’’).
PO 00000
Frm 00027
Fmt 4701
Sfmt 4700
70297
not require a plan to address every
security event that may occur. The plan
need not include minute details or all
possible scenarios. Instead, the Rule
requires the plan to establish a system—
for example, by laying out clear lines of
responsibility, systems for information
sharing, and methods for evaluating
possible solutions—that will facilitate a
financial institution’s response to
security events regardless of the nature
of the event. A detailed approach may
be appropriate for some financial
institutions, such as those with
especially complicated systems or
personnel hierarchies, but the Rule is
designed to give financial institutions
the flexibility needed to develop plans
that best suit their needs.293
Moreover, the Commission believes
the requirement is clear as to what an
incident response plan should include.
The seven listed requirements for the
incident response plans provide
sufficient guidance to financial
institutions designing incident response
plans while giving them flexibility to
design a plan suited to their
organization. In addition, there are
many resources for designing incident
response plans available for financial
institutions, as well as service providers
that can assist with the design
process.294 Individual institutions can
determine the exact details of the plans.
To address questions about whether
information is in the financial
institution’s ‘‘possession,’’ the
Commission is revising paragraph (h) of
the Final Rule to require financial
institutions develop incident response
plans ‘‘designed to promptly respond to,
and recover from, any security event
materially affecting . . . customer
information in your control.’’ (emphasis
added) Replacing the term ‘‘possession’’
with ‘‘control’’ resolves the questions
raised by ACE and the NPA regarding
293 Although the Commission agrees with the
South Carolina Department of Consumer Affairs
that notification of senior personnel is valuable, the
requirement that the plan address ‘‘the definition of
clear roles, responsibilities and levels of decisionmaking authority’’ will almost always result in
communication of decision-making to senior
personnel authorized to make decisions about the
security response. Coupled with the requirement
the Qualified Individual report to the board or
equivalent body on material events affecting
security, the Commission does not see the need to
make this change.
294 See, e.g., FTC, Data Breach Response: A Guide
for Business (2019), www.ftc.gov/tips-advice/
business-center/guidance/data-breach-responseguide-business; NIST, Guide for Cybersecurity
Event Recovery (2016), nvlpubs.nist.gov/nistpubs/
SpecialPublications/NIST.SP.800-184.pdf; Orion
Cassetto, Incident Response Plan 101: How to Build
One, Templates and Examples, Exabeam:
Information Security Blog (November 21, 2018),
www.exabeam.com/incident-response/incidentresponse-plan/ (last visited December 2, 2020).
E:\FR\FM\09DER3.SGM
09DER3
70298
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
whether financial institutions must plan
for security events affecting data that
has been transferred to various kinds of
third parties. Where a financial
institution has voluntarily opted to store
its customer information in the cloud, to
whatever extent the information is no
longer in the ‘‘possession’’ of the
financial institution, it is certainly
within the institution’s ‘‘control.’’ By
contrast, customer information that has
been obtained by a third party such as
a law enforcement agency, over whom
a financial institution has no authority
and of whose actions the financial
institution has no knowledge, cannot
fairly be said to be in the financial
institution’s control. Consequently, the
financial institution need not account
for possible disclosures of that
information by the third party.295
khammond on DSKJM1Z7X2PROD with RULES3
Notification of Security Events to the
Commission
The Commission also requested
comment on whether the Rule should
require financial institutions to report
security events to the Commission.
Several commenters supported this
requirement.296 The Princeton
University Center for Information
Technology Policy noted such a
reporting requirement would ‘‘provide
the Commission with valuable
information about the scope of the
problem and the effectiveness of
security measures across different
entities’’ and ‘‘help the Commission
coordinate responses to shared
threats.’’ 297 The National Association of
Federally-Insured Credit Unions argued
requiring financial institutions to report
security events to the Commission
would provide an ‘‘appropriate
incentive for covered financial
companies to disclose information to
consumers and relevant regulatory
bodies.’’ 298 NAFCU also suggested
notification requirements are important
295 NADA further argued the incident response
plan constitutes a de facto consumer notification
requirement. National Automobile Dealer
Association (comment 46, NPRM), at 39. Financial
institutions have an independent obligation to
perform notification as required by state law,
whether or not they have an incident response plan
in place. The fact that the Rule requires a plan that
sets forth procedures for satisfying that requirement
does not impose any independent notification
requirement on the financial institution.
296 Consumer Reports (comment 52, NPRM), at 6;
Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 7;
Credit Union National Association (comment 30,
NPRM), at 2; Heartland Credit Union Association
(comment 42, NPRM), at 2; National Association of
Federally-Insured Credit Unions (comment 43,
NPRM), at 1–2.
297 Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 7.
298 National Association of Federally-Insured
Credit Unions (comment 43, NPRM), at 1.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
because they ‘‘ensure independent
assessment of whether a security
incident represents a threat to consumer
privacy.’’ 299
Other commenters opposed the
inclusion of a reporting requirement.300
ACE argued such a requirement ‘‘would
simply add another layer on top of an
already crowded list of federal and state
law enforcement contacts and state
breach reporting requirements.’’ 301 ACE
also suggested any notification
requirement should be limited to a more
restricted definition of ‘‘security event’’
than the definition in the Proposed
Rule, so financial institutions would
only be required to report incidents that
could lead to consumer harm.302
The Commission agrees with
commenters that stated a requirement
financial institutions report security
events to the Commission would have
many benefits, including allowing the
Commission to identify emerging threats
and assisting the Commission’s
enforcement of the Rule. In addition,
such a requirement would be unlikely to
create a significant burden on financial
institutions because a security event
that leads to notification to the
Commission is very likely to create
breach notification obligations under
various state laws, and the financial
institution will thus already be engaged
in notifying consumers and state
regulators. The addition of a notification
to the FTC would not require any
significant additional preparation or
effort. However, because the notice of
proposed rulemaking did not set forth a
detailed proposal for a notification
requirement, the Final Rule does not
include such a requirement. Instead, the
Commission is issuing a supplemental
notice of proposed rulemaking (SNPRM)
that proposes adding a requirement
financial institutions notify the
Commission of detected security events
under certain circumstances.303
Proposed Paragraph (i)
Proposed paragraph (i) required a
financial institution’s CISO to ‘‘report in
writing, at least annually, to [the
financial institution’s] board of directors
or equivalent governing body’’ regarding
the following information: (1) The
overall status of the information security
299 National Association of Federally-Insured
Credit Unions (comment 43, NPRM), at 1–2.
300 National Independent Automobile Dealers
Association (comment 48, NPRM), at 7; American
Council on Education (comment 24, NPRM), at 15.
301 American Council on Education (comment 24,
NPRM), at 15.
302 Id.
303 Standards for Safeguarding Customer
Information, SNPRM, published elsewhere in this
issue of the Federal Register.
PO 00000
Frm 00028
Fmt 4701
Sfmt 4700
program and financial institution’s
compliance with the Safeguards Rule;
and (2) material matters related to the
information security program,
addressing issues such as risk
assessment, risk management and
control decisions, service provider
arrangements, results of testing, security
events or violations and management’s
responses thereto, and
recommendations for changes in the
information security program.304 For
financial institutions that did not have
a board of directors or equivalent, the
proposal required the CISO to make the
report to a senior officer responsible for
the financial institution’s information
security program.
One commenter supported this
requirement.305 Additionally, several
workshop participants emphasized the
value of communication between
information security leaders and
corporate boards or their equivalent. For
example, workshop participant Michele
Norin stated it is ‘‘important’’ for the
topic of information security to be
discussed at the level of the board or
senior leadership regularly, and at least
once per year.306 Participant Adrienne
Allen agreed annual reporting made
sense as a requirement, but noted for
some financial institutions, particularly
those with an online presence, even
more frequent communication could be
beneficial.307
ACE argued the Proposed Rule
created too much emphasis on a single
annual report and should instead focus
on regular reporting to the Board or
equivalent.308 It also expressed concern
the report required by the Proposed
Rule would be too detailed and would
not allow the Board to see ‘‘the forest for
the trees,’’ 309 the requirements for the
report were too prescriptive, and the
requirements focused too much on
compliance rather than security.310
Similarly, NADA argued the report
would not improve security but would
instead create ‘‘unnecessary liability
exposure for the board/leadership of the
entity.’’ 311 HITRUST suggested
304 Proposed
16 CFR 314.4(i).
Baeza (comment 12, Workshop), at 3–8
(supporting requirement and providing sample
report form and compliance questionnaire); see also
The Clearing House (comment 49, NPRM), at 15–
16 (arguing that Rule should require more
involvement from Board and senior management).
306 Remarks of Michele Norin, Safeguards
Workshop Tr., supra note 17, at 194.
307 Remarks of Adrienne Allen, Safeguards
Workshop Tr., supra note 17, at 199–200.
308 American Council on Education (comment 24,
NPRM), at 16.
309 Id.
310 Id.
311 National Automobile Dealer Association
(comment 46, NPRM), at 41. NADA also argued the
305 Rocio
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
Qualified Individuals should be able to
meet this reporting requirement by
submitting a report from an information
security certification program to the
Board or equivalent body.312
The Commission adopts the proposal
as final, with one modification
discussed below. This provision is
intended to ensure the governing body
of the financial institution is engaged
with and informed about the state of the
financial institution’s information
security program. Likewise, this will
create accountability for the Qualified
Individual by requiring him or her to set
forth the status of the information
security program for the governing
body.313 This will help financial
institutions to ensure their information
security programs are being maintained
appropriately and given the necessary
resources. Written reports will create a
record of decisions made and the
information upon which they were
based, which may aid future decisionmaking.314 Management involvement in
information security programs can
improve the strength of those programs
and help to reduce breaches.315
The Commission disagrees with the
commenters who stated the reporting
reports by third-party Qualified Individuals might
not include useful information and were ‘‘more
likely to be filled with platitudes and/or efforts to
‘upsell’ the dealership on additional CISO
services.’’ Id. at 42. NADA provided no support for
this claim. The Commission notes such a report
would not meet the requirements of this provision,
and the financial institution would be justified in
terminating their relationship with that provider or,
at least, demanding a revised report that did meet
those requirements.
312 HITRUST (comment 18, NPRM), at 4.
313 See Remarks of Karthik Rangarajan,
Safeguards Workshop Tr., supra note 17, at (‘‘If
quarter over quarter, year over year, this watermark
isn’t reducing, then board of directors should be
able to challenge us and say maybe you’re not
mapping your risks correctly, or vice versa if it’s
reducing but we’re seeing more incidents, we’re
seeing potential breaches, things like that, then the
board of directors should be able to say maybe you
don’t have the right risk quantification framework
or the right risk management framework.’’).
314 Workshop participants Adrienne Allen,
Karthik Rangarajan, and Michele Norin each
emphasized this point. See Safeguards Workshop
Tr., supra note 17, pp. 201–09.
315 See Juhee Kwon Jackie Rees Ulmer, & Tawei
Wang, The Association Between Top Management
Involvement and Compensation and Information
Security Breaches, Journal of Information Systems,
Spring 2013, at 219–236 (‘‘. . . the involvement of
an IT executive decreases the probability of
information security breach reports by about 35
percent . . .’’); Julia L. Higgs, Robert E. Pinsker,
Thomas Joseph Smith, & George Young, The
Relationship Between Board-Level Technology
Committees and Reported Security Breaches,
Journal of Information Systems, Fall 2016, at 79–98
(‘‘[A]s a technology committee becomes more
established, its firm is not as likely to be breached.
To obtain further evidence on the perceived value
of a technology committee, this study uses a returns
analysis and finds that the presence of a technology
committee mitigates the negative abnormal stock
returns arising from external breaches.’’).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
requirement would be too prescriptive.
In fact, the language only requires
reporting of (1) the overall status of the
information security program and its
compliance with this Rule; and (2)
material matters related to the
information security program. The
language includes examples of what
material matters might include, such as
risk assessments and security events,
but does not require all of them be
included. The financial institution and
the Qualified Individual will be
responsible for determining what is
material for their organization. The
Commission does not believe these
requirements call for overly detailed
reports.316
Although the Commission agrees a
certification report from a Qualified
Individual could be a part of the annual
report and may cover many material
matters, it may not suffice in all cases;
thus, the Commission declines to
include such a one-size-fits-all
requirement.
As to the suggestion to require
‘‘regular’’ reporting, the Commission
agrees more regular reporting may be
the best approach for many financial
institutions. To this end, the
Commission modifies the requirement
in the final rule to say ‘‘regularly, and
at least annually.’’ 317 Beyond this
modification, the Final Rule adopts
proposed paragraph (i) as proposed.
Board Certification
The Commission specifically sought
comment on whether the Board or
equivalent should be required to certify
the contents of the report. The two
commenters who addressed this
question stated they should not.318 ACE
noted ‘‘governing boards generally will
not have the knowledge and expertise to
316 Indeed, workshop participants discussed a
variety of strategies for meaningful communication
between security personnel and senior leadership.
Participants noted the proper content, style, and
cadence of reporting (beyond the minimum annual
report) will vary depending on, among other things,
the type of financial institution in question and the
level of familiarity of leadership with the relevant
technical issues. See Safeguards Workshop Tr.,
supra note 17, at 194–200.
317 NADA argued reports required by this
provision would be expensive because the Proposed
Rule stated they would need to be prepared by a
‘‘CISO,’’ which NADA takes to mean a highly
compensated expert of the type retained by the
most sophisticated large institutions. National
Automobile Dealer Association (comment 46,
NPRM), at 41. As discussed above, however, the
Rule does not require all financial institutions to
retain such an expert. Instead, the report will be
made by the Qualified Individual, whose expertise
and compensation will vary according to the size
and complexity of a financial institution’s
information system.
318 National Automobile Dealer Association
(comment 46, NPRM), at 41 n.126; American
Council on Education (comment 24, NPRM), at 16.
PO 00000
Frm 00029
Fmt 4701
Sfmt 4700
70299
independently certify’’ the technical
aspects of the report and certification
might require the employment of
outside auditors.319 The Commission
agrees senior management of financial
institutions will often lack the technical
expertise to personally attest to its
validity. In addition, the primary
purpose of the required report is to
encourage communication between
information security personnel and
senior management, not to show
compliance with the Rule. Requiring the
governing board to certify the contents
of the report would likely transform the
report into a compliance document and
might reduce its efficacy as a
communication between the Qualified
Individual and the Board. Accordingly,
the Commission declines to adopt this
requirement in the Final Rule.
§ 314.5: Effective Date
The Proposed Rule set a new effective
date for some portions of the Rule.
Proposed § 314.5 provided certain
elements of the information security
program would not be required until six
months after the publication of a final
rule, rather than immediately upon
publication. The paragraphs that would
have a delayed effective date were:
§ 314.4(a), related to the appointment of
a Qualified Individual; § 314.4(b)(1),
relating to conducting a written risk
assessment; § 314.4(c)(1) through (8),
setting forth the new elements of the
information security program;
§ 314.4(d)(2), requiring continuous
monitoring or annual penetration testing
and biannual vulnerability assessment;
§ 314.4(e), requiring training for
personnel; § 314.4(f)(3), requiring
periodic assessment of service
providers; § 314.4(h), requiring a written
incident response plan; and § 314.4(i),
requiring annual written reports from
the Qualified Individual. All other
requirements under the Safeguards Rule
would remain in effect during this sixmonth period. These remaining
requirements largely mirrored the
requirements of the existing Rule.
All commenters that addressed this
provision noted the difficulty of
complying with some of the provisions
of the Proposed Rule, and argued
financial institutions should be given
more time to comply with them. ACE
suggested financial institutions be given
one year to create a plan for compliance
and two years to come into actual
compliance.320 AFSA suggested
compliance not be required for two
319 American Council on Education (comment 24,
NPRM), at 16.
320 American Council on Education (comment 24,
NPRM), at 4–5.
E:\FR\FM\09DER3.SGM
09DER3
70300
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
years.321 ACA International requested
the effective date be one year after
publication of the Rule.322
The Commission agrees some
financial institutions may need longer to
modify their information security
programs to comply with the new
requirements in the Final Rule,
especially given the current pandemic
and the strains it is placing on
businesses. Accordingly, the Final Rule
extends the effective date for these
enumerated provisions to one year after
the publication of this document.
Proposed § 314.6: Exceptions
khammond on DSKJM1Z7X2PROD with RULES3
Proposed § 314.6 exempted financial
institutions that maintain customer
information concerning fewer than five
thousand consumers from certain
requirements of the Proposed Rule,
namely § 314.4(b)(1), requiring a written
risk assessment; § 314.4(d)(2), requiring
continuous monitoring or annual
penetration testing and biannual
vulnerability assessment; § 314.4(h),
requiring a written incident response
plan; and § 314.4(i), requiring an annual
written report by the CISO (as revised,
the Qualified Individual).323 This
proposed section was designed to
reduce the burden on smaller financial
institutions.
The Commission sought comment on
whether it was appropriate to include
such an exemption, whether the specific
exemptions were appropriate, whether
the use of the number of customers
concerning whom the financial
institution retains customer information
is the most effective way to determine
which financial institutions should be
exempted and, if so, whether five
thousand customers was an appropriate
number. After reviewing the comments
received, the Commission retains the
exemption for financial institutions
with fewer than 5,000 customers as
proposed.
Several commenters supported the
inclusion of an exemption for small
financial institutions. Consumer Reports
supported the exemption as
proposed.324 NPA supported the
decision to base this exemption on the
number of customers whose information
the financial institution maintains, but
questioned how the number of
321 American Financial Services Association
(comment 41, NPRM), at 7.
322 ACA International (comment 45, NPRM), at
10–11.
323 Proposed 16 CFR 314.6.
324 Consumer Reports (comment 52, NPRM), at 6;
see also Credit Union National Association
(comment 30, NPRM), at 2 (noting the exemption
will be helpful for smaller businesses, but
suggesting other changes to the Proposed Rule so
the exemption is not required).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
customers would be determined.325
NPA asked whether the number of
customers would be counted on an
annual basis or include all records the
financial institution maintains. It also
asked if each transaction with a
customer would be counted
separately.326
Some commenters argued the number
of customers whose records a financial
institution maintains was the wrong
measure by which to assess whether the
exemption should apply. For example,
commenters suggested the Rule should
take into account businesses with
revenue beneath a certain threshold,327
the number of students enrolled at
covered educational institutions,328 or
the number of individuals employed by
the financial institution.329
Additionally, some commenters
argued the threshold for application of
the exemption should be higher. ACA
International suggested the exemption
should apply to all financial institutions
maintaining records concerning fewer
than 10,000 customers.330 AFSA
suggested a 50,000 customer
threshold.331 NADA 332 and NIADA 333
argued the threshold should be raised to
100,000 customers. Without proposing a
specific alternative, NPA expressed
concern the 5,000-customer threshold
may be too low, noting pawnbrokers
who accept firearms as collateral are
required to keep customer records
related to certain transactions for twenty
years.334
As to the substance of the exemption,
some commenters felt it did not go far
enough to relieve the burden of the rule
for small financial institutions. ACA
International proposed eligible financial
325 National Pawnbrokers Association (comment
32, NPRM), at 6.
326 Id.; see also National Independent Automobile
Dealers Association (comment 48, NPRM), at 3.
327 ACA International (comment 45, NPRM), at
11–12.
328 American Council on Education (comment 24,
NPRM), at 5.
329 Ahmed Aly (comment 22, NPRM).
330 ACA International (comment 45, NPRM), at
11–12.
331 American Financial Services Association
(comment 41, NPRM), at 3–4.
332 National Automobile Dealers Association
(comment 46, NPRM), at 43–44. NADA also
suggested information about customers for which
the nonpublic information has been removed
should not be counted to the total. If the
information is anonymized or otherwise
transformed so it is no longer reasonably linkable
to a customer, that information will not count
towards the exemption. NADA’s example of
retaining only ‘‘name, phone number, address, and
VIN of the vehicle they own,’’ would still count as
customer information under the Rule.
333 National Independent Automobile Dealers
Association (comment 48, NPRM), at 3.
334 National Pawnbrokers Association (comment
32, NPRM), at 6.
PO 00000
Frm 00030
Fmt 4701
Sfmt 4700
institutions should also be exempt from
the requirement to designate a single
qualified individual to oversee their
information security programs.335 The
National Federation of Independent
Business argued businesses with 15 or
fewer employees should be exempted
from the Rule entirely and instead held
only to a requirement to take
‘‘commercially reasonable steps’’ to
safeguard customer information.336 The
Small Business Administration Office of
Advocacy suggested, in the absence of
additional information regarding the
impact of the proposed changes on
small businesses, the Rule should
‘‘maintain the status quo’’ for small
entities as defined by the Small
Business Administration’s size
standards.337
On the other hand, other commenters
opposed the inclusion of any
exemption. The Independent
Community Bankers of America noted
the Federal Financial Institutions
Examination Council Interagency
Guidelines Establishing Standards for
Safeguarding Customer Information
(‘‘FFIEC Guidelines’’), which detail how
depository institutions are required to
protect customer information, include
no exemption for smaller institutions
and suggested the Rule should also have
no exemption and apply equally to all
financial institutions.338
Under the existing Rule, there is no
exception for smaller entities. Still, the
Commission continues to believe it is
appropriate to exempt small businesses
from some of the revised Rule’s
requirements. Although the FFIEC
Guidelines do not exempt small
businesses from its requirements, the
FFIEC Guidelines regulate only
depository financial institutions subject
to an entirely different regulatory
regime, including supervision by their
regulatory agencies. While the
provisions from which eligible financial
institutions are exempt have significant
benefits for the security of customer
information and other sensitive data,339
335 ACA
International (comment 45, NPRM), at
12.
336 National Federation of Independent Business
(comment 16, NPRM), at 4.
337 Small Business Administration Office of
Advocacy (comment 28, NPRM), at 6.
338 Independent Community Bankers of America
(comment 35, NPRM), at 4; see also American
Escrow (comment 6, Workshop), at 3 (arguing even
small companies may need to comply with all
portions of the Rule to maintain consumer
confidence); see also Caiting Wang (Comment 6,
Privacy) (suggesting exempted provisions should be
optional for smaller businesses, or the Commission
create a fund to enable small businesses to comply
with these provisions).
339 See, e.g., Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 85
(noting continuous monitoring allows organizations
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
those provisions may be less necessary
in situations where the overall volume
of retained data is low. This is true in
part because the potential for
cumulative consumer harm is less
where fewer consumers’ information
may be exposed as the result of a
security incident.340
For similar reasons, the Commission
finds the number of individuals
concerning whom a financial institution
maintains customer information is the
appropriate measure of whether the
exemption should apply to a particular
financial institution. The application of
the exemption should take into account
both the potential burden of compliance
to financial institutions and the risk to
consumers when standards are
relaxed—in other words, the purpose of
the exemption is to avoid imposing
undue burden while assuring customer
information is subject to necessary
protections. Even a very small financial
institution, depending on its business
model, may retain very large quantities
of sensitive customer information.341
Adequate security is necessary to
protect such information, which may
constitute an attractive target for bad
actors such as identity thieves; the value
of the target is correlated with the
volume of information maintained.342
to detect and quickly respond to threats); Remarks
of Frederick Lee, Safeguards Workshop Tr., supra
note 17, at 126–28 (Frederick Lee) (discussing
benefits of penetration testing); Remarks of Tom
Dugas, Safeguards Workshop Tr., supra note 17, at
143 (noting the importance of vulnerability scans);
Remarks of Michele Norin, Safeguards Workshop
Tr., supra note 17, 194–95 (asserting annual
reporting by the Qualified Individual to an
organization’s board or equivalent is beneficial);
Remarks of Adrienne Allen, Safeguards Workshop
Tr., supra note 17, at 201.
340 See Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 91–92 (noting
companies that control large amounts of consumer
data should in most instances implement the full
range of data security safeguards, whereas small
businesses with less data may need to focus on
cybersecurity basics); see also Remarks of Lee
Waters, Safeguards Workshop Tr., supra note 17, at
91 (‘‘[T]he amount of data [that a business holds]
would definitely have an influence on whether a
business is even going to be attacked.’’); Remarks
of Rocio Baeza, Safeguards Workshop Tr., supra
note 17, at 94 (citing the volume of consumer
records held by an organization as an important
factor in assessing cybersecurity risk).
341 See, e.g., Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 91–92 (noting small
businesses with an enormous amount of consumer
records need to follow all of the safeguards and
‘‘can’t get away with just doing the basics’’); see
also ACA International (comment 45, NPRM) at 11
(‘‘Many small financial institutions, including a
number of ACA members, have objectively limited
operations in terms of number of employees and
revenues, but handle large volumes of consumer
account data for each of their clients on whose
behalf they are collecting debts.’’).
342 See. e.g., Remarks of Rocio Baeza, Safeguards
Workshop Tr., supra note 17, at 94 (opining ‘‘the
better indicators for cybersecurity risk are going to
be two things: The volume of consumer records that
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
While a business’s revenue or number of
employees may provide a measure of
the burden of compliance for that
business, these figures do not capture
consumer risk. By contrast, the number
of individuals about whom a financial
institution maintains customer
information is a proxy for the level of
security necessary in light of both the
risk of attack and the potential
consumer harm should a security
incident occur.343 In addition, basing
the exemption on the number of
individuals concerning whom a
financial institution maintains customer
information provides an incentive to
financial institutions to reduce the
amount of information they retain. A
financial institution may choose to
dispose of information so it holds
information on few enough consumers
to qualify for exemption.344
The Final Rule adopts this section as
proposed. The Commission continues to
believe the cutoff for financial
institutions maintaining information
concerning 5,000 consumers
appropriately balances the need for
security with the burdens on smaller
businesses. The requirements to which
exempted financial institutions would
still be required to adhere are tailored to
balance the importance of adequately
securing customer information against
the need to limit financial burdens for
small businesses. Many of these
requirements were already in force as
part of the existing Rule—for example,
covered financial institutions were
already required to design and
implement a written information
security program, conduct risk
assessments, perform an initial
assessment of their service providers,
and designate one or more employees to
oversee information security. For
reasons discussed elsewhere in this
document, the new requirements that
apply to exempted financial
institutions, such as the requirement to
designate a single qualified individual
to oversee information security rather
than one or more individuals, will
a financial institution holds and also the rate of
change.’’); Remarks of Lee Waters, Safeguards
Workshop Tr., supra note 17, at 91 (noting the
amount of data a company holds influences
whether it is going to be attacked).
343 See Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 89–90
(noting the size of a financial institution and the
amount and nature of the information it holds factor
into an appropriate information security program).
344 The Commission understands this provision to
count all individual consumers about which a
financial institution maintains customer
information, including both current and former
customers. The exemption counts consumers rather
than transactions so a financial institution that had
100 transactions with a single customer would
count only a single consumer.
PO 00000
Frm 00031
Fmt 4701
Sfmt 4700
70301
ensure financial institutions of all sizes
continue to adequately protect customer
information in an environment of
increasing cybersecurity risk, while
avoiding the imposition of undue
burden.
IV. Paperwork Reduction Act
The Paperwork Reduction Act
(‘‘PRA’’), 44 U.S.C. 35, requires Federal
agencies to seek and obtain Office of
Management and Budget (OMB)
approval before undertaking a collection
of information directed to ten or more
persons.345 A ‘‘collection of
information’’ occurs when ten or more
persons are asked to report, provide,
disclose, or record information in
response to ‘‘identical questions.’’ 346
Applying these standards, neither the
Safeguards Rule nor the amendments
constitute a ‘‘collection of
information.’’ 347 The Rule calls upon
affected financial institutions to develop
or strengthen their information security
programs in order to provide reasonable
safeguards. Under the Rule, each
financial institution’s safeguards will
vary according to its size and
complexity, the nature and scope of its
activities, and the sensitivity of the
information involved. For example, a
financial institution with numerous
employees would develop and
implement employee training and
management procedures beyond those
that would be appropriate or reasonable
for a sole proprietorship, such as an
individual tax preparer or mortgage
broker. Similarly, a financial institution
that shares customer information with
numerous service providers would need
to take steps to ensure such information
remains protected, while a financial
institution with no service providers
would not need to address this issue.
Thus, although each financial
institution must summarize its
compliance efforts in one or more
written documents, the discretionary
balancing of factors and circumstances
the Rule allows—including the myriad
operational differences among
businesses it contemplated—does not
require entities to answer ‘‘identical
questions’’ and therefore does not
trigger the PRA’s requirements.
The amendments to the Rule do not
change this analysis because they retain
the existing Rule’s process-based
approach, allowing financial
institutions to tailor their programs to
reflect the financial institutions’ size,
complexity, and operations, and to the
345 44
U.S.C. 3502(3)(A)(i).
44 U.S.C. 3502(3)(A).
347 See Standards for Safeguarding Customer
Information, 67 FR 36484, 36491 (May 23, 2002).
346 See
E:\FR\FM\09DER3.SGM
09DER3
70302
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
sensitivity and amount of customer
information they collect. For example,
amended § 314.4(b) would require a
written risk assessment, but each risk
assessment will reflect the particular
structure and operation of the financial
institution and, though each assessment
must include certain criteria, these are
only general guidelines and do not
consist of ‘‘identical questions.’’
Similarly, amended § 314.4(h), which
requires a written incident response
plan, is only an extension of the
preexisting requirement of a written
information security plan and would
necessarily vary significantly based on
factors such as the financial institution’s
internal procedures, which officials
within the financial institution have
decision-making authority, how the
financial institution communicates
internally and externally, and the
structure of the financial institution’s
information systems. Likewise, the
proposed requirement for Qualified
Individuals to produce annual reports
under proposed § 314.4(i) does not
consist of answers to identical
questions, as the content of these reports
would vary considerably between
financial institutions and Qualified
Individuals are given flexibility in
deciding what to include in the reports.
Finally, the modification of the
definition of ‘‘financial institution’’ to
include ‘‘activities incidental to
financial activities’’ and therefore bring
finders under the scope of the Rule do
not constitute a ‘‘collection of
information,’’ and therefore do not
trigger the PRA’s requirements.
khammond on DSKJM1Z7X2PROD with RULES3
V. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA),
as amended by the Small Business
Regulatory Enforcement Fairness Act of
1996, requires an agency to either
provide an Initial Regulatory Flexibility
Analysis (IRFA) with a proposed Rule,
or certify that the proposed Rule will
not have a significant impact on a
substantial number of small entities.348
The Commission published an Initial
Regulatory Flexibility Analysis in order
to inquire into the impact of the
Proposed Rule on small entities. In
response, the Commission received
comments that argued the revision to
the Safeguards Rule would be unduly
burdensome for smaller financial
institutions. The discussion below
summarizes these comments and the
Commission’s response to them.
348 5
U.S.C. 603 et seq.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
1. Description of the Reason for Agency
Action
The Commission issues these
amendments to clarify the Safeguards
Rule by including a definition of
‘‘financial institution’’ and related
examples in the Safeguards Rule rather
than incorporating them from the
Privacy Rule by reference. The
amendments also expand the definition
of ‘‘financial institution’’ in the Rule to
include entities engaged in activities
incidental to financial activities. This
change would bring ‘‘finders’’ within
the scope of the Rule. This change
harmonizes the Rule with other
agencies’ rules and requires finders that
collect consumers’ sensitive financial
information to comply with the
Safeguards Rule’s process-based
approach to protect that data.
In addition, the amendments modify
the Safeguards Rule to include more
detailed requirements for the
information security program required
by the Rule.
2. Issues Raised by Comments in
Response to the IRFA
As stated above, the Commission
received several comments that argued
the revised Safeguards Rule would
impose unduly heavy burdens on
smaller businesses. The Small Business
Administration’s Office of Advocacy
commented it was concerned the FTC
had not gathered sufficient data as to
either the costs or benefits of the
proposed changes for small financial
institutions. The FTC shares the Office
of Advocacy’s interest in ensuring
regulatory changes have an evidentiary
basis. Many of the questions on which
the FTC sought public comment, both in
the regulatory review and in the
proposed rule context, specifically
related to the costs and benefits of
existing and proposed Rule
requirements. Following the initial
round of commenting, the Commission
conducted the FTC Safeguards
Workshop and solicited additional
public comments with the explicit goal
of gathering additional data relating to
the costs and benefits of the proposed
changes.349 As detailed throughout this
document, the Commission believes
there is a strong evidentiary basis for the
issuance of the Final Rule.
The Office of Advocacy also argued
the Proposed Rule’s requirements were
unduly prescriptive and should not be
enacted as they apply to small
businesses until the Commission can
349 See Public Workshop Examining Information
Security for Financial Institutions and Information
Related to Changes to the Safeguards Rule, 85 FR
13082 (Mar. 6, 2020).
PO 00000
Frm 00032
Fmt 4701
Sfmt 4700
‘‘ascertain the quantitative impact on
small entities.’’ 350 The Office of
Advocacy, along with other
commenters, argued the amendments
taken together would create a large
burden on smaller financial institutions.
In particular, commenters pointed to the
requirements that financial institutions
appoint a chief information security
officer, customer information be
encrypted, financial institutions utilize
multi-factor authentication, and
financial institutions regularly update
training programs. These comments and
the Commission’s response are
discussed at length above. Most
commenters did not provide any
specific estimates of these expenses, but
two commenters did provide a summary
of their expected expenses.
As discussed in the document, the
Commission believes any burden
imposed by the revised Rule is
substantially mitigated by the fact the
Rule continues to be process-based,
flexible, and based on the financial
institution’s size and complexity. In
addition, the amendments exempt
institutions that maintain information
on fewer than 5,000 consumers from
certain requirements that require
additional written product and might
pose a greater burden on smaller
entities. The Commission believes most
of the entities covered by the exemption
will be small businesses. Finally, the
Commission believes all financial
institutions, including small businesses,
that comply with the current Safeguards
Rule will already be in compliance with
most of the new provisions of the
revised Rule as part of their current
information security program.
In addition, in response to the
comments concerned about the burden
of the amendments, the Commission
extended the effective date from six
months after the publication of the Final
Rule to one year after the publication to
allow financial institutions additional
time to come into compliance with the
revised Rule. In addition, in response to
comments that argued hiring a chief
information security officer would be
prohibitively expensive for small
financial institutions, the Commission
amended the rule to clarify such an
employee was not required for all
financial institutions. The Final Rule is
modified to clarify a financial
institution need only appoint an
individual who is qualified to
coordinate its information security
program, and those qualifications will
vary based on the complexity of the
program and size and nature of the
350 Small Business Administration Office of
Advocacy (comment 28, NPRM), at 6.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
financial institution. The Commission
also clarified employee training
programs need to be updated only as
necessary, to respond to a comment
regular updating would be difficult for
smaller financial institutions.
3. Estimate of Number of Small Entities
to Which the Amendments Will Apply
As previously discussed in the IRFA,
determining a precise estimate of the
number of small entities 351—including
newly covered entities under the
modified definition of financial
institution—is not readily feasible.
Financial institutions already covered
by the Rule as originally promulgated
include lenders, financial advisors, loan
brokers and servicers, collection
agencies, financial advisors, tax
preparers, and real estate settlement
services, to the extent they have
‘‘customer information’’ within the
meaning of the Rule. Finders are also
covered under the Final Rule. However,
it is not known whether any finders are
small entities, and if so, how many there
are. The Commission requested
comment and information on the
number of ‘‘finders’’ that would be
covered by the Rule’s modified
definition of ‘‘financial institution,’’ and
how many of those finders, if any, are
small entities. The Commission received
no comments that addressed this
question.
khammond on DSKJM1Z7X2PROD with RULES3
4. Projected Reporting, Recordkeeping,
and Other Compliance Requirements
The Rule does not impose any
reporting or any specific recordkeeping
requirements as discussed earlier. See
supra Section IV (Paperwork Reduction
Act). With regard to other compliance
requirements, the addition of definitions
and examples from the Privacy Rule is
351 The U.S. Small Business Administration Table
of Small Business Size Standards Matched to North
American Industry Classification System Codes
(‘‘NAICS’’) are generally expressed in either
millions of dollars or number of employees. A size
standard is the largest a business can be and still
qualify as a small business for Federal Government
programs. For the most part, size standards are the
annual receipts or the average employment of a
firm. Depending on the nature of the financial
services an institution provides, the size standard
varies. By way of example, mortgage and
nonmortgage loan brokers (NAICS code 522310) are
classified as small if their annual receipts are $8.0
million or less. Consumer lending institutions
(NAICS code 522291) are classified as small if their
annual receipts are $41.5 million or less.
Commercial banking and savings institutions
(NAICS codes 522110 and 522120) are classified as
small if their assets are $600 million or less. Assets
are determined by averaging the assets reported on
businesses’ four quarterly financial statements for
the preceding year. The 2019 Table of Small
Business Size Standards is available at https://
www.sba.gov/sites/default/files/2019-08/
SBA%20Table%20of%20Size%20Standards_
Effective%20Aug%2019%2C%202019_Rev.pdf.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
not expected to have an impact on
covered financial institutions, including
those that may be small entities. (The
preceding section of this analysis
discusses classes of covered financial
institutions that may qualify as small
entities.) The addition of ‘‘finders’’ to
the definition of financial institutions
imposes the obligations of the Rule on
entities that engage in ‘‘finding’’ activity
and also collect customer information.
The addition of more detailed
requirements may require some
financial institutions to perform
additional risk assessments or
monitoring, or to create additional
safeguards as set forth in the Proposed
Rule. These obligations may require
institutions to retain employees or thirdparty service providers with skills in
information security, but, as discussed
above, the Commission believes most
financial institutions will have already
complied with many parts of the Rule
as part of their information security
programs required under the existing
Rule. There may be additional related
compliance costs (e.g., legal, new
equipment or systems, modifications to
policies or procedures), but, as
discussed above, the Commission
believes these are limited by several
factors, including the flexibility of the
Rule, the existing safeguards in place to
comply with the existing Rule, and the
exemption for financial institutions that
maintain less consumer information.
Although two commenters provided
summaries of the expected expenses for
some financial institutions to comply
with the Rule, those estimates did not
provide sufficient detail to fully
evaluate whether they were accurate or
representative of other financial
institutions and appeared to be based, at
least in part, on a misunderstanding of
the requirement to appoint a Qualified
Individual. The Commission believes,
for most smaller financial institutions,
there are very low-cost solutions for any
additional duties imposed by the Final
Rule. This view is supported by the
comments of several experts at the
Safeguards Rule Workshop.352
352 See, e.g., Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 78
(describing virtual CISO services); Matthew Green,
Safeguards Workshop Tr., supra note 17, at 225
(noting website usage of encryption for data in
motion is above 80 percent; ‘‘Let’s Encrypt’’
provides free TLS certificates; and costs have gone
down to the point that if a financial institution is
not using TLS encryption for data in motion, it is
making an unusual decision outside the norm);
Rocio Baeza, Safeguards Workshop Tr., supra note
17, at 106 (‘‘[T]he encryption of data in transit has
been standard. There’s no pushback with that.’’);
Slides Accompanying the Remarks of Lee Waters,
‘‘Information Security Programs and Smaller
Businesses,’’ in Safeguards Workshop Slides, supra
note 72, at 26 (‘‘Estimated Costs of Proposed
PO 00000
Frm 00033
Fmt 4701
Sfmt 4700
70303
The Commission believes the
protection of consumers’ financial
information is of the utmost importance
and the cost of the safeguards required
to provide that protection is justified
and necessary. The Commission
carefully balanced the cost of these
requirements with the need to protect
consumer information and has made
every effort to ensure the Final Rule
retains flexibility so financial
institutions can tailor information
security programs to the size and
complexity of the financial institution,
the nature and scope of its activities,
and the sensitivity of any customer
information at issue.
5. Description of Steps Taken To
Minimize Significant Economic Impact,
if Any, on Small Entities, Including
Alternatives
The standards in the Final Rule allow
a small financial institution to develop
an information security program
appropriate to its size and complexity,
the nature and scope of its activities,
and the sensitivity of any customer
information at issue. The amendments
include certain design standards (e.g., a
company must implement encryption,
authentication, and incident response)
in the Rule, in addition to the
performance standards (reasonable
security) the Rule currently uses. As
discussed, while these design standards
may introduce some additional burden,
the Commission believes many financial
institutions’ existing information
security programs already meet most of
these requirements. In addition, the
requirements in the Final Rule, like
those in the existing Rule, are designed
to allow financial institutions flexibility
in how and whether they should be
implemented. For example, the
requirement encryption be used to
protect customer information in transit
and at rest may be met with effective
alternative compensating controls if
encryption is infeasible for a given
financial institution.
In addition, the amendments exempt
financial institutions that maintain
relatively small amounts of customer
information from certain requirements
of the Final Rule. The exemptions
would apply to financial institutions
that maintain customer information
Changes,’’ estimating costs of multi-factor
authentication to be $50 for smartcard or fingerprint
readers, and $10 each per smartcard); Slides
Accompanying Remarks of Wendy Nather,
Safeguards Workshop Slides, supra note 72, at 37
(chart showing the use of multi-factor
authentication solutions such as Duo Push, phone
call, mobile passcode, SMS passcode, hardware
token, Yubikey passcode, and U2F token in
industries such as financial services and higher
education).
E:\FR\FM\09DER3.SGM
09DER3
70304
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
concerning fewer than ten thousand
consumers. The Commission believes
exempted financial institutions are
generally, but not exclusively, small
entities. Such financial institutions are
not required to perform a written risk
assessment, conduct continuous
monitoring or annual penetration testing
and biannual vulnerability assessment,
prepare a written incident response
plan, or prepare an annual written
report by the Qualified Individual.
These exemptions are intended to
reduce the burden on smaller financial
institutions. The Commission believes
the obligations subject to these
exemptions are the ones most likely to
cause undue burden on smaller
financial institutions.
Exempted financial institutions will
still need to conduct risk assessments,
design and implement a written
information security program with the
required elements, utilize qualified
information security personnel and train
employees, monitor activity of
authorized users, oversee service
providers, and evaluate and adjust their
information security program. These are
core obligations under the Rule any
financial institution that collects
customer information must meet,
regardless of size.
The Commission considered allowing
compliance with a third-party data
security standard, such as the NIST
framework, to act as a safe harbor for
compliance with the Rule. The
Commission, however, determined any
reduction of burden created by allowing
such safe harbors is offset by issues they
would cause. For example, such safe
harbors would require the Commission
to monitor the third-party standard or
standards to determine whether they
continued to align with the Safeguards
Rule. In addition, the Commission
would still have to investigate a
company’s compliance with the outside
standard in any enforcement action. The
Commission also does not agree
compliance with an outside standard is
likely to be less burdensome than
complying with the Safeguards Rule
itself.
VI. Other Matters
Pursuant to the Congressional Review
Act (5 U.S.C. 801 et seq.), the Office of
Information and Regulatory Affairs
designated this rule as not a ‘‘major
rule,’’ as defined by 5 U.S.C. 804(2).
List of Subjects in 16 CFR Part 314
Consumer protection, Credit, Data
protection, Privacy, Trade practices.
For the reasons stated above, the
Federal Trade Commission amends 16
CFR part 314 as follows:
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
PART 314—STANDARDS FOR
SAFEGUARDING CUSTOMER
INFORMATION
1. The authority citation for part 314
continues to read as follows:
■
Authority: 15 U.S.C. 6801(b), 6805(b)(2).
2. In § 314.1, revise paragraph (b) to
read as follows:
■
§ 314.1
Purpose and scope.
*
*
*
*
*
(b) Scope. This part applies to the
handling of customer information by all
financial institutions over which the
Federal Trade Commission (‘‘FTC’’ or
‘‘Commission’’) has jurisdiction.
Namely, this part applies to those
‘‘financial institutions’’ over which the
Commission has rulemaking authority
pursuant to section 501(b) of the
Gramm-Leach-Bliley Act. An entity is a
‘‘financial institution’’ if its business is
engaging in an activity that is financial
in nature or incidental to such financial
activities as described in section 4(k) of
the Bank Holding Company Act of 1956,
12 U.S.C. 1843(k), which incorporates
activities enumerated by the Federal
Reserve Board in 12 CFR 225.28 and
225.86. The ‘‘financial institutions’’
subject to the Commission’s
enforcement authority are those that are
not otherwise subject to the enforcement
authority of another regulator under
section 505 of the Gramm-Leach-Bliley
Act, 15 U.S.C. 6805. More specifically,
those entities include, but are not
limited to, mortgage lenders, ‘‘pay day’’
lenders, finance companies, mortgage
brokers, account servicers, check
cashers, wire transferors, travel agencies
operated in connection with financial
services, collection agencies, credit
counselors and other financial advisors,
tax preparation firms, non-federally
insured credit unions, investment
advisors that are not required to register
with the Securities and Exchange
Commission, and entities acting as
finders. They are referred to in this part
as ‘‘You.’’ This part applies to all
customer information in your
possession, regardless of whether such
information pertains to individuals with
whom you have a customer
relationship, or pertains to the
customers of other financial institutions
that have provided such information to
you.
■ 3. Revise § 314.2 to read as follows:
§ 314.2
Definitions.
(a) Authorized user means any
employee, contractor, agent, customer,
or other person that is authorized to
access any of your information systems
or data.
PO 00000
Frm 00034
Fmt 4701
Sfmt 4700
(b)(1) Consumer means an individual
who obtains or has obtained a financial
product or service from you that is to be
used primarily for personal, family, or
household purposes, or that individual’s
legal representative.
(2) For example:
(i) An individual who applies to you
for credit for personal, family, or
household purposes is a consumer of a
financial service, regardless of whether
the credit is extended.
(ii) An individual who provides
nonpublic personal information to you
in order to obtain a determination about
whether he or she may qualify for a loan
to be used primarily for personal,
family, or household purposes is a
consumer of a financial service,
regardless of whether the loan is
extended.
(iii) An individual who provides
nonpublic personal information to you
in connection with obtaining or seeking
to obtain financial, investment, or
economic advisory services is a
consumer, regardless of whether you
establish a continuing advisory
relationship.
(iv) If you hold ownership or
servicing rights to an individual’s loan
that is used primarily for personal,
family, or household purposes, the
individual is your consumer, even if
you hold those rights in conjunction
with one or more other institutions.
(The individual is also a consumer with
respect to the other financial
institutions involved.) An individual
who has a loan in which you have
ownership or servicing rights is your
consumer, even if you, or another
institution with those rights, hire an
agent to collect on the loan.
(v) An individual who is a consumer
of another financial institution is not
your consumer solely because you act as
agent for, or provide processing or other
services to, that financial institution.
(vi) An individual is not your
consumer solely because he or she has
designated you as trustee for a trust.
(vii) An individual is not your
consumer solely because he or she is a
beneficiary of a trust for which you are
a trustee.
(viii) An individual is not your
consumer solely because he or she is a
participant or a beneficiary of an
employee benefit plan that you sponsor
or for which you act as a trustee or
fiduciary.
(c) Customer means a consumer who
has a customer relationship with you.
(d) Customer information means any
record containing nonpublic personal
information about a customer of a
financial institution, whether in paper,
electronic, or other form, that is handled
E:\FR\FM\09DER3.SGM
09DER3
khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
or maintained by or on behalf of you or
your affiliates.
(e)(1) Customer relationship means a
continuing relationship between a
consumer and you under which you
provide one or more financial products
or services to the consumer that are to
be used primarily for personal, family,
or household purposes.
(2) For example:
(i) Continuing relationship. A
consumer has a continuing relationship
with you if the consumer:
(A) Has a credit or investment account
with you;
(B) Obtains a loan from you;
(C) Purchases an insurance product
from you;
(D) Holds an investment product
through you, such as when you act as
a custodian for securities or for assets in
an Individual Retirement Arrangement;
(E) Enters into an agreement or
understanding with you whereby you
undertake to arrange or broker a home
mortgage loan, or credit to purchase a
vehicle, for the consumer;
(F) Enters into a lease of personal
property on a non-operating basis with
you;
(G) Obtains financial, investment, or
economic advisory services from you for
a fee;
(H) Becomes your client for the
purpose of obtaining tax preparation or
credit counseling services from you;
(I) Obtains career counseling while
seeking employment with a financial
institution or the finance, accounting, or
audit department of any company (or
while employed by such a financial
institution or department of any
company);
(J) Is obligated on an account that you
purchase from another financial
institution, regardless of whether the
account is in default when purchased,
unless you do not locate the consumer
or attempt to collect any amount from
the consumer on the account;
(K) Obtains real estate settlement
services from you; or
(L) Has a loan for which you own the
servicing rights.
(ii) No continuing relationship. A
consumer does not, however, have a
continuing relationship with you if:
(A) The consumer obtains a financial
product or service from you only in
isolated transactions, such as using your
ATM to withdraw cash from an account
at another financial institution;
purchasing a money order from you;
cashing a check with you; or making a
wire transfer through you;
(B) You sell the consumer’s loan and
do not retain the rights to service that
loan;
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
(C) You sell the consumer airline
tickets, travel insurance, or traveler’s
checks in isolated transactions;
(D) The consumer obtains one-time
personal or real property appraisal
services from you; or
(E) The consumer purchases checks
for a personal checking account from
you.
(f) Encryption means the
transformation of data into a form that
results in a low probability of assigning
meaning without the use of a protective
process or key, consistent with current
cryptographic standards and
accompanied by appropriate safeguards
for cryptographic key material.
(g)(1) Financial product or service
means any product or service that a
financial holding company could offer
by engaging in a financial activity under
section 4(k) of the Bank Holding
Company Act of 1956 (12 U.S.C.
1843(k)).
(2) Financial service includes your
evaluation or brokerage of information
that you collect in connection with a
request or an application from a
consumer for a financial product or
service.
(h)(1) Financial institution means any
institution the business of which is
engaging in an activity that is financial
in nature or incidental to such financial
activities as described in section 4(k) of
the Bank Holding Company Act of 1956,
12 U.S.C. 1843(k). An institution that is
significantly engaged in financial
activities, or significantly engaged in
activities incidental to such financial
activities, is a financial institution.
(2) Examples of financial institutions
are as follows:
(i) A retailer that extends credit by
issuing its own credit card directly to
consumers is a financial institution
because extending credit is a financial
activity listed in 12 CFR 225.28(b)(1)
and referenced in section 4(k)(4)(F) of
the Bank Holding Company Act of 1956
(12 U.S.C. 1843(k)(4)(F)), and issuing
that extension of credit through a
proprietary credit card demonstrates
that a retailer is significantly engaged in
extending credit.
(ii) An automobile dealership that, as
a usual part of its business, leases
automobiles on a nonoperating basis for
longer than 90 days is a financial
institution with respect to its leasing
business because leasing personal
property on a nonoperating basis where
the initial term of the lease is at least 90
days is a financial activity listed in 12
CFR 225.28(b)(3) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act, 12 U.S.C. 1843(k)(4)(F).
(iii) A personal property or real estate
appraiser is a financial institution
PO 00000
Frm 00035
Fmt 4701
Sfmt 4700
70305
because real and personal property
appraisal is a financial activity listed in
12 CFR 225.28(b)(2)(i) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act, 12 U.S.C. 1843(k)(4)(F).
(iv) A career counselor that
specializes in providing career
counseling services to individuals
currently employed by or recently
displaced from a financial organization,
individuals who are seeking
employment with a financial
organization, or individuals who are
currently employed by or seeking
placement with the finance, accounting
or audit departments of any company is
a financial institution because such
career counseling activities are financial
activities listed in 12 CFR
225.28(b)(9)(iii) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act, 12 U.S.C. 1843(k)(4)(F).
(v) A business that prints and sells
checks for consumers, either as its sole
business or as one of its product lines,
is a financial institution because
printing and selling checks is a financial
activity that is listed in 12 CFR
225.28(b)(10)(ii) and referenced in
section 4(k)(4)(F) of the Bank Holding
Company Act, 12 U.S.C. 1843(k)(4)(F).
(vi) A business that regularly wires
money to and from consumers is a
financial institution because transferring
money is a financial activity referenced
in section 4(k)(4)(A) of the Bank
Holding Company Act, 12 U.S.C.
1843(k)(4)(A), and regularly providing
that service demonstrates that the
business is significantly engaged in that
activity.
(vii) A check cashing business is a
financial institution because cashing a
check is exchanging money, which is a
financial activity listed in section
4(k)(4)(A) of the Bank Holding Company
Act, 12 U.S.C. 1843(k)(4)(A).
(viii) An accountant or other tax
preparation service that is in the
business of completing income tax
returns is a financial institution because
tax preparation services is a financial
activity listed in 12 CFR 225.28(b)(6)(vi)
and referenced in section 4(k)(4)(G) of
the Bank Holding Company Act, 12
U.S.C. 1843(k)(4)(G).
(ix) A business that operates a travel
agency in connection with financial
services is a financial institution
because operating a travel agency in
connection with financial services is a
financial activity listed in 12 CFR
225.86(b)(2) and referenced in section
4(k)(4)(G) of the Bank Holding Company
Act, 12 U.S.C. 1843(k)(4)(G).
(x) An entity that provides real estate
settlement services is a financial
institution because providing real estate
settlement services is a financial activity
E:\FR\FM\09DER3.SGM
09DER3
khammond on DSKJM1Z7X2PROD with RULES3
70306
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
listed in 12 CFR 225.28(b)(2)(viii) and
referenced in section 4(k)(4)(F) of the
Bank Holding Company Act, 12 U.S.C.
1843(k)(4)(F).
(xi) A mortgage broker is a financial
institution because brokering loans is a
financial activity listed in 12 CFR
225.28(b)(1) and referenced in section
4(k)(4)(F) of the Bank Holding Company
Act, 12 U.S.C. 1843(k)(4)(F).
(xii) An investment advisory company
and a credit counseling service are each
financial institutions because providing
financial and investment advisory
services are financial activities
referenced in section 4(k)(4)(C) of the
Bank Holding Company Act, 12 U.S.C.
1843(k)(4)(C).
(xiii) A company acting as a finder in
bringing together one or more buyers
and sellers of any product or service for
transactions that the parties themselves
negotiate and consummate is a financial
institution because acting as a finder is
an activity that is financial in nature or
incidental to a financial activity listed
in 12 CFR 225.86(d)(1).
(3) Financial institution does not
include:
(i) Any person or entity with respect
to any financial activity that is subject
to the jurisdiction of the Commodity
Futures Trading Commission under the
Commodity Exchange Act (7 U.S.C. 1 et
seq.);
(ii) The Federal Agricultural Mortgage
Corporation or any entity chartered and
operating under the Farm Credit Act of
1971 (12 U.S.C. 2001 et seq.);
(iii) Institutions chartered by Congress
specifically to engage in securitizations,
secondary market sales (including sales
of servicing rights) or similar
transactions related to a transaction of a
consumer, as long as such institutions
do not sell or transfer nonpublic
personal information to a nonaffiliated
third party other than as permitted by
§§ 313.14 and 313.15; or
(iv) Entities that engage in financial
activities but that are not significantly
engaged in those financial activities,
and entities that engage in activities
incidental to financial activities but that
are not significantly engaged in
activities incidental to financial
activities.
(4) Examples of entities that are not
significantly engaged in financial
activities are as follows:
(i) A retailer is not a financial
institution if its only means of
extending credit are occasional ‘‘lay
away’’ and deferred payment plans or
accepting payment by means of credit
cards issued by others.
(ii) A retailer is not a financial
institution merely because it accepts
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
payment in the form of cash, checks, or
credit cards that it did not issue.
(iii) A merchant is not a financial
institution merely because it allows an
individual to ‘‘run a tab.’’
(iv) A grocery store is not a financial
institution merely because it allows
individuals to whom it sells groceries to
cash a check, or write a check for a
higher amount than the grocery
purchase and obtain cash in return.
(i) Information security program
means the administrative, technical, or
physical safeguards you use to access,
collect, distribute, process, protect,
store, use, transmit, dispose of, or
otherwise handle customer information.
(j) Information system means a
discrete set of electronic information
resources organized for the collection,
processing, maintenance, use, sharing,
dissemination or disposition of
electronic information containing
customer information or connected to a
system containing customer
information, as well as any specialized
system such as industrial/process
controls systems, telephone switching
and private branch exchange systems,
and environmental controls systems that
contains customer information or that is
connected to a system that contains
customer information.
(k) Multi-factor authentication means
authentication through verification of at
least two of the following types of
authentication factors:
(1) Knowledge factors, such as a
password;
(2) Possession factors, such as a token;
or
(3) Inherence factors, such as
biometric characteristics.
(l)(1) Nonpublic personal information
means:
(i) Personally identifiable financial
information; and
(ii) Any list, description, or other
grouping of consumers (and publicly
available information pertaining to
them) that is derived using any
personally identifiable financial
information that is not publicly
available.
(2) Nonpublic personal information
does not include:
(i) Publicly available information,
except as included on a list described in
paragraph (l)(1)(ii) of this section; or
(ii) Any list, description, or other
grouping of consumers (and publicly
available information pertaining to
them) that is derived without using any
personally identifiable financial
information that is not publicly
available.
(3) For example:
(i) Nonpublic personal information
includes any list of individuals’ names
PO 00000
Frm 00036
Fmt 4701
Sfmt 4700
and street addresses that is derived in
whole or in part using personally
identifiable financial information (that
is not publicly available), such as
account numbers.
(ii) Nonpublic personal information
does not include any list of individuals’
names and addresses that contains only
publicly available information, is not
derived, in whole or in part, using
personally identifiable financial
information that is not publicly
available, and is not disclosed in a
manner that indicates that any of the
individuals on the list is a consumer of
a financial institution.
(m) Penetration testing means a test
methodology in which assessors attempt
to circumvent or defeat the security
features of an information system by
attempting penetration of databases or
controls from outside or inside your
information systems.
(n)(1) Personally identifiable financial
information means any information:
(i) A consumer provides to you to
obtain a financial product or service
from you;
(ii) About a consumer resulting from
any transaction involving a financial
product or service between you and a
consumer; or
(iii) You otherwise obtain about a
consumer in connection with providing
a financial product or service to that
consumer.
(2) For example:
(i) Information included. Personally
identifiable financial information
includes:
(A) Information a consumer provides
to you on an application to obtain a
loan, credit card, or other financial
product or service;
(B) Account balance information,
payment history, overdraft history, and
credit or debit card purchase
information;
(C) The fact that an individual is or
has been one of your customers or has
obtained a financial product or service
from you;
(D) Any information about your
consumer if it is disclosed in a manner
that indicates that the individual is or
has been your consumer;
(E) Any information that a consumer
provides to you or that you or your
agent otherwise obtain in connection
with collecting on, or servicing, a credit
account;
(F) Any information you collect
through an internet ‘‘cookie’’ (an
information collecting device from a
web server); and
(G) Information from a consumer
report.
(ii) Information not included.
Personally identifiable financial
information does not include:
E:\FR\FM\09DER3.SGM
09DER3
khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
(A) A list of names and addresses of
customers of an entity that is not a
financial institution; and
(B) Information that does not identify
a consumer, such as aggregate
information or blind data that does not
contain personal identifiers such as
account numbers, names, or addresses.
(o)(1) Publicly available information
means any information that you have a
reasonable basis to believe is lawfully
made available to the general public
from:
(i) Federal, State, or local government
records;
(ii) Widely distributed media; or
(iii) Disclosures to the general public
that are required to be made by Federal,
State, or local law.
(2) You have a reasonable basis to
believe that information is lawfully
made available to the general public if
you have taken steps to determine:
(i) That the information is of the type
that is available to the general public;
and
(ii) Whether an individual can direct
that the information not be made
available to the general public and, if so,
that your consumer has not done so.
(3) For example:
(i) Government records. Publicly
available information in government
records includes information in
government real estate records and
security interest filings.
(ii) Widely distributed media. Publicly
available information from widely
distributed media includes information
from a telephone book, a television or
radio program, a newspaper, or a
website that is available to the general
public on an unrestricted basis. A
website is not restricted merely because
an internet service provider or a site
operator requires a fee or a password, so
long as access is available to the general
public.
(iii) Reasonable basis. (A) You have a
reasonable basis to believe that mortgage
information is lawfully made available
to the general public if you have
determined that the information is of
the type included on the public record
in the jurisdiction where the mortgage
would be recorded.
(B) You have a reasonable basis to
believe that an individual’s telephone
number is lawfully made available to
the general public if you have located
the telephone number in the telephone
book or the consumer has informed you
that the telephone number is not
unlisted.
(p) Security event means an event
resulting in unauthorized access to, or
disruption or misuse of, an information
system, information stored on such
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
information system, or customer
information held in physical form.
(q) Service provider means any person
or entity that receives, maintains,
processes, or otherwise is permitted
access to customer information through
its provision of services directly to a
financial institution that is subject to
this part.
(r) You includes each ‘‘financial
institution’’ (but excludes any ‘‘other
person’’) over which the Commission
has enforcement jurisdiction pursuant
to section 505(a)(7) of the GrammLeach-Bliley Act.
■ 4. In § 314.3, revise paragraph (a) to
read as follows:
§ 314.3 Standards for safeguarding
customer information.
(a) Information security program. You
shall develop, implement, and maintain
a comprehensive information security
program that is written in one or more
readily accessible parts and contains
administrative, technical, and physical
safeguards that are appropriate to your
size and complexity, the nature and
scope of your activities, and the
sensitivity of any customer information
at issue. The information security
program shall include the elements set
forth in § 314.4 and shall be reasonably
designed to achieve the objectives of
this part, as set forth in paragraph (b) of
this section.
*
*
*
*
*
■ 5. Revise § 314.4 to read as follows:
§ 314.4
Elements.
In order to develop, implement, and
maintain your information security
program, you shall:
(a) Designate a qualified individual
responsible for overseeing and
implementing your information security
program and enforcing your information
security program (for purposes of this
part, ‘‘Qualified Individual’’). The
Qualified Individual may be employed
by you, an affiliate, or a service
provider. To the extent the requirement
in this paragraph (a) is met using a
service provider or an affiliate, you
shall:
(1) Retain responsibility for
compliance with this part;
(2) Designate a senior member of your
personnel responsible for direction and
oversight of the Qualified Individual;
and
(3) Require the service provider or
affiliate to maintain an information
security program that protects you in
accordance with the requirements of
this part.
(b) Base your information security
program on a risk assessment that
identifies reasonably foreseeable
PO 00000
Frm 00037
Fmt 4701
Sfmt 4700
70307
internal and external risks to the
security, confidentiality, and integrity of
customer information that could result
in the unauthorized disclosure, misuse,
alteration, destruction, or other
compromise of such information, and
assesses the sufficiency of any
safeguards in place to control these
risks.
(1) The risk assessment shall be
written and shall include:
(i) Criteria for the evaluation and
categorization of identified security
risks or threats you face;
(ii) Criteria for the assessment of the
confidentiality, integrity, and
availability of your information systems
and customer information, including the
adequacy of the existing controls in the
context of the identified risks or threats
you face; and
(iii) Requirements describing how
identified risks will be mitigated or
accepted based on the risk assessment
and how the information security
program will address the risks.
(2) You shall periodically perform
additional risk assessments that
reexamine the reasonably foreseeable
internal and external risks to the
security, confidentiality, and integrity of
customer information that could result
in the unauthorized disclosure, misuse,
alteration, destruction, or other
compromise of such information, and
reassess the sufficiency of any
safeguards in place to control these
risks.
(c) Design and implement safeguards
to control the risks you identity through
risk assessment, including by:
(1) Implementing and periodically
reviewing access controls, including
technical and, as appropriate, physical
controls to:
(i) Authenticate and permit access
only to authorized users to protect
against the unauthorized acquisition of
customer information; and
(ii) Limit authorized users’ access
only to customer information that they
need to perform their duties and
functions, or, in the case of customers,
to access their own information;
(2) Identify and manage the data,
personnel, devices, systems, and
facilities that enable you to achieve
business purposes in accordance with
their relative importance to business
objectives and your risk strategy;
(3) Protect by encryption all customer
information held or transmitted by you
both in transit over external networks
and at rest. To the extent you determine
that encryption of customer
information, either in transit over
external networks or at rest, is
infeasible, you may instead secure such
customer information using effective
E:\FR\FM\09DER3.SGM
09DER3
khammond on DSKJM1Z7X2PROD with RULES3
70308
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
alternative compensating controls
reviewed and approved by your
Qualified Individual;
(4) Adopt secure development
practices for in-house developed
applications utilized by you for
transmitting, accessing, or storing
customer information and procedures
for evaluating, assessing, or testing the
security of externally developed
applications you utilize to transmit,
access, or store customer information;
(5) Implement multi-factor
authentication for any individual
accessing any information system,
unless your Qualified Individual has
approved in writing the use of
reasonably equivalent or more secure
access controls;
(6)(i) Develop, implement, and
maintain procedures for the secure
disposal of customer information in any
format no later than two years after the
last date the information is used in
connection with the provision of a
product or service to the customer to
which it relates, unless such
information is necessary for business
operations or for other legitimate
business purposes, is otherwise required
to be retained by law or regulation, or
where targeted disposal is not
reasonably feasible due to the manner in
which the information is maintained;
and
(ii) Periodically review your data
retention policy to minimize the
unnecessary retention of data;
(7) Adopt procedures for change
management; and
(8) Implement policies, procedures,
and controls designed to monitor and
log the activity of authorized users and
detect unauthorized access or use of, or
tampering with, customer information
by such users.
(d)(1) Regularly test or otherwise
monitor the effectiveness of the
safeguards’ key controls, systems, and
procedures, including those to detect
actual and attempted attacks on, or
intrusions into, information systems.
(2) For information systems, the
monitoring and testing shall include
continuous monitoring or periodic
penetration testing and vulnerability
assessments. Absent effective
continuous monitoring or other systems
to detect, on an ongoing basis, changes
in information systems that may create
vulnerabilities, you shall conduct:
(i) Annual penetration testing of your
information systems determined each
given year based on relevant identified
risks in accordance with the risk
assessment; and
(ii) Vulnerability assessments,
including any systemic scans or reviews
of information systems reasonably
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
designed to identify publicly known
security vulnerabilities in your
information systems based on the risk
assessment, at least every six months;
and whenever there are material
changes to your operations or business
arrangements; and whenever there are
circumstances you know or have reason
to know may have a material impact on
your information security program.
(e) Implement policies and
procedures to ensure that personnel are
able to enact your information security
program by:
(1) Providing your personnel with
security awareness training that is
updated as necessary to reflect risks
identified by the risk assessment;
(2) Utilizing qualified information
security personnel employed by you or
an affiliate or service provider sufficient
to manage your information security
risks and to perform or oversee the
information security program;
(3) Providing information security
personnel with security updates and
training sufficient to address relevant
security risks; and
(4) Verifying that key information
security personnel take steps to
maintain current knowledge of changing
information security threats and
countermeasures.
(f) Oversee service providers, by:
(1) Taking reasonable steps to select
and retain service providers that are
capable of maintaining appropriate
safeguards for the customer information
at issue;
(2) Requiring your service providers
by contract to implement and maintain
such safeguards; and
(3) Periodically assessing your service
providers based on the risk they present
and the continued adequacy of their
safeguards.
(g) Evaluate and adjust your
information security program in light of
the results of the testing and monitoring
required by paragraph (d) of this
section; any material changes to your
operations or business arrangements;
the results of risk assessments
performed under paragraph (b)(2) of this
section; or any other circumstances that
you know or have reason to know may
have a material impact on your
information security program.
(h) Establish a written incident
response plan designed to promptly
respond to, and recover from, any
security event materially affecting the
confidentiality, integrity, or availability
of customer information in your control.
Such incident response plan shall
address the following areas:
(1) The goals of the incident response
plan;
PO 00000
Frm 00038
Fmt 4701
Sfmt 4700
(2) The internal processes for
responding to a security event;
(3) The definition of clear roles,
responsibilities, and levels of decisionmaking authority;
(4) External and internal
communications and information
sharing;
(5) Identification of requirements for
the remediation of any identified
weaknesses in information systems and
associated controls;
(6) Documentation and reporting
regarding security events and related
incident response activities; and
(7) The evaluation and revision as
necessary of the incident response plan
following a security event.
(i) Require your Qualified Individual
to report in writing, regularly and at
least annually, to your board of directors
or equivalent governing body. If no such
board of directors or equivalent
governing body exists, such report shall
be timely presented to a senior officer
responsible for your information
security program. The report shall
include the following information:
(1) The overall status of the
information security program and your
compliance with this part; and
(2) Material matters related to the
information security program,
addressing issues such as risk
assessment, risk management and
control decisions, service provider
arrangements, results of testing, security
events or violations and management’s
responses thereto, and
recommendations for changes in the
information security program.
■
6. Revise § 314.5 to read as follows:
§ 314.5
Effective date.
Section 314.4(a), (b)(1), (c)(1) through
(8), (d)(2), (e), (f)(3), (h), and (i) are
effective as of December 9, 2022.
■
7. Add § 314.6 to read as follows:
§ 314.6
Exceptions.
Section 314.4(b)(1), (d)(2), (h), and (i)
do not apply to financial institutions
that maintain customer information
concerning fewer than five thousand
consumers.
By direction of the Commission,
Commissioners Phillips and Wilson
dissenting.
April Tabor,
Secretary.
Note: The following appendix will not
appear in the Code of Federal Regulations.
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
Appendix—Statements Issued on
October 27, 2021
khammond on DSKJM1Z7X2PROD with RULES3
Statement of Chair Lina M. Khan Joined by
Commissioner Rebecca Kelly Slaughter
Regarding Regulatory Review of the
Safeguards Rule
Today the FTC is significantly
strengthening the Safeguards Rule,1 first
promulgated by the FTC twenty years ago
pursuant to a Congressional directive to
protect personal information that is stored by
financial institutions. This revamping—the
first time in the Rule’s history—is sorely
needed. In the twenty years since the Rule
was first issued, the complexity of
information security has increased
drastically, the use of computer networks in
every aspect of life has expanded
exponentially, and, most notably, an
unending chain of damaging data breaches
caused by inadequate security have cost
Americans heavily.2 The amendments
adopted today require financial institutions
to develop information security programs
that can meet the challenges of today’s
security environment.
For Americans, the harms stemming from
the types of security vulnerabilities that this
Rule addresses are all too real. Victims of
breaches have their most sensitive
information exposed, making them more
vulnerable to identity theft, phishing attacks,
and other forms of fraud.3 In 2018, almost 10
percent of Americans suffered some form of
identity theft, costing many of them
hundreds of dollars and dozens of hours of
time, an experience that many describe as
distressing.4 For some, the cost is much
higher, with victims losing tens of thousands
of dollars.5
The Rule amendments the FTC is issuing
today are strongly supported by the evidence
in the record.6 The evidence gathered from
1 16 CFR part 314. Pursuant to the Gramm Leach
Bliley Act (‘‘GLB’’ or ‘‘GLBA’’), Public Law 106–
102, 113 Stat. 1338 (1999) (codified as amended in
scattered sections of 12 and 15 U.S.C.), the
Commission promulgated the Safeguards Rule in
2001.
2 See, e.g., 2020 Internet Crime Report, Fed. Bur.
Investigations,at 20 (Mar. 2021) (reporting
consumer loss of over $128 million resulting from
corporate data breaches to those who filed
complaints in 2020 alone); Int’l Bus. Mach, Cost of
a Data Breach, at 4 (2021) (estimating that the
average cost of single data breach has risen to $4.24
million).
3 2013 Identity Fraud Report: Data Breaches
Becoming a Treasure Trove for Fraudsters, Javelin
Strategy, at 1 (Feb. 2013) (reporting that 1 in 4
recipients of a data breach notification become
victims of identity theft); Michelle Singletary, Your
online profile may help identity thieves,
Washington Post (Feb. 28, 2012), https://
www.washingtonpost.com/business/economy/
michelle-singletary-your-online-profile-may-helpidentity-thieves/2012/02/28/gIQAXFjygR_story.html
(reporting that recipients of data breach letters are
9.5% more likely to suffer identity theft).
4 See Erika Harrell, Victims of Identity Theft,
2018, U.S. Dep’t of Just., at 1 (Apr. 2021), https://
bjs.ojp.gov/content/pub/pdf/vit18.pdf.
5 See 2021 Consumer Aftermath Report, Identity
Theft Resource Center (2021), at 6 (finding that in
a study of 427 identity crime victims, 21% of them
suffered losses of over $20,000).
6 The Commission first sought public comments
on the proposed amendments in April 2019. See
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
information security experts, industry
associations, and consumer groups—those
with hands-on experience in the area and
knowledge of the field—decisively show that
the amendments are necessary. Of course, all
of this information supplements the
experience that Commission staff has
obtained over twenty years of enforcing the
Rule, and gained through investigations of
companies’ data security practices under the
FTC’s deception and unfairness authority.
The dissent’s conclusion that these
amendments are unnecessary is belied by
both the reality of rampant data security
breaches as well as the robust evidentiary
record. The recent history of major data
breaches affecting millions of consumers
shows that more needs to be done to protect
consumers’ sensitive information. Despite the
increasing sophistication of cyberattacks,
many businesses continue to offer inadequate
security.7 In particular, the massive Equifax
Privacy of Consumer Financial Information Rule
Under the Gramm-Leach-Bliley Act, 84 FR 13150;
Standards for Safeguarding Customer Information,
84 FR 13158 (April 4, 2019). The agency received
almost 50 comments from consumer groups,
industry associations, and data security experts. See
FTC Seeks Comment on Proposed Amendments to
Safeguards and Privacy Rules, 16 CFR part 314,
Project No. P145407, (FTC–2019–0019) (‘‘2019
Safeguards and Privacy NPRM ’’), https://
www.regulations.gov/docket/FTC-2019-0019/
document. Further, the Commission conducted a
workshop discussing the proposed amendments
with information security professionals and experts,
including IT staff from financial institutions
covered by the Safeguards Rule. See Transcript,
Information Security and Financial Institutions: An
FTC Workshop to Examine Safeguards Rule, Fed.
Trade Comm’n (July 13, 2020) (‘‘Safeguards
Workshop’’), https://www.ftc.gov/system/files/
documents/public_events/1567141/transcript-glbsafeguards-workshop-full.pdf. Connected with the
workshop, the Commission sought and received
another round of public comments on the
amendments. The eleven relevant public comments
relating to the subject matter of the July 13, 2020,
workshop can be found here: Postponement of
Public Workshop Related to Proposed Changes to
the Safeguards Rule, 85 FR 23354 (FTC–2020–0038)
(Apr. 27, 2020) (‘‘Workshop Comment Docket’’),
https://www.regulations.gov/document/FTC-20200038-0001.
7 See, e.g., Electronic Privacy Information Center,
Comment Letter No. 55 on 2019 Safeguards and
Privacy NPRM (FTC–2019–0019), at 3 (Aug. 1,
2019) (citing dramatic increase in data breaches at
financial services firms affecting millions of
consumers), https://www.regulations.gov/comment/
FTC-2019-0019-0055; Consumer Reports, Comment
Letter No. 52 on 2019 Safeguards and Privacy
NPRM (FTC–2019–0019) (Aug. 2, 2019), https://
www.regulations.gov/comment/FTC-2019-00190052 (noting several high profile data breaches at
financial institutions as evidence for the need for
stronger regulation); Inpher, Inc., Comment Letter
No. 50 on 2019 Safeguards and Privacy NPRM
(FTC–2019–0019), at 1 (Aug. 1, 2019), https://
www.regulations.gov/comment/FTC-2019-00190050 (pointing to major breaches at financial
institutions as evidence for the need of stronger
security regulations); Independent Community
Bankers of America, Comment Letter No. 35 on
2019 Safeguards and Privacy NPRM (FTC–2019–
0019) (Aug. 2, 2019), https://www.regulations.gov/
comment/FTC-2019-0019-0035 (noting that FTCregulated financial institutions are subject to less
stringent security requirements than those regulated
by banking agencies, even though many handle the
same types of information as those financial
PO 00000
Frm 00039
Fmt 4701
Sfmt 4700
70309
breach, which the FTC alleged was caused by
inadequate data security that could have
been easily corrected by the company, is a
glaring example of how a financial
institution’s lax security practices can have
devastating consequences for Americans.8
The dissent’s suggestion that our current
framework is sufficient falls flat in the face
of such a stark example of the harm that can
arise from avoidable lax security practices by
covered financial institutions. Moreover, the
dissent’s complaint that the rule is also
informed by evidence arising from breaches
and practices occurring in other types of
industries misses the mark. Not only is there
substantial evidence in the rulemaking
record clearly illustrating security lapses of
financial institutions that are covered by the
Rule,9 but the implication that we shouldn’t
use our broader knowledge of common
security pitfalls is unwise.
The record evidence also shows that the
amendment’s requirements track bedrock
principles of data security and represent
proven elements of effective data security
programs that reduce the risk of breaches.10
institutions); National Consumer Law Center et al.,
Comment Letter No. 58 on 2019 Safeguards and
Privacy NPRM (FTC–2019–0019) (Aug. 2, 2019),
https://www.regulations.gov/document/FTC-20190019-0058 (arguing that the recent Equifax breach
showed the need for strengthening the Safeguards
Rule); Cisco Systems, Inc., Comment Letter No. 51
on 2019 Safeguards and Privacy NPRM (FTC–2019–
0019) (Aug. 2, 2019), https://www.regulations.gov/
document/FTC-2019-0019-0051 (noting that
sophisticated hacking techniques used in state
sponsored attacks are likely to be adopted by ‘‘more
garden variety, less sophisticated hackers.’’);
Safeguards Workshop, at 24–26 (July 13, 2020)
(remarks of Chris Cronin) (stating that many
companies do not conduct complete or adequate
risk assessments). Id. at 38–39 (remarks of Serge
Jorgensen) (noting that businesses’ understanding of
the need for security has improved, but that they
continue to struggle to implement controls across
business units). Id. at 39–41 (remarks of Chris
Cronin) (stating that, ‘‘as a rule,’’ businesses of all
sizes are ‘‘behind’’ on cybersecurity, attributing this
in part to consultants whose advice about
reasonable security is motivated by a desire to
‘‘make the clients happy’’). Id. at 43 (remarks of
Pablo Molina) (citing ‘‘the mounting losses that
come from cybercrime’’ as evidence that many
businesses are ‘‘falling behind’’ cybercriminals). Id.
at 114 (remarks of Brian McManamon) (noting that
‘‘the proposed changes are the minimum necessary
to have an effective security program in place.’’). Id.
at 44 (remarks of Sam Rubin) (noting that, in his
experience, companies make significant
investments in technical security measures but that
investment in personnel to oversee and use those
measures is ‘‘a huge shortcoming that I’m seeing in
the field.’’); The Clearing House Association LLC,
Comment Letter No. 49 on 2019 Safeguards and
Privacy NPRM (FTC–2019–0019), at 7–9 (Aug. 2,
2019), https://www.regulations.gov/comment/FTC2019-0019-0049 (citing a 2018 study by the Center
for Financial Inclusion that showed widespread
data security failures among financial technology
companies around the globe).
8 Press Release, Fed. Trade Comm’n, Equifax to
Pay $575 Million as Part of Settlement with FTC,
CFPB, and States Related to 2017 Data Breach, (July
22, 2019), https://www.ftc.gov/news-events/pressreleases/2019/07/equifax-pay-575-million-partsettlement-ftc-cfpb-states-related.
9 See infra, note 7.
10 See, e.g., for Single Qualified Individual
Requirement: National Consumer Law Center et al.,
E:\FR\FM\09DER3.SGM
Continued
09DER3
khammond on DSKJM1Z7X2PROD with RULES3
70310
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
supra note 7, at 3 (arguing that a clear line of
reporting with a single responsible individual could
have prevented the Equifax consumer data breach);
Safeguards Workshop, at 182–84 (remarks of
Adrienne Allen) (stating that without a single
responsible individual, information security staff
‘‘can fall into traps of each relying on someone else
to make a hard call . . . [In a program without a
single coordinator] issues can sometimes fall
through the cracks.’’). Id. at 184–85 (remarks of
Michele Norin) (‘‘I think it’s extremely important to
have a person in front of the information security
program. I think that there are so many components
to understand, to manage, to keep an eye on. I think
it’s difficult to do that if it’s part of someone else’s
job. And so I found that it’s extremely helpful to
have a person in charge of that program just from
a pure basic management perspective and
understanding perspective.’’); Risk Assessment
Requirement: Id. at 25 (remarks of Chris Cronin)
(stating that evaluating the likelihoods and impacts
of potential security risks and evaluating existing
controls is an important component of a risk
assessment). Id. at 29–30 (remarks of Serge
Jorgensen) (emphasizing the importance of risk
assessments as tools for adjusting existing security
measures to account for both current and future
security threats); Encryption Requirement:
Princeton University Center for Information
Technology Policy, Comment Letter No. 54 on 2019
Safeguards and Privacy NPRM (FTC–2019–0019), at
3 (Aug. 2, 2019), https://www.regulations.gov/
document/FTC-2019-0019-0054 (noting the
effectiveness of encryption); Inpher, Inc., supra note
7, at 4; Safeguards Workshop, at 225 (remarks of
Matthew Green) (noting website usage of encryption
is above 80 percent; ‘‘Let’s Encrypt’’ provides free
TLS certificates; and costs have gone down to the
point that if a financial institution is not using TLS
encryption for data in motion, it is making an
unusual decision outside the norm). Id. at 106
(remarks of Rocio Baeza) (‘‘[T]he encryption of data
in transit has been standard. There’s no pushback
with that.’’); Multifactor Authentication
Requirement: Princeton University Center for
Information Technology Policy, supra note 10, at 6–
7; Electronic Privacy Information Center, supra,
note 7, at 8; National Consumer Law Center et al.,
supra note 7, at 2; Safeguards Workshop, at 102
(remarks of Brian McManamon) (stating that his
company TECH LOCK supports requiring multifactor authentication for users connecting from
internal networks). Id. at 266 (remarks of Matthew
Green) (explaining that passwords are not enough
of an authentication feature but when MFA is used
and deployed, the defenders can win against
attackers). Id. at 239 (describing how because smart
phones have modern secure hardware processors,
biometric sensors and readers built in, increasingly
consumers can get the security they need through
the devices they already have by storing
cryptographic authentication keys on the devices
and then using the phone to activate them);
Incident Response Plan: Credit Union National
Association, Comment Letter No. 30 on 2019
Safeguards and Privacy NPRM (FTC–2019–0019), at
2 (Aug. 1, 2019), https://www.regulations.gov/
document/FTC-2019-0019-0030 (noting that that an
incident response plan ‘‘helps ensure that an entity
is prepared in case of an incident by planning how
it will respond and what is required for the
response.’’). Consumer Reports, supra note 7, at 6
(observing that ‘‘a written incident response plan is
an essential component of a good security
system.’’); HITRUST, Comment Letter No. 18 on
2019 Safeguards and Privacy NPRM (FTC–2019–
0019), at 2 (July 1, 2019), https://
www.regulations.gov/document/FTC-2019-00190018 (commenting that incident response plans can
help organizations ‘‘to better allocate limited
resources.). Safeguards Workshop, at 52 (remarks of
Serge Jorgenson) (observing that a prompt response
to an incident can prevent a ‘‘threat actor running
around in my environment for days, months, years,
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
The amended Rule requires that financial
institutions’ information security plans
address such core concepts as controlling
who is accessing their system,11
understanding their system,12 monitoring
what users do in their system,13 and
protecting the information contained in their
system.14 More particularly, it also requires
encryption of customer information and the
use of multifactor authentication. Adopting
these practices will reduce the chances of a
breach occurring.
In fact, it is likely that the massive breach
at Equifax could have been prevented or
mitigated by adopting practices required by
these amendments. For example, the
Commission’s complaint alleged that the
vulnerability that led to the breach was not
detected for four months because Equifax’s
automated vulnerability scanner was not
configured to scan all of the networks in the
system, something that could have been
prevented if Equifax had performed an
adequate inventory of its system as required
by § 314.4(c)(2) of the amended Rule.15
Equifax allegedly did not encrypt the data of
145 million consumers as required by
§ 314.4(c)(3) of the amended Rule; such
encryption might have prevented the
intruders from misusing individuals’
sensitive information, even if they were able
to obtain it.16 In addition, the complaint
charged that Equifax did not adequately
monitor activity on its network, which
allowed intruders to access and use their
network undetected for months; such
monitoring will be required by
§ 314.4(c)(8).17 Finally, and perhaps most
importantly, Equifax split authority over its
information security program between two
people, which caused failures of
and able to access anything they want.’’); Board
Reporting Requirement: Workshop participants
Adrienne Allen, Karthik Rangarajan, and Michele
Norin each emphasized that such reporting can aid
decision making. See Safeguards Workshop, at 201–
09; see also Rocio Baeza, Comment Letter No. 12
on Workshop Comment Docket (FTC–2020–0038),
at 3–8 (Aug. 12, 2020), https://www.regulations.gov/
comment/FTC-2020-0038-0012 (supporting
requirement and providing sample report form and
compliance questionnaire); Juhee Kwon et al., The
Association Between Top Management Involvement
and Compensation and Information Security
Breaches, J. L. Info. Sys., at 219–236 (2013) (‘‘. . .
the involvement of an IT executive decreases the
probability of information security breach reports
by about 35 percent . . .’’); Julia L. Higgs et al., The
Relationship Between Board-Level Technology
Committees and Reported Security Breaches, J. L.
Info. Sys., at 79–98 (2016) (‘‘[A]s a technology
committee becomes more established, its firm is not
as likely to be breached. To obtain further evidence
on the perceived value of a technology committee,
this study uses a returns analysis and finds that the
presence of a technology committee mitigates the
negative abnormal stock returns arising from
external breaches.’’).
11 16 CFR 314.4(c)(1).
12 16 CFR 314.4(c)(2).
13 16 CFR 314.4(c)(8).
14 16 CFR 314.4(c)(3) and 314.4(c)(5).
15 Compl. for Permanent Injunction & Other
Relief., FTC v. Equifax, Inc., No. 1:19–mi–99999–
UNA (N.D. Ga. July 22, 2019) ¶ 17.
16 Id. ¶ 22.E.
17 Id. ¶ 22.F.
PO 00000
Frm 00040
Fmt 4701
Sfmt 4700
communications and oversight.18 Indeed, the
U.S. House Committee on Oversight and
Government identified Equifax’s organization
as one of the major causes of the breach.19
Appointing a single Qualified Individual as
the coordinator of Equifax’s information
security system, as required by § 314.4(a) of
the amended Rule, could have helped
prevent or limit the scope of one of the
largest breaches in American history. By
implementing the measures required in the
amended Rule, financial institutions will
prevent or mitigate many future breaches,
protecting consumers and their information.
There is also no support for the dissent’s
notion that the amendments eliminate
financial institutions’ flexibility in a way that
will hurt smaller businesses. The
amendments require that information
security programs address certain aspects of
security, but do not prescribe any particular
method for doing so. Specifically, the
amended Rule requires that the information
security program address areas such as access
control, change management, information
disposal, and monitoring user activity, but it
does not require that financial institutions
take any particular action in those areas. In
fact, the Rule recognizes the concerns of
small businesses and adopts appropriate
flexibilities. Section 314.6 of the revised Rule
exempts financial institutions that maintain
information concerning fewer than 5,000
consumers from certain requirements. In
addition, financial institutions with smaller
and simpler systems may determine that
minimal procedures are required in those
areas, and they retain flexibility under these
amendments to follow that route. Moreover,
the record contains significant evidence that
there are free and low-cost solutions for
smaller businesses with more modest data
security needs.20
18 While the dissent questions the requirements in
the Rule regarding elevating security issues to the
top levels of the corporate structure, research
supports these requirements. Boards are becoming
increasingly involved in cybersecurity governance,
as demonstrated by surveys of practitioners and the
growth of literature aimed at educating board
members on cybersecurity. Some studies suggest
that Board attention to data security decisions can
dramatically improve data safeguarding. For
example, one study found a 35% decrease in the
probability of information security breaches when
companies include the Chief Information Security
Officer (or equivalent) in the top management team
and the CISO has access to the board. See Juhee
Kwon et al., supra note 10. see also Safeguards
Workshop, at 201–09.
19 U.S. H. Rep. Comm. on Oversight and Gov.
Reform, Majority Staff Report on The Equifax Data
Breach, 115th Cong., at 55–62 (Dec. 2018).
20 See, e.g., Safeguards Workshop, at 267 (remarks
of Wendy Nather) (‘‘we have a lot more options, a
lot more technologies today than we did before that
are making both of these solutions, both encryption
and MFA, easier to use, more flexible, in some cases
cheaper, and we should be encouraging their
adoption wherever possible.’’). Id. at 265–66
(remarks of Matthew Green) (‘‘I think that we’re in
a great time when we’ve reached the point where
we can actually mandate that encryption be
used. . . . And we’ve reached the point where now
it is something that’s come to be and we can
actually build well.’’). Id. at 229–30 (remarks of
Randy Marchany) (noting that encryption is already
built into the Microsoft Office environment and that
a number of Microsoft products, such as
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
We believe that these amendments
represent a much-needed step forward in
protecting Americans’ data security. Given
growing recognition that the requirements
captured in the Rule represent best practices,
some financial institutions seem to have
already taken appropriate steps to protect
customers’ data and meet the requirements
set out in the amended Rule. It is important,
though, to require those that lag behind to
strengthen their security and prevent future
breaches before they occur, rather than in the
wake of a devastating breach after the damage
has already been done.
khammond on DSKJM1Z7X2PROD with RULES3
Joint Statement of Commissioners Noah
Joshua Phillips and Christine S. Wilson in
the Matter of the Final Rule Amending the
Gramm-Leach-Bliley Act’s Safeguards Rule
In 1999, Congress passed the GrammLeach-Bliley Act, which charged the Federal
Trade Commission (the ‘‘Commission’’) with
promulgating and enforcing a regulation to
ensure that financial firms take care to
safeguard the information they collect from
consumers.1 The Safeguards Rule 2 has
established more data security obligations for
consumer financial data than for data
collected by non-financial firms, a gap that
underlies our view—shared by our
colleagues—that congressional data security
legislation is warranted.
One hallmark of the Safeguards Rule is its
recognition that, in a world of continuously
Spreadsheets, Excel, Docs, and PowerPoint, support
that encryption feature). Id. at 225. Id. at 106
(Remarks of Rocio Baeza) (‘‘[T]he encryption of data
in transit has been standard. There’s no pushback
with that.’’). Id. at 74 (remarks of James Crifasi)
(stating that car dealerships can rely on existing
staff for the role of Qualified Individual). Id. at 78–
79 (remarks of Lee Waters) (stating that any
dealership with any IT staff at all would have
someone who could assume the role of ‘‘qualified
individual,’’ perhaps requiring some additional
research or outside help). Id. at 81–82 (remarks of
Rocio Baeza) (stating that companies may use an
existing employee for the role and ‘‘for any areas
where there may be skill gaps, that can be
supplemented with either certifications or some
type of education.’’). Id. at 89–90 (remarks of Brian
McManamon) (noting that the size of a financial
institution and the amount and nature of the
information that it holds factor into an appropriate
information security program); Presentation Slides,
Inf. Security & Fin. Inst.: An FTC Workshop of GLB
Safeguards, at 27–28 (July 13, 2020) (slides
Accompanying remarks of Rocio Baeza, ‘‘Models for
Complying to the Safeguards Rule Changes)
(‘‘Safeguards Workshop Presentation Slides’’)
https://www.ftc.gov/system/files/documents/
public_events/1567141/slides-glb-workshop.pdf
(describing three different compliance models: Inhouse, outsource, and hybrid, with costs ranging
from $199 per month to more than $15,000 per
month). Safeguards Workshop, at 81–83 (remarks of
Rocio Baeza) (describing three compliance models
in more detail); Safeguards Workshop Presentation
Slides, at 29 (remarks of Brian McManamon,
‘‘Sample Pricing’’) (estimating the cost of
cybersecurity services based on number of
endpoints). Id. at 83–85.
1 Public Law 106–102, 113 Stat. 1338 (1999).
Notably, even as it transferred authority for other
consumer financial regulation to the Consumer
Financial Protection Bureau in the Dodd-Frank Act,
Congress left this rulemaking authority with the
Commission, a vote of confidence in our approach.
15 U.S.C. 6804(a)(1).
2 16 CFR part 314.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
evolving threats and standards, a one-sizefits-all approach to data security may not
work. Under Democratic and Republic
leadership, the Commission has repeatedly
emphasized this principle.3 We have
traditionally eschewed an overly prescriptive
approach, both to data security in general
and to the Safeguards Rule itself.4 The FTC
has never demanded ‘‘perfect’’ security
because the Commission has recognized that
data security is neither cost- nor
consequence-free, and often requires
tradeoffs.5 At the same time, during our
tenure, the Commission has continued to
enforce data security standards vigorously,
including those embodied in the Safeguards
Rule.6
In March 2019, the Commission approved
a Notice of Proposed Rulemaking (‘‘NPRM’’)
proposing additional requirements to the
3 See, e.g., Federal Trade Commission, Statement
Marking the FTC’s 50th Data Security Settlement,
at 1 (Jan. 31, 2014), https://www.ftc.gov/system/
files/documents/cases/140131gmrstatement.pdf
(‘‘FTC Data Security Statement’’) (‘‘Through its
settlements, testimony, and public statements, the
Commission has made clear that it does not require
perfect security; reasonable and appropriate
security is a continuous process of assessing and
addressing risks; there is no one-size-fits-all data
security program; and the mere fact that a breach
occurred does not mean that a company has
violated the law.’’); see also Prepared Statement of
the Federal Trade Commission: Before the
Committee on Homeland Security and
Governmental Affairs Permanent Subcommittee on
Investigations, 116 Cong. 3 (2019) (statement of
Andrew Smith, Director, Bureau of Consumer
Protection) (‘‘[t]here is no one-size-fits-all data
security program . . .’’), https://www.ftc.gov/
system/files/documents/public_statements/
1466607/commission_testimony_re_data_security_
senate_03072019.pdf. Federal Trade Commission,
Stick with Security: A Business Blog Series (Oct.
2017), https://www.ftc.gov/news-events/blogs/
business-blog/2017/10/stick-security-ftc-resourcesyour-business.
4 FTC Notice of Proposed Rulemaking, 84 FR
13158 (Apr. 4, 2019), https://
www.federalregister.gov/documents/2019/04/04/
2019-04981/standards-for-safeguarding-customerinformation (‘‘The Commission continues to believe
that a flexible, non-prescriptive Rule enables
covered organizations to use it to respond to the
changing landscape of security threats, to allow for
innovation in security practices, and to
accommodate technological changes and
advances.’’).
5 Under the FTC’s unfairness authority, the
Commission brings cases when companies under its
jurisdiction fail to employ ‘‘reasonable’’ security.
FTC Data Security Statement, supra note 3 (‘‘The
touchstone of the Commission’s approach to data
security is reasonableness: a company’s data
security measures must be reasonable and
appropriate in light of the sensitivity and volume
of consumer information it holds, the size and
complexity of its business, and the cost of available
tools to improve security and reduce
vulnerabilities.’’).
6 See, e.g., In the matter of Ascension Data &
Analytics, LLC, FTC File No. 1923126 (2020),
https://www.ftc.gov/enforcement/casesproceedings/192-3126/ascension-data-analytics-llcmatter; U.S. v. Mortgage Solutions FCS, Inc., Civ.
Action No. 4:20–cv–110 (N.D. Cal 2020), https://
www.ftc.gov/enforcement/cases-proceedings/1823199/mortgage-solutions-fcs-inc; FTC v. Equifax,
Inc., Civ. Action No. 1:19–cv–03297–TWT (N.D. Ga.
2019), https://www.ftc.gov/enforcement/casesproceedings/172-3203/equifax-inc.
PO 00000
Frm 00041
Fmt 4701
Sfmt 4700
70311
Safeguards Rule. While we recognize the
value in regularly reviewing our rules and
updating them as needed, we dissented then
because the proposal lacked data
demonstrating the need for and efficacy of
the proposed amendments.7
We appreciate Staff’s diligent work on this
rule and many of the modifications made to
the original proposal. The Federal Register
Notice does a commendable job of presenting
the full panoply of comments that the
Commission received. The FTC is at its best
when it seeks input from experts, industry,
and consumer groups; this rulemaking
process reflects a commitment to that
approach. But the comment period did not
produce data demonstrating that the previous
iteration of the rule was inadequate, or that
the costs and consequences of the new
prescriptive obligations will translate into
actual consumer safeguards. That was our
concern, and the comments did not allay it.
In fact, as several commenters observed,
the new prescriptive requirements could
weaken data security by diverting finite
resources towards a check-the-box
compliance exercise and away from risk
management tailored to address the unique
security needs of individual financial
institutions. It is ironic that the revisions
mandate a risk assessment and then order
firms to prioritize specified precautions
ahead of the risks and needs counseled by
that assessment. The revisions also impose
intrusive corporate governance obligations
wholly unsupported by record evidence of
prevalent failures at the senior managerial
level.
For these reasons, which we explain more
fully below, we dissent.
The Record Fails To Provide a Basis for the
New Requirements
We expressed concern in March 2019 that
some of the proposals in the NPRM tracked
issues that arose in cases involving firms not
covered by the Safeguards Rule. That is,
those failures occurred at companies to
which the Safeguards Rule did not apply.
And heightened obligations imposed in a
settlement context, when a company has
engaged in risky and allegedly illegal
behavior, may not be appropriate for all
market participants. We did not see evidence
that covered firms had a systematic
problem—i.e., that the Rule was not
7 Dissenting Statement of Commissioner Noah
Joshua Phillips and Commissioner Christine S.
Wilson, Review of Safeguards Rule (Mar. 5, 2019),
https://www.ftc.gov/system/files/documents/
public_statements/1466705/reg_review_of_
safeguards_rule_cmr_phillips_wilson_dissent.pdf;
See, e.g., Noah Joshua Phillips (@FTCPhillips),
Twitter (Mar. 5, 2019, 3:08 p.m.), https://
twitter.com/FTCPhillips/status/
1103024596247289867 (‘‘A reexamination of the
Rule may indeed be appropriate and necessary; but,
before we borrow from other existing schemes, we
must first understand whether the existing Rule is
inadequate for its purpose and whether the data
supports the efficacy of the alternatives.’’); Christine
S. Wilson, Remarks at NAD 2020, One Step
Forward, Two Steps Back: Sound Policy on
Consumer Protection Fundamentals 7–8 (Oct. 5,
2020), https://www.ftc.gov/system/files/documents/
public_statements/1581434/wilson_remarks_at_
nad_100520.pdf.
E:\FR\FM\09DER3.SGM
09DER3
70312
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES3
working.8 The Commission can—and does—
promote best practices and reasonable care
requirements through speeches, guidance,
reports, and the like, to help financial firms
evaluate whether they are taking proper
precautions.9 But new rules that set concrete
standards for all companies, regardless of
risk, require more justification. Such rules
make companies liable for penalties, and
could focus efforts on compliance to address
penalty deterrence rather than risk.
Dozens of commenters have shared their
views on the Safeguards proposal, and FTC
Staff held a workshop to evaluate the need
to change the Rule. While there is no
shortage of opinions as to the need and
benefits of the proposed changes (nor is there
a shortage of opinions critiquing the new
requirements), this process failed to provide
evidence of market failure or other systemic
problems 10 necessitating the proposed
changes for firms already governed by the
requirements of the Rule. In fact, one
commenter that generally supported the rule
changes noted that it was not clear that the
new rules would have prevented the alleged
8 Commenters on the proposed rules reflected
these same concerns. See, e.g, CTIA (comment 34,
NPRM) at 4, https://www.regulations.gov/comment/
FTC/2019-0019-0034 (observing that most examples
cited in the NPRM are from non-financial firms and
arguing that the FTC’s action in Equifax
demonstrated that the agency is able to use to the
current framework effectively); Global Privacy
Alliance (comment 38, NPRM) at 4, https://
www.regulations.gov/comment/FTC/2019-00190038 (the changes to the rules started not from FTC
experience but rather from state laws); Electronic
Transactions Association (comment 27, NPRM),
https://www.regulations.gov/comment/FTC/20190019-0027 (the current rule is effective and there
are no harms that warrant these changes); National
Automobile Dealers Association (comment 46,
NPRM) at 6, https://www.regulations.gov/comment/
FTC/2019-0019-0046 (‘‘[N]ew requirements for all
financial institutions should not be based on
unrelated enforcement actions that may not be
generally applicable to all financial institutions
subject to the Rule.’’).
9 Federal Trade Commission, Data Security,
https://www.ftc.gov/datasecurity.
10 One study cited by commenters pointed toward
widespread problems among fintech firms
‘‘including misuse of cryptography, use of weak
cryptography, and excessive permission
requirements.’’ The Clearing House Association
LLC (comment 49, NPRM) at 7–9, https://
www.regulations.gov/comment/FTC/2019-00190049 (citing a 2018 study by the Center for
Financial Inclusion, https://content.centerfor
financialinclusion.org/wp-content/uploads/sites/2/
2018/09/CFI43-CFI_Online_Security-Final2018.09.12.pdf). This study included firms from
around the world and did not indicate that this
limited set of issues arose in U.S. firms covered by
the Safeguards Rule. See also National Automobile
Dealers Association (comment 46, NPRM) at 46,
https://www.regulations.gov/comment/FTC/20190019-0046 (‘‘These requirements have largely not
been proven to be necessary or effective.’’).
Participants at the FTC’s July 2020 Workshop
generally agreed that companies could invest more
in security, but the fact of under-investment does
not mean that these changes to the Safeguards Rule
constitute the best course of action. FTC,
Information Security and Financial Institutions: An
FTC Workshop to Examine Safeguards Rule Tr. at
23–70 (July 13, 2020), https://www.ftc.gov/system/
files/documents/public_events/1567141/transcriptglb-safeguards-workshop-full.pdf (‘‘Safeguards
Workshop’’).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
lapses that led to the Equifax breach, the
largest Safeguards case on record.11
That these proposals may constitute best
practices appropriate to certain firms or
situations does not justify imposing them on
every firm and in every situation.12 The FTC
historically has been appropriately cautious
in mandating specific security practices, and
we see no sound basis in the rulemaking
record to change that approach.13
The Revised Safeguards Rule Is Premature
In our 2019 statement, we expressed
concern that the proposals in the NPRM were
premature. They are based in large part on
the New York Department of Financial
Service data security rules,14 adopted in
2016. At the same time, Congress and the
Executive Branch were evaluating new
privacy and data security legislation that may
overlap with the proposed amendments.15
Since our original statement, we have been
provided with no additional information on
the impact and efficacy of the NYDFS rules.16
Without this critical input, we do not believe
adopting wholesale the NYDFS approach is
the prudent course.17 We would have been
better served by monitoring the efficacy,
costs and unintended consequences of the
NYDFS rules during this ramp-up period.
Imposing similar rules on far more firms
across a broader array of industries makes
even less sense.
Congress, with the encouragement of the
Commission, has continued to consider
legislative initiatives in this area. Throughout
2019, 2020 and 2021, we saw the release of
several draft bills addressing data security, as
well as privacy.18 And other developments,
such as data security requirements of the
General Data Protection Regulation 19 and
new cybersecurity incidents 20 ensure that
11 Consumer Reports (comment 52, NPRM),
https://www.regulations.gov/comment/FTC/20190019-0052 at 2. Not all the commenters agreed with
this perspective, and some felt that these rules
would have prevented the Equifax breach. See
National Consumer Law Center and others
(comment 58, NPRM), https://www.regulations.gov/
comment/FTC/2019-0019-0058. Chair Khan and
Commissioner Slaughter focus on the Equifax
breach to justify the adoption of prescriptive and
complex data security measures, measures that
match the sophistication and complexity of the
consumer financial data managed by one of the
largest credit bureaus. But even assuming the new
rules would have prevented it, one (albeit) highprofile breach, without more, should not be
extrapolated to an entire industry with diverse
business models housing varied consumer financial
data. Reasonable safeguards for a company like
Equifax, based on its size and complexity, the
nature and scope of its activities, and the sensitivity
of the information involved, would likely outpace
procedures that would be appropriate or reasonable
for a sole proprietorship or small business.
12 While the Final Rule is based on proposals
from New York State Department of Financial
Services (‘‘NYDFS’’), the FTC imposes its
requirements much more broadly than the NYDFS
Cybersecurity Requirements for Financial Services
Companies, 23 NYCRR Pt. 500. The NYDFS
requirements exempt a much larger cross-section of
organizations from the most onerous, prescriptive,
and expensive provisions in their rule. 23 NYCRR
§ 500.19. Nor do the exceptions in the Final Rule,
while helpful, suffice.
13 Unfortunately, this is not the first time this
Commission has emphasized what we can do over
what we should do. See, e.g., Joint Statement of
Commissioners Noah Joshua Phillips and Christine
S. Wilson, In the matter of Resident Home LLC,
Commission File No. 2023179 (Oct. 7, 2021),
https://www.ftc.gov/system/files/documents/
public_statements/1597270/resident_home_
dissenting_statement_wilson_and_phillips_final_
0.pdf; Joint Statement of Commissioners Noah
Joshua Phillips and Christine S. Wilson, U.S. v.
iSpring Water Systems, LLC, Commission File No.
C4611 (Apr. 12, 2019), https://www.ftc.gov/system/
files/documents/public_statements/1513499/
ispring_water_systems_llc_c4611_modified_joint_
statement_of_commissioners_phillips_and_wilson_
4-12.pdf.
14 Cybersecurity Requirements for Financial
Services Companies, 23 NYCRR Pt. 500 (2016).
15 See Consumer Data Industry Association
(comment 36, NPRM) at 2, https://
www.regulations.gov/document?D=FTC-2019-00190036 (noting that the NY rule is too recent and
Congress is debating new legislation that should be
left to Congress to resolve); National Automobile
Dealers Association (comment 46, NPRM) at 46,
https://www.regulations.gov/comment/FTC-20190019-0046 (The new rules ‘‘are premature as they
are based on untested and new standards in a
rapidly changing environment, and in a context
where federal debate is ongoing.’’); New York
Insurance Association (comment 31, NPRM),
https://www.regulations.gov/comment/FTC-20190019-0031 (it is premature to adopt these rules
without the benefit of the state’s experience).
16 We appreciate the time and resources the
NYDFS invested in commenting on our proposed
rule. Though the NYDFS does say that its rules have
‘‘enhanced cybersecurity protection across the
financial industry and fostered an environment in
which the threat of a cyber attack is taken seriously
at all levels of New York’s financial services firms,’’
it offers no supporting data. New York State
Department of Financial Services (comment 40,
NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0040.
17 As several commenters pointed out, the NYDFS
rules are more nuanced that the amendments
introduced today. For instance, under the NYDFS
regulations, certain additional requirements only
apply to a category of sensitive data, a limitation
not carried through to the Safeguards Rule. See, e.g.,
U.S. Chamber of Commerce (comment 33, NPRM),
https://www.regulations.gov/comment/FTC-20190019-0033; CTIA (comment 34, NPRM), https://
www.regulations.gov/comment/FTC/2019-00190034; Electronic Transactions Association
(comment 27, NPRM), https://www.regulations.gov/
comment/FTC/2019-0019-0027. These distinctions
only raise more questions and concerns about
basing our regulations on the New York rules.
18 See, e.g., Fourth Amendment is Not for Sale
Act, S. 1265, 117th Cong. (2021); Data Care Act of
2021, S. 919, 117th Cong. (2021); Data Protection
Act of 2021, S. 2134, 117th Cong. (2021); SAFE
DATA Act, S. 2499, 117th Cong. (2021); Consumer
Online Privacy Rights Act, S. 2968, 116th Cong.
(2019). See also, California Privacy Rights Act of
2020, Cal. Civ. Code § 1798.100 et seq.; Virginia
Consumer Data Protection Act, Va. Code § 59.1–575
et seq.; and Colorado Privacy Act, 2021 Colo. ALS
483, 2021 Colo. Ch. 483, 2021 Colo. SB. 190.
19 Council Directive 2016/679, art. 32 2016 O.J.
(L119).
20 See, e.g., Joseph Menn and Christopher Bing,
Hackers of SolarWinds stole data on U.S. sanctions
policy, intelligence probes, Reuters (Oct. 8, 2021),
https://www.reuters.com/world/us/hackerssolarwinds-breach-stole-data-us-sanctions-policyintelligence-probes-2021-10-07/; Stephanie Kelly
and Jessica Resnick-ault, One password allowed
hackers to disrupt Colonial Pipeline, CEO tells
senators, Reuters (June 8, 2021), https://
www.reuters.com/business/colonial-pipeline-ceotells-senate-cyber-defenses-were-compromised-
PO 00000
Frm 00042
Fmt 4701
Sfmt 4700
E:\FR\FM\09DER3.SGM
09DER3
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
these issues will continue to draw
congressional attention. The decisions about
tradeoffs in this space are complex and
significant for consumers, business, and
government; intrusive mandates are best left
to the people’s representatives rather than to
the vagaries of the administrative rulemaking
process.21
khammond on DSKJM1Z7X2PROD with RULES3
The Revised Rules Inhibit Flexibility and
Impose Substantial Costs
The Safeguards Rule originally drafted and
evaluated by the Commission embraced a
flexible approach, emphasizing protections
targeted to a company’s size and risk
profile.22 As we wrote in 2019, these new
rules move us away from that approach; that
loss of flexibility will impose costs without
necessarily improving safeguards for
consumer data, which should be the point of
this exercise.
Commenters and the Commission itself
have noted that there are financial impacts to
these new requirements.23 The Small
Business Administration’s Office of
ahead-hack-2021-06-08; Carly Page, The Accellion
data breach continues to get messier, TechCrunch
(July 8, 2021), https://techcrunch.com/2021/07/08/
the-accellion-data-breach-continues-to-get-messier/;
Peter Valdes-Dapena, Volkswagen hack: 3 million
customers have had their information stolen, CNN
(June 11, 2021), https://www.cnn.com/2021/06/11/
cars/vw-audi-hack-customer-information/
index.html.
21 Sen. Roger Wicker, Rep. Cathy McMorris
Rodgers, & Noah Phillips, FTC must leave privacy
legislating to Congress, Wash. Examiner (Sept. 29,
2021), https://www.washingtonexaminer.com/
opinion/op-eds/ftc-must-leave-privacy-legislatingto-congress. Substance aside, businesses and
consumers need confidence to plan around new
rules. As the recent—and perhaps future—debate
about net neutrality rules has demonstrated, agency
rules are subject to disruptive swings that
undermine such confidence.
22 The Commission itself acknowledges the
importance of flexibility in issuing the Final Rule.
See, e.g., Final Rule at 27 (‘‘The Commission,
however, believes that the elements provide
sufficient flexibilityfor financial institutions to
adopt information security programs suited to the
size, nature, and complexity of their organization
and information systems.’’)
23 See Final Rule; American Council on
Education (comment 24, NPRM) at 13–14, https://
www.regulations.gov/comment/FTC-2019-00190024; Wisconsin Bankers Association (comment 37,
NPRM) at 1–2, https://www.regulations.gov/
comment/FTC-2019-0019-0037; American Financial
Services Association (comment 41, NPRM) at 4,
https://www.regulations.gov/comment/FTC-20190019-0041; National Association of Dealer Counsel
(comment 44, NPRM) at 1, https://
www.regulations.gov/comment/FTC-2019-00190044; National Automobile Dealers Association
(comment 46, NPRM) at 11, https://
www.regulations.gov/comment/FTC-2019-00190046; National Independent Automobile Dealers
Association, (comment 48, NPRM) at 3, https://
www.regulations.gov/comment/FTC-2019-00190048; Gusto and others (comment 11, Workshop) at
2–4, https://www.regulations.gov/comment/FTC2019-0019-0011; National Pawnbrokers Association
(comment 3, NPRM) at 2, https://
www.regulations.gov/comment/FTC-2019-00190032; See also Remarks of James Crifasi, Safeguards
Workshop, supra note 10, Tr. at 72–74, https://
www.ftc.gov/system/files/documents/public_events/
1567141/transcript-glb-safeguards-workshopfull.pdf (study showing that compliance costs are
unaffordable for small businesses).
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
Advocacy stated its belief that the
Commission itself does not appear to
understand fully the economic impact of the
proposed changes to the Safeguards Rule.24
The burden of these new rules may also
reduce competition and innovation, as
smaller firms less able to absorb the financial
costs cede ground to larger firms better
equipped to handle new regulatory
mandates.25
Security itself may also suffer. A series of
specific rules can incentivize companies to
move from a thoughtful assessment of risk
and precautions to a check-the-box exercise
to ensure that they are complying with
regulatory mandates—in other words, from a
focus on real security to an emphasis on rule
compliance.26 One commenter cited data
24 Small Business Administration Office of
Advocacy (comment 28, NPRM) at 3–4, https://
www.regulations.gov/comment/FTC-2019-00190028 (‘‘An agency cannot consider alternatives that
minimize any significant economic impact if the
agency does not know what the economic impact
of the proposed action is.’’).
25 See CTIA (comment 34, NPRM), https://
www.regulations.gov/comment/FTC-2019-00190034 (noting the need for more study on the costs
to competition); U.S. Chamber of Commerce
(comment 33, NPRM) at 4, https://
www.regulations.gov/comment/FTC-2019-00190033 (‘‘Some private organizations can absorb the
added costs, while others cannot.’’). See also
Christine S. Wilson, Remarks at the Future of
Privacy Forum, A Defining Moment for Privacy:
The Time is Ripe for Federal Privacy Legislation 13
(Feb. 6, 2020), https://www.ftc.gov/system/files/
documents/public_statements/1566337/
commissioner_wilson_privacy_forum_speech_0206-2020.pdf (‘‘Importantly, the legislative
framework should also consider competition.
Regulations, by their nature, will impact markets
and competition. GDPR may have lessons to teach
us in this regard. Research indicates that GDPR may
have decreased venture capital investment and
entrenched dominant players in the digital
advertising market.’’); Noah Joshua Phillips,
Prepared Remarks at internet Governance Forum
USA, Keep It: Maintaining Competition in the
Privacy Debate (July 27, 2018), https://www.ftc.gov/
system/files/documents/public_statements/
1395934/phillips_-_internet_governance_forum_727-18.pdf (discussing the competition impacts of
new privacy rules).
26 See U.S. Chamber of Commerce (comment 33,
NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0033; Consumer Data Industry
Association (comment 36, NPRM), https://
www.regulations.gov/comment/FTC-2019-00190036; Global Privacy Alliance (comment 38,
NPRM), https://www.regulations.gov/comment/
FTC/2019-0019-0038. While some parts of the rule,
such as encryption requirements, allow security
officials to make a written determination that a
different precaution is appropriate, it seems
unlikely that any individual security official will
risk liability to make such a determination and the
specific requirements here will likely become the
default rule. American Council on Education
(comment 24, NPRM) at 12, https://
www.regulations.gov/comment/FTC-2019-00190024 (‘‘In the absence of a clear delineation by the
Commission of what alternatives an institutional
information security executive might approve that
the Commission considers reasonably equivalent,
and assurance that they are reasonably applicable
in our contexts, that pressure release valve in the
requirement seems unlikely to release much
pressure.’’); Software Information & Industry
Association (comment 29, NPRM) at 3, https://
www.regulations.gov/comment/FTC-2019-00190056 (‘‘The mere threat of a per se law violation
PO 00000
Frm 00043
Fmt 4701
Sfmt 4700
70313
demonstrating that when security personnel
are busy with compliance and regulatory
response, they have less time to focus on a
firm’s actual security needs.27 Further,
without the flexibility to prioritize, finite
resources may be diverted to areas of lower
risk but higher regulatory scrutiny; 28
commenters noted the irony of mandating a
risk assessment and then ordering firms to
prioritize specified precautions ahead of the
risks and needs counseled by that
assessment.29 And potentially innovative
security practices that address changing
threats and needs may be discouraged.30 As
will chill these approvals except in the most
ironclad circumstances, thereby potentially
thwarting industry-wide adoption of new and better
security standards.’’); New York Insurance
Association (comment 31, NPRM), https://
www.regulations.gov/comment/FTC-2019-00190031 (‘‘This runs the risk that companies might feel
compelled to encrypt all consumer data regardless
of whether the CISO’s compensating controls would
be second guessed in the event a company were to
lose unencrypted customer information.’’);
Mortgage Bankers Association (comment 26, NPRM)
at 4, https://www.regulations.gov/comment/FTC2019-0019-0026 (noting the obligation to prepare an
incident response plan had ‘‘the potential to cripple
small businesses under the pressure of repeatedly
checking the boxes for potential harmless events.’’).
27 Bank Policy Institute (comment 39, NPRM) at
6, https://www.regulations.gov/comment/FTC-20190019-0039 (‘‘When the sector surveyed its
information security teams in late 2016, CISOs
reported that approximately 40% of their cyber
team’s time was spent on compliance related
matters, not on cybersecurity. Due to one
framework issuance, in particular, the
reconciliation process delayed one firm’s
implementation of a security event monitoring tool
intended to better detect and respond to cyberattacks by 3–6 months. With respect to another
issuance, another firm stated that 91 internal
meetings were held to determine how that issuance
aligned with its program and in gathering data for
eventual regulatory requests.’’).
28 See U.S. Chamber of Commerce (comment 33,
NPRM) at 4, https://www.regulations.gov/comment/
FTC-2019-0019-0033 (‘‘the proposed requirements
would increasingly divert company resources
toward compliance and away from risk
management activities that are tailored to
businesses’ unique security needs.’’); Software
Information & Industry Association (comment 29,
NPRM) at 3, https://www.regulations.gov/comment/
FTC-2019-0019-0056 (‘‘The effect of a prescriptive
approach in this enforcement structure is to place
companies in the position of forced compliance
with potentially unnecessary or inapplicable
requirements without the appropriate process for
these covered entities to explain to a supervisory
authority why it is unnecessary.’’); American
Financial Services Association (comment 41,
NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0041. In some cases, asking too
much of small businesses for whom all this is a
substantial undertaking may lead them to fail at
even the basic protections. Safeguards Workshop,
supra note 10, Tr. at 118–19 (July 13, 2020), https://
www.ftc.gov/system/files/documents/public_events/
1567141/transcript-glb-safeguards-workshopfull.pdf.
29 See Bank Policy Institute (comment 39, NPRM),
https://www.regulations.gov/comment/FTC-20190019-0039; Money Services Round Table (comment
53, NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0053.
30 See Consumer Data Industry Association
(comment 36, NPRM) at 7–8, https://
www.regulations.gov/comment/FTC-2019-0019-
E:\FR\FM\09DER3.SGM
Continued
09DER3
70314
Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations
one commenter noted, ‘‘[e]ven today’s best
practices will be overtaken by future changes
in both technology and the capabilities of
threat actors,’’ 31 and these proscriptive rules
lose the ‘‘self-modernizing’’ nature of flexible
requirements,32 locking in place the primacy
of current practices.33
The reduction in flexibility and imposition
of these costs must be justified by a
significant reduction in risk or some other
substantial consumer benefit. But the record
provides scant support for these tradeoffs. Or
as one commenter put it:
[A]s with many of these requirements, we
do not take issue with the notion that there
is merit to this step [requiring monitoring],
and that many financial institutions will
implement some version of this control.
However, by making this an explicit, standalone requirement, the Commission is
enshrining costs and efforts that will be
khammond on DSKJM1Z7X2PROD with RULES3
0036 (minimization requirement can impact
innovative uses more broadly).
31 See Cisco Systems Inc. (comment 51, NPRM) at
3, https://www.regulations.gov/comment/FTC-20190019-0051 (noting also in the context of multi-factor
authentication that there will come a time when it
is no longer the ‘‘appropriate baseline’’ and
‘‘covered entities could find themselves in full
compliance with the rule as long as they use access
control technology no less protective than MFA as
defined in the Proposed Amendments.’’).
32 National Automobile Dealers Association
(comment 46, NPRM), https://www.regulations.gov/
comment/FTC-2019-0019-0046.
33 See CTIA (comment 34, NPRM) at 3–5, https://
www.regulations.gov/comment/FTC-2019-00190034 (flexibility in the rule allowed it to keep up
with evolving threats, whereas new rule could limit
innovation); HITRUST Alliance (comment 18,
NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0018 (expressing concern about
creating outdated requirements); The American
Financial Services Association (comment 41,
NPRM), https://www.regulations.gov/comment/
FTC-2019-0019-0041.
VerDate Sep<11>2014
18:18 Dec 08, 2021
Jkt 256001
extensive and will likely not be needed in all
circumstances.34
The Rules Involve the FTC in the Internal
Governance Decisions of Covered Firms
The specifics of the proposals also raise
issues, as we expressed in 2019, with regard
to mandating the appropriate level of board
engagement,35 hiring and training
requirements,36 and program accountability
structures.37 We wrote then, and remain
concerned now, that the Commission is
substituting its own judgement about
governance decisions for those of private
companies covered by this Rule.
In certain extraordinary cases involving
clear evidence of management failure, we
have imposed prescriptive governance
obligations on respondents.38 Those rare and
34 National Automobile Dealers Association
(comment 46, NPRM) https://www.regulations.gov/
comment/FTC-2019-0019-0046 (arguing that the
Commission needs additional study into the costs
and benefits); See also Consumer Data Industry
Association (comment 36, NPRM), https://
www.regulations.gov/comment/FTC-2019-00190036 (benefits of new rule not justified by
tradeoffs).
35 American Council on Education (comment 24,
NPRM) at 16, https://www.regulations.gov/
comment/FTC-2019-0019-0024; National
Automobile Dealers Association (comment 46,
NPRM) at 41, https://www.regulations.gov/
comment/FTC-2019-0019-0046.
36 U.S. Chamber of Commerce (comment 33,
NPRM) at 12, https://www.regulations.gov/
comment/FTC-2019-0019-0033; National
Automobile Dealers Association (comment 46,
NPRM) at 34–36, https://www.regulations.gov/
comment/FTC-2019-0019-0046.
37 See Final Rule. See also American Council on
Education (comment 24, NPRM) at 14, https://
www.regulations.gov/comment/FTC-2019-00190024 (critiquing the intrusion on personnel
practices).
38 U.S. v. Facebook, Inc., Civ. Action No. 19–cv–
2184 (D.D.C. July 24, 2019), https://www.ftc.gov/
PO 00000
Frm 00044
Fmt 4701
Sfmt 9990
egregious instances cannot justify a similar
approach in a broad rulemaking absent a real
record of widespread corporate
mismanagement or failure at the senior
management level.
The Commission has elected to proceed
with most of these governance requirements,
forcing the hand of management and shifting
their priorities to avoid the risk of regulatory
action,39 without clear evidence of their need
or efficacy.
Conclusion
Regularly reviewing our rules to ensure
that they address the current environment is
an important part of the FTC’s regular
process. But rules have far-reaching and
frequently unintended impacts in the real
world; when imposing additional legal
obligations in the rulemaking context, we
must do so with great care. The amended
Safeguards Rule replaces a rule that has
worked well for 20 years, a rule that took a
principle-based approach in order to provide
financial institutions flexibility to determine
the appropriate and realistic security
safeguards for their organizations. The record
before us at best fails to convince that the
changes are necessary and at worst raises
concern about the substantial costs and risks
in imposing these amendments. Accordingly,
we dissent.
[FR Doc. 2021–25736 Filed 12–8–21; 8:45 am]
BILLING CODE 6750–01–P
enforcement/cases-proceedings/092-3184/facebookinc.
39 These governance rules may not even promote
security. See Consumer Data Industry Association
(comment 36, NPRM), https://www.regulations.gov/
comment/FTC-2019-0019-0036 (arguing that the
annual reporting will become a checkbox exercise).
E:\FR\FM\09DER3.SGM
09DER3
]]>Agencies
[Federal Register Volume 86, Number 234 (Thursday, December 9, 2021)]
[Rules and Regulations]
[Pages 70272-70314]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-25736]
[[Page 70271]]
Vol. 86
Thursday,
No. 234
December 9, 2021
Part III
Federal Trade Commission
-----------------------------------------------------------------------
16 CFR Part 314
Standards for Safeguarding Customer Information; Final Rule
Federal Register / Vol. 86 , No. 234 / Thursday, December 9, 2021 /
Rules and Regulations
[[Page 70272]]
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 314
RIN 3084-AB35
Standards for Safeguarding Customer Information
AGENCY: Federal Trade Commission.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is
issuing a final rule (``Final Rule'') to amend the Standards for
Safeguarding Customer Information (``Safeguards Rule'' or ``Rule'').
The Final Rule contains five main modifications to the existing Rule.
First, it adds provisions designed to provide covered financial
institutions with more guidance on how to develop and implement
specific aspects of an overall information security program, such as
access controls, authentication, and encryption. Second, it adds
provisions designed to improve the accountability of financial
institutions' information security programs, such as by requiring
periodic reports to boards of directors or governing bodies. Third, it
exempts financial institutions that collect less customer information
from certain requirements. Fourth, it expands the definition of
``financial institution'' to include entities engaged in activities the
Federal Reserve Board determines to be incidental to financial
activities. This change adds ``finders''--companies that bring together
buyers and sellers of a product or service--within the scope of the
Rule. Finally, the Final Rule defines several terms and provides
related examples in the Rule itself rather than incorporates them from
the Privacy of Consumer Financial Information Rule (``Privacy Rule'').
DATES:
Effective date: This rule is effective January 10, 2022.
Applicability date: The provisions set forth in Sec. 314.5 are
applicable beginning December 9, 2022.
FOR FURTHER INFORMATION CONTACT: David Lincicum (202-326-2773),
Katherine McCarron (202-326-2333), or Robin Wetherill (202-326-2220),
Division of Privacy and Identity Protection, Bureau of Consumer
Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW,
Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
I. Background
Congress enacted the Gramm Leach Bliley Act (``GLB'' or ``GLBA'')
in 1999.\1\ The GLBA provides a framework for regulating the privacy
and data security practices of a broad range of financial institutions.
Among other things, the GLBA requires financial institutions to provide
customers with information about the institutions' privacy practices
and about their opt-out rights, and to implement security safeguards
for customer information.
---------------------------------------------------------------------------
\1\ Pubic Law 106-102, 113 Stat. 1338 (1999).
---------------------------------------------------------------------------
Subtitle A of Title V of the GLBA required the Commission and other
Federal agencies to establish standards for financial institutions
relating to administrative, technical, and physical safeguards for
certain information.\2\ Pursuant to the Act's directive, the Commission
promulgated the Safeguards Rule (16 CFR part 314) in 2002. The
Safeguards Rule became effective on May 23, 2003.
---------------------------------------------------------------------------
\2\ See 15 U.S.C. 6801(b), 15 U.S.C. 6805(b)(2).
---------------------------------------------------------------------------
The current Safeguards Rule requires a financial institution to
develop, implement, and maintain a comprehensive information security
program that consists of the administrative, technical, and physical
safeguards the financial institution uses to access, collect,
distribute, process, protect, store, use, transmit, dispose of, or
otherwise handle customer information.\3\ The information security
program must be written in one or more readily accessible parts.\4\ The
safeguards set forth in the program must be appropriate to the size and
complexity of the financial institution, the nature and scope of its
activities, and the sensitivity of any customer information at
issue.\5\ The safeguards must also be reasonably designed to ensure the
security and confidentiality of customer information, protect against
any anticipated threats or hazards to the security or integrity of the
information, and protect against unauthorized access to or use of such
information that could result in substantial harm or inconvenience to
any customer.\6\
---------------------------------------------------------------------------
\3\ 16 CFR 314.2(c).
\4\ 16 CFR 314.3(a).
\5\ 16 CFR 314.3(a), (b).
\6\ 16 CFR 314.3(a), (b).
---------------------------------------------------------------------------
In order to develop, implement, and maintain its information
security program, a financial institution must identify reasonably
foreseeable internal and external risks to the security,
confidentiality, and integrity of customer information that could
result in the unauthorized disclosure, misuse, alteration, destruction,
or other compromise of such information.\7\ The financial institution
must then design and implement safeguards to control the risks
identified through the risk assessment, and must regularly test or
otherwise monitor the effectiveness of the safeguards' key controls,
systems, and procedures.\8\ The Rule also requires the financial
institution to evaluate and adjust its information security program in
light of the results of this testing and monitoring, any material
changes in its operations or business arrangements, or any other
circumstances it knows or has reason to know may have a material impact
on its information security program.\9\ The financial institution must
also designate an employee or employees to coordinate the information
security program.\10\
---------------------------------------------------------------------------
\7\ 16 CFR 314.4(b).
\8\ 16 CFR 314.4(c).
\9\ 16 CFR 314.4(e).
\10\ 16 CFR 314.4(a).
---------------------------------------------------------------------------
Finally, the current Safeguards Rule requires financial
institutions to take reasonable steps to select and retain service
providers capable of maintaining appropriate safeguards for customer
information and require those service providers by contract to
implement and maintain such safeguards.\11\
---------------------------------------------------------------------------
\11\ 16 CFR 314.4(d).
---------------------------------------------------------------------------
II. Regulatory Review of the Safeguards Rule
On September 7, 2016, the Commission solicited comments on the
Safeguards Rule as part of its periodic review of its rules and
guides.\12\ The Commission sought comment on a number of general
issues, including the economic impact and benefits of the Rule;
possible conflicts between the Rule and state, local, or other Federal
laws or regulations; and the effect on the Rule of any technological,
economic, or other industry changes. The Commission received 28
comments from individuals and entities representing a wide range of
viewpoints.\13\ Most commenters agreed there is a continuing need for
the Rule and it benefits consumers and competition.\14\
---------------------------------------------------------------------------
\12\ Safeguards Rule, Request for Comment, 81 FR 61632 (Sept. 7,
2016).
\13\ The 28 public comments received prior to March 15, 2019,
are posted at: https://www.ftc.gov/policy/public-comments/initiative-674.
\14\ See, e.g., Mortgage Bankers Association (comment 39, NPRM);
National Automobile Dealers Association (Comment 40, NPRM); Data &
Marketing Association (comment 38, NPRM); Electronic Transactions
Association (comment 24, NPRM); State Privacy & Security Coalition
(comment 26, NPRM).
---------------------------------------------------------------------------
On April 4, 2019, the Commission issued a notice of proposed
rulemaking (NPRM) setting forth proposed amendments to the Safeguards
Rule (the ``Proposed Rule'').\15\ In response, the Commission received
49 comments from various interested parties
[[Page 70273]]
including industry groups, consumer groups, and individual
consumers.\16\ On July 13, 2020, the Commission held a workshop
concerning the proposed changes and conducted panels with information
security experts discussing subjects related to the Proposed Rule.\17\
The Commission received 11 comments following the workshop.\18\ After
reviewing the initial comments to the Proposed Rule, conducting the
workshop, and then reviewing the comments received following the
workshop, the Commission now issues final amendments to the Safeguards
Rule.
---------------------------------------------------------------------------
\15\ FTC Notice of Proposed Rulemaking, 84 FR 13158 (April 4,
2019).
\16\ The 49 relevant public comments received on or after March
15, 2019, can be found at Regulations.gov. See FTC Seeks Comment on
Proposed Amendments to Safeguards and Privacy Rules, 16 CFR part
314, Project No. P145407, https://www.regulations.gov/docket/FTC-2019-0019/document.
\17\ See FTC, Information Security and Financial Institutions:
An FTC Workshop to Examine Safeguards Rule Tr. (July 13, 2020),
https://www.ftc.gov/system/files/documents/public_events/1567141/transcript-glb-safeguards-workshop-full.pdf [hereinafter Safeguards
Workshop Tr.].
\18\ The 11 relevant public comments relating to the subject
matter of the July 13, 2020, workshop can be found at https://www.regulations.gov/document/FTC-2020-0038-0001. This document cites
comments using the last name of the individual submitter or the name
of the organization, followed by the number based on the last two
digits of the comment ID number.
---------------------------------------------------------------------------
III. Overview of Final Rule
As noted above, the Final Rule modifies the current Rule in five
primary ways. First, the Final Rule amends the current Rule to include
more detailed requirements for the development and establishment of the
information security program required under the Rule. For example,
while the current Rule requires financial institutions to undertake a
risk assessment and develop and implement safeguards to address the
identified risks, the Final Rule sets forth specific criteria for what
the risk assessment must include, and requires the risk assessment be
set forth in writing. As to particular safeguards, the Final Rule
requires that they address access controls, data inventory and
classification, encryption, secure development practices,
authentication, information disposal procedures, change management,
testing, and incident response. And while the Final Rule retains the
requirement from the current Rule that financial institutions provide
employee training and appropriate oversight of service providers, it
adds mechanisms designed to ensure such training and oversight are
effective. Although the Final Rule has more specific requirements than
the current Rule, it still provides financial institutions the
flexibility to design an information security program appropriate to
the size and complexity of the financial institution, the nature and
scope of its activities, and the sensitivity of any customer
information at issue.
Second, the Final Rule adds requirements designed to improve
accountability of financial institutions' information security
programs. For example, while the current Rule allows a financial
institution to designate one or more employees to be responsible for
the information security program, the Final Rule requires the
designation of a single Qualified Individual. The Final Rule also
requires periodic reports to boards of directors or governing bodies,
which will provide senior management with better awareness of their
financial institutions' information security programs, making it more
likely the programs will receive the required resources and be able to
protect consumer information.
Third, recognizing the impact of the additional requirements on
small businesses, the Final Rule exempts financial institutions that
collect information on fewer than 5,000 consumers from the requirements
of a written risk assessment, incident response plan, and annual
reporting to the Board of Directors.
Fourth, the Final Rule expands the definition of ``financial
institution'' to include entities engaged in activities the Federal
Reserve Board determines to be incidental to financial activities. This
change brings ``finders''--companies that bring together buyers and
sellers of a product or service--within the scope of the Rule. Finders
often collect and maintain very sensitive consumer financial
information, and this change will require them to comply with the
Safeguards Rule's requirements to protect that information. This change
will also bring the Rule into harmony with other Federal agencies'
Safeguards Rules, which include activities incidental to financial
activities in their definition of financial institution.
Finally, the Final Rule includes several definitions and related
examples, including of ``financial institution,'' in the Rule itself
rather than incorporate them from a related FTC rule, the Privacy of
Consumer Financial Information Rule, 16 CFR part 313. This will make
the rule more self-contained and will allow readers to understand its
requirements without referencing the Privacy Rule.
IV. Section-by-Section Analysis
General Comments
The Commission received 49 comments in response to the NPRM for the
Proposed Rule, from a diverse set of stakeholders, including industry
groups, individual businesses, consumer advocacy groups, academics,
information security experts, government agencies, and individual
consumers. It also hosted a workshop on the Proposed Rule, which
included approximately 20 security experts. Some of the comments simply
expressed general support \19\ or general disapproval \20\ of the
Proposed Rule. Many, however, offered detailed responses to specific
proposals in the NPRM. In general, industry groups were opposed to most
or all of the Proposed Rule, and consumer advocacy groups, academics,
and security experts were generally in favor of the amendments. The
comments and workshop record are discussed in the following Section-by-
Section analysis.
---------------------------------------------------------------------------
\19\ See Encore Capital Group (comment 25, NPRM); Justine
Bykowski (comment 12, NPRM); ``Peggy from Bloomington, MN'' (comment
13, NPRM); ``Anonymous'' (comment 20, NPRM).
\20\ ``Jane Q. Citizen'' (comment 14, NPRM).
---------------------------------------------------------------------------
Sec. 314.1: Purpose and Scope
The Purpose and Scope section of the current Rule generally states
the Rule implements the Gramm-Leach-Bliley Act and applies to the
handling of customer information by financial institutions over which
the FTC has jurisdiction. In its NPRM, the Commission proposed adding a
definition of ``financial institution'' modeled on the definition
included in the Commission's Privacy Rule (16 CFR part 313) and a
series of examples providing guidance on what constitutes a financial
institution under the Commission's jurisdiction. Other than expanding
the definition of ``financial institution'' as discussed below, the new
language was not meant to reflect a substantive change to the
Safeguards Rule; rather, it was meant to allow the Rule to be read on
its own, without reference to the Privacy Rule.\21\ The Commission
received no comments that addressed this section specifically, and
[[Page 70274]]
the Commission adopts the language of the Proposed Rule in the Final
Rule.\22\
---------------------------------------------------------------------------
\21\ In a separate final rule, published elsewhere in this issue
of the Federal Register, the Commission is amending the Privacy Rule
to reflect changes made by the Dodd-Frank Act, limiting that rule to
certain auto dealers. Through that proceeding, the Commission is
also removing examples of financial institutions from the Privacy
Rule that are no longer covered under the rule in the wake of these
changes.
\22\ Several commenters addressed the change to the definition
of ``financial institution.'' Those comments are addressed in the
discussion of the definition of ``financial institution'' below.
---------------------------------------------------------------------------
Sec. 314.2: Definitions
The Proposed Rule added a number of definitions to Sec. 314.2. The
Proposed Rule also retained paragraph (a), which states terms used in
the Safeguards Rule have the same meaning as set forth in the Privacy
Rule.
The American Council on Education (ACE) suggested all terms from
the Privacy Rule, such as ``consumer,'' ``customer,'' and ``customer
information,'' be included in the Final Rule in order to make the Final
Rule easier for regulated entities to understand.\23\ On the other
hand, HITRUST recommended no definitions from the Privacy Rule be
duplicated in the Safeguards Rule, reasoning that in the event of a
need to amend the terms, it would require the amendment of two rules
rather than one.\24\
---------------------------------------------------------------------------
\23\ American Council on Education (comment 24, NPRM), at 7.
\24\ HITRUST, (comment 18, NPRM), at 2.
---------------------------------------------------------------------------
The Commission is persuaded including all terms from the Privacy
Rule within the Safeguards Rule will improve clarity and ease of use.
Accordingly, the Commission has determined to delete paragraph (a),
since it is no longer necessary to state all terms in the Safeguards
Rule have the same meaning as in the Privacy Rule. It also adds the
Privacy Rule definitions of ``consumer,'' ``customer,'' ``customer
relationship,'' ``financial product or service,'' ``nonpublic personal
information,'' ``personally identifiable financial information,''
``publicly available information,'' and ``you'' to the definitions in
the Final Rule. No substantive change to these definitions is intended.
Authorized User
The Proposed Rule added a definition for the term ``authorized
user'' as paragraph (b). Proposed paragraph (b) defined an authorized
user of an information system as any employee, contractor, agent or
other person that participates in your business operations and is
authorized to access and use any of your information systems and data.
This term was used in Sec. 314.4(c)(10) of the Proposed Rule, which
required financial institutions to implement policies to monitor the
activity of ``authorized users'' and detect unauthorized access to
customer information.
The Commission received one comment on this proposed definition
from the National Automobile Dealers Association (NADA), which
suggested the term ``authorized user'' was used inconsistently and was
too vague.\25\ NADA pointed out while ``authorized user'' is a defined
term, the term ``authorized individual'' was used in proposed Sec.
313.4(c)(1) (addressing access controls for information systems) and
(c)(3) (addressing access controls for physical data). NADA also argued
the inclusion of ``other person that participates in the business
operations of an entity'' within the definition of ``authorized user''
was unclear and created ambiguity in its application.\26\
---------------------------------------------------------------------------
\25\ National Automobile Dealers Association (comment 46, NPRM),
at 11-12.
\26\ National Automobile Dealers Association (comment 46, NPRM),
at 11-12.
---------------------------------------------------------------------------
The Commission agrees with NADA's points, and, in response,
modifies the Final Rule in two ways. First, the Final Rule replaces the
term ``authorized individual'' with ``authorized user'' in Sec.
313.4(c)(1). As described further below, because the Final Rule
combines Sec. 313.4(c)(3) with Sec. 313.4(c)(1), there is no need to
make a corresponding change to that section.
Second, because the Commission agrees the ambiguities in the
definition of ``authorized user'' from the Proposed Rule could create
confusion, it makes several changes to the definition. It deletes the
phrase ``other person that participates in the business operations of
an entity.'' The Commission agrees this phrase was vague. The
Commission had intended it to cover any person the financial
institution allows to access information systems or data, including,
for example, ``customers'' of the financial institutions. For the
purpose of controlling authorized access and detecting unauthorized
access (which is where the definition of ``authorized user'' appears),
financial institutions should monitor anomalous patterns of usage of
their systems, not only by employees and agents, but also by customers
and other persons authorized to access systems or data. To clarify this
point, the Commission adds ``customer or other person'' to the
definition of ``authorized users.''
The Commission intends that the definition of ``authorized users''
should include anyone who the financial institution authorizes to
access an information system or data, regardless of whether that user
actually uses the data. Thus, for clarity, the Commission has deleted
the requirement that the authorized user be authorized to use the
information system or data. Finally, the definition of authorized user
should include users who can access both ``information systems and
data'' and users authorized to access either information systems or
data. Accordingly, for clarification purposes, the Commission modifies
the definition of authorized user in the Final Rule as any employee,
contractor, agent, customer or other person that is authorized to
access any of your information systems or data.
Security Event
In proposed paragraph (c), the Commission defined security event as
an event resulting in unauthorized access to, or disruption or misuse
of, an information system or information stored on such information
system. This term was used in provisions requiring financial
institutions to establish a written incident response plan designed to
respond to security events. It also appeared in the provision requiring
the coordinator of a financial institution's information security
program to provide an annual report to the financial institution's
governing body; the required report must identify all security events
that took place that year.
Commenters expressed three main concerns with this definition. The
first relates to whether the term ``security event'' should be expanded
to instances in which there is unauthorized access to, or disruption or
misuse of, information in physical form, as opposed to electronic form.
The Proposed Rule used the term ``security event'' instead of
``cybersecurity event'' to clarify that an information security program
encompasses information in both digital and physical forms and that
unauthorized access to paper files, for example, would also be a
security event under the Rule. The Money Services Round Table (MSRT),
however, noted despite the use of the more general ``security'' in the
defined term, the definition itself is limited to events involving
information systems.\27\ The Commission agrees this creates a
contradiction. Accordingly, the Final Rule includes the compromise of
customer information in physical form in the definition of ``security
event.''
---------------------------------------------------------------------------
\27\ Money Services Round Table (comment 53, NPRM), at 5 n.14.
---------------------------------------------------------------------------
Second, some industry groups argued a ``security event'' should
occur only when there is ``unauthorized access'' to an information
system, not in cases in which there has been a ``disruption or misuse''
of such systems (e.g., a ransomware attack).\28\ These
[[Page 70275]]
commenters argued the disruption or misuse of information systems is
not directly related to the protection of customer information and is,
therefore, outside the Commission's statutory authority.\29\ The
Commission disagrees. Requiring a financial institution to protect
against disruption and misuse of its information system is within the
Commission's authority under the GLBA, which directed the Commission to
promulgate a rule that required financial institutions to ``to protect
against any anticipated threats or hazards to the security or
integrity'' of customer information. A disruption or misuse of an
information system will be, in many cases, a threat to the
``integrity'' of customer information. In addition, disruption or
misuse may also indicate the existence of a security weakness that
could be exploited to gain unauthorized access to customer information.
For example, an event in which ransomware placed on a system is used to
encrypt customer information, rendering it useless, raises the
possibility similar software could have been used to exfiltrate
customer information. Accordingly, the Final Rule retains the inclusion
of ``misuse or disruption'' within the definition of ``security
event.''
---------------------------------------------------------------------------
\28\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 4; National Automobile Dealers Association
(comment 46, NPRM), at 12-13; Consumer Data Industry Association
(comment 36, NPRM), at 3-4.
\29\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 4; National Automobile Dealers Association
(comment 46, NPRM), at 12-13.
---------------------------------------------------------------------------
Third, several commenters suggested the definition of ``security
event'' be limited to events in which there is a risk of consumer harm
or some other negative effect.\30\ Similarly, some commenters argued
the definition should exclude events that involve encrypted information
in which the encryption key was not compromised or when there is
evidence the information accessed has not been misused.\31\ The
Commission declines to narrow the provision in this manner. It believes
a financial institution should still engage in its incident response
procedures to determine whether the event indicates a weakness that
could endanger customer information and to respond accordingly. The
financial institution can then take the appropriate steps in response.
Further, Sec. 314.4(h) of the Final Rule, which sets forth the
requirement for an incident response plan, requires the incident
response plan be designed to respond only to security events
``materially affecting the confidentiality, integrity, or availability
of customer information,'' limiting the impact of the definition of
``security event.''
---------------------------------------------------------------------------
\30\ HITRUST (comment 18, NPRM), at 3; American Council on
Education (comment 24, NPRM), at 7; Mortgage Bankers Association
(comment 26, NPRM), at 4-5; Consumer Data Industry Association
(comment 36, NPRM), at 3-4; National Automobile Dealers Association
(comment 46, NPRM), at 12-13; National Independent Automobile
Dealers Association (comment 48, NPRM), at 4.
\31\ Mortgage Bankers Association (comment 48, NPRM), at 4-5;
National Automobile Dealers Association (comment 46, NPRM), at 12-
13; National Independent Automobile Dealers Association (comment 48,
NPRM) at 4; American Council on Education (comment 24, NPRM), at 7.
---------------------------------------------------------------------------
Accordingly, the Final Rule defines security event as an event
resulting in unauthorized access to, or disruption or misuse of, an
information system, information stored on such information system, or
customer information held in physical form. The Proposed Rule placed
this definition as paragraph (c), out of alphabetical order. The Final
Rule adopts it as paragraph (p), placing it in alphabetical order with
the other definitions in Sec. 314.2.
Encryption
Proposed paragraph (e) defined encryption as the transformation of
data into a form that results in a low probability of assigning meaning
without the use of a protective process or key. This term was used in
proposed Sec. 314.4(c)(4), which generally required financial
institutions to encrypt customer information. This definition was
intended to define the process of encryption while not requiring any
particular technology or technique for achieving the protection
provided by encryption.
NADA argued this definition should be made more flexible by adding
an alternative so it would read ``the transformation of data into a
form that results in a low probability of assigning meaning without the
use of a protective process or key or securing information by another
method that renders the data elements unreadable or unusable''
(emphasis added).\32\ On the other hand, others argued the Proposed
Rule's definition did not sufficiently protect customer
information.\33\ For example, the Princeton University Center for
Information Technology Policy (``Princeton Center'') suggested the Rule
should be changed ``to clarify that encryption must be consistent with
current cryptographic standards and accompanied by appropriate
safeguards for cryptographic key material.'' \34\ Similarly, ACE argued
the definition should include ``the transformation of data in
accordance with industry standards.'' \35\
---------------------------------------------------------------------------
\32\ National Automobile Dealers Association (comment 46, NPRM),
at 13.
\33\ American Council on Education (comment 24, NPRM), at 7;
Princeton University Center for Information Technology Policy
(comment 54, NPRM), at 4.
\34\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 4.
\35\ American Council on Education (comment 24, NPRM), at 7.
---------------------------------------------------------------------------
The Commission agrees the proposed definition should be tethered to
some technical standard, without being too prescriptive about what that
standard is. Under the proposed definition, as well as NADA's proposed
definition, financial institutions could have claimed they were
``encrypting'' data if they were aggregating it, scrambling it, or
redacting it in a way that made it possible to re-identify the data
through, for example, the application of common algorithms or programs.
The Commission does not believe this would have provided consumers with
sufficient protection. The Commission also agrees with the commenters
who stated the definition should signal that encryption should be
cryptographically based.
Accordingly, the Final Rule defines encryption as the
transformation of data into a form that results in a low probability of
assigning meaning without the use of a protective process or key,
consistent with current cryptographic standards and accompanied by
appropriate safeguards for cryptographic key material. This definition
does not require any specific process or technology to perform the
encryption but does require that whatever process is used be
sufficiently robust to prevent the deciphering of the information in
most circumstances.
Financial Institution
Incidental Activity
The Proposed Rule made one substantive change to the definition of
``financial institution'' it incorporated from the Privacy Rule. The
change was designed to include entities ``significantly engaged in
activities that are incidental to [] financial activity'' as defined by
the Bank Holding Company Act. This proposed change brought only one
activity into the definition that was not covered before: the act of
``finding'' as defined in 12 CFR 225.86(d)(1). The proposed revision to
paragraph (f) added an example of a financial institution acting as a
finder by ``bringing together one or more buyers and sellers of any
product or service for transactions that the parties themselves
negotiate and consummate.'' This example used the language set forth in
12 CFR 225.86(d)(1), which defines ``finding'' as an activity
incidental to a financial activity under the Bank Holding Company Act.
The Commission
[[Page 70276]]
adopts this proposal without modification.
The change to the definition of ``financial institution'' brings it
into harmony with other agencies' GLB rules.\36\ The change is
supported by the language of the Gramm-Leach-Bliley Act.\37\ The Act
defines a ``financial institution'' as any institution ``the business
of which is engaging in financial activities as described in section
1843(k) of title 12.'' \38\ That section, in turn, describes activities
that are financial in nature as those the Board has determined ``to be
financial in nature or incidental to such financial activity.'' \39\
The Final Rule's definition mirrors this language. The change will not
lead to a significant expansion of the Rule coverage as it expands the
definition only to include entities engaged in activity incidental to
financial activity, as determined by the Federal Reserve Board. The
Board has determined only one activity to be incidental to financial
activity--``acting as a finder.'' \40\
---------------------------------------------------------------------------
\36\ See 12 CFR 1016.3(l) (defining ``financial institution''
for entities regulated by agencies other than the FTC). See also 17
CFR 248.3(n) (defining ``financial institution'' to include ``any
institution the business of which is . . . incidental to . . .
financial activities'' for Security and Exchange Commission's rule
implementing GLBA's safeguard provisions.).
\37\ 15 U.S.C. 6801 et seq.
\38\ 15 U.S.C. 6809(3).
\39\ 12 U.S.C. 1843(k).
\40\ 12 CFR 225.86.
---------------------------------------------------------------------------
Several commenters who addressed this issue supported the inclusion
of activities incidental to financial activities.\41\ Other commenters
expressed concern the proposed change in the definition would expand
the Rule's coverage to businesses that should not be considered
financial institutions.\42\ They argued the definition of the term
``finder'' is too broad and companies that connect buyers and sellers
in non-financial contexts would be swept inappropriately into the
definition of ``financial institution.'' The Association of National
Advertisers argued advertising agencies could be considered ``finders''
because they play a role in connecting buyers and sellers.\43\
---------------------------------------------------------------------------
\41\ Electronic Privacy Information Center (comment 55, NPRM),
at 9; Independent Community Bankers of America (comment 35, NPRM),
at 3; National Automobile Dealers Association (comment 46, NPRM), at
13-16.
\42\ Association of National Advertisers (comment, Workshop), at
4-5; internet Association (comment, Workshop), at 4-5; see also
Anonymous (comment 15, NPRM) (questioning whether any governing body
would oversee any future determinations by the Federal Reserve Board
that activities are incidental to financial activity).
\43\ Association of National Advertisers (comment 5, Workshop),
at 5.
---------------------------------------------------------------------------
In response, the Commission notes the Federal Reserve Board
describes acting as a finder as ``bringing together one or more buyers
and sellers of any product or service for transactions that the parties
themselves negotiate and consummate.'' \44\ The Board sets forth
several activities within the scope of acting as a finder, such as
``[i]dentifying potential parties, making inquiries as to interest,
introducing and referring potential parties to each other, [] arranging
contacts between and meetings of interested parties'' and ``[c]onveying
between interested parties expressions of interest, bids, offers,
orders and confirmations relating to a transaction.'' \45\
---------------------------------------------------------------------------
\44\ 12 CFR 225.86 (d).
\45\ 12 CFR 225.86 (d)(1)(i).
---------------------------------------------------------------------------
Although this language is somewhat broad, its scope is
significantly limited in the context of the Safeguards Rule. First, the
Safeguards Rule applies only to transactions ``for personal, family, or
household purposes.'' \46\ Therefore, only finding services involving
consumer transactions will be covered. Second, the Safeguards Rule
applies only to the information of customers, which are consumers with
which a financial institution has a continuing relationship.\47\
Therefore, it will not apply to finders that have only isolated
interactions with consumers and do not receive information from other
financial institutions about those institutions' customers. This
significantly narrows the types of finders that will have obligations
under the Rule, excluding, the Commission believes, most advertising
agencies and similar businesses that generally do not have continuing
relationships with consumers who are using their services for personal
or household purposes.
---------------------------------------------------------------------------
\46\ See Final Rule 16 CFR 314.2(b)(1).
\47\ 16 CFR 314.1; Final Rule 16 CFR 314.2(c).
---------------------------------------------------------------------------
The Commission believes entities that perform finding services for
consumers with whom they have an ongoing relationship are properly
considered ``financial institutions'' for purposes of the Rule.
Accordingly, the Commission adopts the changes to the definition of
``financial institution'' as proposed.
Other Changes to Definition of ``Financial Institutions''
Other commenters suggested modifying the definition of ``financial
institution'' \48\ in different ways. The Electronic Privacy
Information Center (EPIC) argued the definition should be expanded by
treating more activities as financial activities.\49\ EPIC pointed out
information shared with social media companies, retailers, apps, and
devices generally is not covered under the Safeguards Rule. The
Commission understands the concern that many businesses fall outside
the coverage of the Safeguards Rule, despite handling sensitive
consumer information, but the Commission's authority to regulate
activity under the Safeguards and Privacy Rules is established by the
GLBA. The Rule's application is limited to financial institutions as
defined by that statute and cannot be extended beyond that
definition.\50\ The institutions discussed by EPIC, however, are still
covered by the FTC Act's prohibition against deceptive or unfair
conduct, including with respect to their use and protection of consumer
information.\51\
---------------------------------------------------------------------------
\48\ National Pawnbrokers Association (comment 32, NPRM), at 5-6
(arguing that transaction-reporting vendors be included in
definition); National Consumer Law Center and others (comment 58,
NPRM), at 5 (arguing that consumer reporting agencies be included
explicitly in the definition); see also American Escrow Association
(comment, Workshop), at 2-3 (requesting that the Rule specifically
set out the duties of real estate settlement operations and other
businesses that handle but do not maintain sensitive information);
Beverly Enterprises, LLC (comment 3, NPRM), at 3-4 (requesting that
the Rule specifically set out duties related to online
notarizations); Yangxue Li (comment 5, NPRM) (asking whether Rule
would set forth specific guidelines for different industries);
Slobadon Raybolka (comment 17, NPRM) (suggesting that companies that
perform online background checks be covered by the rule); The
Clearing House (comment 49, NPRM) (suggesting a separate set of more
stringent rules for fintech companies).
\49\ Electronic Privacy Information Center (comment 55, NPRM),
at 9.
\50\ See 15 U.S.C. 6801 (requiring agencies to promulgate Rule
establishing standards for financial institutions); 15 U.S.C.
6809(3) (defining ``financial institutions'' as an ``institution the
business of which is engaging in financial activities as described''
in the Bank Holding Company Act).
\51\ In the Matter of Facebook, Inc., Docket No. C-4365 (Apr.
28, 2020); FTC v. Wyndham Worldwide Corporation, 799 F.3d 236 (3d
Cir. 2015); FTC v. D-Link Systems, Inc., Case No. 3:17-cv-00039-JD
(N.D. Cal. July 2, 2019); In the Matter of Twitter, Inc., Docket No.
C-4316 (Mar. 11, 2011).
---------------------------------------------------------------------------
The National Federation of Independent Business (NFIB) argued
individuals and sole proprietors should be excluded from the definition
of ``financial institution'' because an individual cannot be an
``institution.'' \52\ When the Privacy Rule was promulgated in 2000,
commenters also suggested the definition should exclude sole
proprietors.\53\ The Commission noted there was no basis to exclude
sole proprietors and ``[w]hether or not a
[[Page 70277]]
commercial enterprise is operated by a single individual is not
determinative'' of whether the enterprise is a financial institution.
The Commission has not changed its position on this matter and declines
to make this change to the definition of ``financial institution.''
---------------------------------------------------------------------------
\52\ National Federation of Independent Business (comment 16,
NPRM), at 2-3.
\53\ Privacy Rule, Final Rule, 65 FR 33645 (May 24, 2000) at
33656.
---------------------------------------------------------------------------
The Final Rule adopts this definition as proposed without change.
Information Security Program
Paragraph (i) of the Final Rule adopts the existing Rule's
paragraph (c) and does not alter the definition of ``information
security program.'' The Commission received no comments on this
definition, and accordingly, adopts the current definition in the Final
Rule.
Information System
Proposed paragraph (h) defined information system as a discrete set
of electronic information resources organized for the collection,
processing, maintenance, use, sharing, dissemination or disposition of
electronic information, as well as any specialized system such as
industrial/process controls systems, telephone switching and private
branch exchange systems, and environmental control systems. The term
``information system'' was used throughout the proposed amendments to
designate the systems that must be covered by the information security
program.
The MSRT suggested this definition was too narrow in some respects
and too broad in others.\54\ It argued the definition of ``information
system'' was too narrow because it did not include physical systems or
employees and would exclude them from some of the provisions of the
Rule. Specifically, the MSRT argued that based on this definition, the
penetration tests required by Sec. 314.4(d)(2) would not be required
to test ``potential human vulnerabilities'' such as social engineering
or phishing.\55\ The Commission does not agree. Penetration testing, as
defined by the Final Rule, is a process through which testers ``attempt
to circumvent or defeat the security features of an information
system.'' \56\ One way such security features are tested is through
social engineering and phishing.\57\ The fact that the testing involves
employees with access to the information system, rather than just the
system itself, does not exclude such tests from the definition of
``penetration testing.'' Attempted social engineering and phishing are
important parts of testing the security of information systems and
would not be excluded by this definition.
---------------------------------------------------------------------------
\54\ Money Services Round Table (comment 53, NPRM), at 5-6.
\55\ Id. at 5.
\56\ Final Rule Sec. 314.2(j).
\57\ Indeed, Workshop participant Scott Wallace noted, in
conducting penetration testing, ``the first thing [he does]'' is
generally to ``prepare for the phishing campaign.'' Remarks of Scott
Wallace, Safeguards Workshop Tr., supra note 17, at 131-32.
---------------------------------------------------------------------------
The MSRT also argued the definition was too broad, and was joined
by other commenters in this concern.\58\ These commenters shared a
concern the proposed definition would include systems that are in no
way connected to customer information and would require financial
institutions to include all systems in their possession, regardless of
their involvement with customer information. The Commission agrees the
definition should be limited to those systems that either contain
customer information or are connected to systems that contain customer
information, and adds that limitation to the Final Rule. The Rule does
not limit the definition to only those systems that contain customer
information, because a common source of data breaches is a
vulnerability in a connected system that an attacker exploits to gain
access to the company's network and move within the network to obtain
access to the system containing sensitive information.\59\ Accordingly,
the definition of information system in the Final Rule is modified to a
discrete set of electronic information resources organized for the
collection, processing, maintenance, use, sharing, dissemination or
disposition of electronic information containing customer information
or any such system connected to a system containing customer
information, as well as any specialized system such as industrial/
process controls systems, telephone switching and private branch
exchange systems, and environmental controls systems, that contains
customer information or that is connected to a system that contains
customer information.
---------------------------------------------------------------------------
\58\ Money Services Round Table (comment 53, NPRM), at 5;
Consumer Data Industry Association (comment 36, NPRM), at 4;
American Council on Education (comment 24, NPRM), at 7-8.
\59\ See Remarks of Serge Jorgensen, Safeguards Workshop Tr.,
supra note 17, at 58-59 (noting cybersecurity attacks can take
advantage of systems that are connected to the systems in which
sensitive information is stored); Remarks of Tom Dugas, Safeguards
Workshop Tr., supra note 17, at 138 (noting a vulnerability in one
system can result in the exposure of information maintained in
another system); see also Remarks of Rocio Baeza, Safeguards
Workshop Tr., supra note 17, at 106-07 (noting the heightened
importance of encryption in a context where numerous systems are
connected); Remarks of James Crifasi, Safeguards Workshop Tr., supra
note 17, at 107-08 (same).
---------------------------------------------------------------------------
Multi-Factor Authentication
Proposed paragraph (i) defined multi-factor authentication as
authentication through verification of at least two of the following
types of authentication factors: Knowledge factors, such as a password;
possession factors, such as a token; or inherence factors, such as
biometric characteristics. This term was used in proposed Sec.
314.4(c)(6),\60\ which required financial institutions to implement
multi-factor authentication for individuals accessing networks that
contain customer information.
---------------------------------------------------------------------------
\60\ Section 314.4(c)(5) in the Final Rule.
---------------------------------------------------------------------------
Several commenters argued the definition should explicitly include
SMS text messages as an acceptable example of a possession factor or
otherwise to be explicitly allowed.\61\ The Proposed Rule did not
include SMS text messages as an example of a possession factor.\62\
Most commenters who addressed this issue interpreted this exclusion
from the examples as forbidding financial institutions from using SMS
text messages as a possession factor for multi-factor authentication.
That is not the effect of this exclusion, however. The language of the
definition neither prohibits nor recommends use of SMS text messages.
Indeed, SMS text messages are not addressed at all. In some cases, use
of SMS text messages as a factor may be the best solution because of
its low cost and easy use, if its risks do not outweigh those benefits
under the circumstances.\63\ In other instances, however, the use of
SMS text messages may not be a reasonable solution, such as when
extremely sensitive information can be obtained through the access
method being controlled, or when a more secure method can be used for a
comparable price. A financial institution will need to evaluate the
balance of risks for its situation. If, however, the Commission were to
explicitly allow use of SMS text messages, this could be considered a
safe harbor that would not require the company to consider risks
associated with use of SMS text as a factor in a particular use case.
Accordingly, the Final Rule does not include SMS text
[[Page 70278]]
messages in the examples of possession factors.
---------------------------------------------------------------------------
\61\ Electronic Transactions Association (comment 27, NPRM), at
4; U.S. Chamber of Commerce (comment 33, NPRM), at 9; CTIA (comment
34, NPRM), at 7-9; Global Privacy Alliance (comment 38, NPRM), at 9;
National Automobile Dealers Association (comment 46, NPRM), at 29;
National Independent Automobile Dealers Association (comment 48,
NPRM), at 6.
\62\ See, e.g., NIST Special Publication 800-63B, Digital
Identity Guidelines, 5.1.3.3 (restricting use of verification using
the Public Switched Telephone Network (SMS or voice) as an ``out-of-
band'' factor for multi-factor authentication).
\63\ See, e.g., Remarks of Wendy Nather, Safeguards Workshop
Tr., supra note 17, at 231-32.
---------------------------------------------------------------------------
The final Rule adopts the proposed definition of ``multi-factor
authentication'' without change as paragraph (k) of this section.
Penetration Testing
Proposed paragraph (j) defined penetration testing as a test
methodology in which assessors attempt to circumvent or defeat the
security features of an information system by attempting penetration of
databases or controls from outside or inside your information systems.
This term was used in proposed Sec. 314.4(d)(2), which required
financial institutions to continually monitor the effectiveness of
their safeguards or to engage in annual penetration testing. The
Commission received no comments concerning this definition. The Final
Rule adopts the definition from the Proposed Rule as paragraph (m) of
this section.
Personally Identifiable Financial Information
To minimize cross-referencing to the Privacy Rule, as noted above,
the Commission is adding several definitions to the Final Rule. One of
these definitions is ``personally identifiable financial information,''
which is identical to the definition currently contained in the Privacy
Rule. This term is included within the ambit of ``customer
information,'' in both the existing Rule and the Final Rule.
The Princeton Center suggested expanding the definition of
``personally identifiable financial information'' from the Privacy Rule
to include ``aggregate information or blind data that does not contain
personal identifiers such as account numbers, names, or addresses.''
\64\ The Princeton Center further suggested clarifying that, for
information to not be considered ``personally identifiable financial
information,'' the financial institution must be required to
demonstrate the information is not ``reasonably linkable'' to
individuals.
---------------------------------------------------------------------------
\64\ Princeton University Center for Information Technology
Policy (comment 54, NPRM) at 9-10.
---------------------------------------------------------------------------
The Commission does not believe this amendment is necessary. The
definition of ``personally identifiable financial information'' is
already a broad one.\65\ It includes not just information associated
with types of personal information such as a name or address or account
number, but also information linked to a persistent identifier (``any
information you collect through an Internet `cookie' (an information
collecting device from a web server'')).\66\ While there may be some
merit to limiting the exception for aggregate information or blind data
to data that cannot be reasonably linkable to an individual, for
purposes of a rule that can be periodically updated to keep up with
changing technology, the current approach is more concrete and
enforceable, and less subject to differences in interpretation.
---------------------------------------------------------------------------
\65\ See 16 CFR 313.3(o)(1).
\66\ 16 CFR 313.3(o)(2)(i)(F).
---------------------------------------------------------------------------
Service Provider
Proposed paragraph (k) adopted the existing Rule's definition and
does not alter the definition of ``service provider.'' The Commission
received no comments on this definition and adopts it as paragraph (q)
of the Final Rule.
Sec. 314.3: Standards for Safeguarding Customer Information
Proposed Sec. 314.3, which required financial institutions to
develop an information security program (paragraph (a)) and set forth
the objectives of the Rule (paragraph (b)), was largely identical to
the existing Rule. It changed only the requirement that ``safeguards''
be based on the elements set forth in Sec. 314.4, by replacing
``safeguards'' with ``information security program.'' The Commission
received no comments on this proposal and adopts it without change in
the Final Rule.
Sec. 314.4: Elements
Proposed Sec. 314.4 altered the current Rule's required elements
of an information security program and added several new elements.
General Comments
The Commission received many comments addressing the new elements,
both in favor of the changes and opposed to them. The comments in favor
of the changes generally argued these changes would protect consumers
by improving the data security of institutions that hold their
information.\67\ Most of the comments opposed to the proposed elements
fell into several categories, objecting: (1) The proposed changes were
too prescriptive and did not allow financial institutions sufficient
flexibility in managing their information security; (2) the proposed
amendments would be too expensive for financial institutions,
particularly smaller institutions, to adopt; and (3) some of the
requirements should not apply to all customer information but should be
limited to some subset of especially ``sensitive'' customer
information. The Commission does not agree with these comments for the
reasons discussed below, and accordingly, retains the general approach
of the Proposed Rule in the Final Rule.
---------------------------------------------------------------------------
\67\ See, e.g., New York Department of Financial Service
(comment 40, NPRM), at 1 (arguing the Proposed Rule would ``further
advance efforts to protect financial institutions and consumers from
cybercriminals.''); Princeton University Center for Information
Technology Policy (comment 54, NPRM), at 1 (stating the Proposed
Rule ``would significantly reduce data security risks for the
customers of financial institutions.''); National Consumer Law
Center and others (comment 58, NPRM), at 2 (stating requirements of
Proposed Rule are ``reasonable and common-sense measures that any
company dealing with large amounts of consumer personal information
should take.'').
---------------------------------------------------------------------------
Flexibility
Many industry groups argued the new proposed elements were too
prescriptive, lacked flexibility, would quickly become outdated, and
would force financial institutions to engage in activities that would
not enhance security.\68\ For example, the Electronics Transactions
Association argued the Proposed Rule would ``limit the ability of
industry to develop new and innovative approaches to information
security.'' \69\ Similarly, CTIA commented the Proposed Rule would
create a ``prescriptive core of requirements that covered businesses
must follow, irrespective of whether risk assessments show they are
necessary.'' \70\
---------------------------------------------------------------------------
\68\ See, e.g., HITRUST (comment 18, NPRM), at 1-2; American
Council on Education (comment 24, NPRM), at 2-4; Cristian Munarriz
(comment 21, NPRM); Electronic Transactions Association (comment 27,
NPRM), at 1-2; National Pawnbrokers Association (comment 32, NPRM),
at 3; CTIA (comment 34, NPRM), at 5; Consumer Data Industry
Association (comment 36, NPRM), at 2; Wisconsin Bankers Association
(comment 37, NPRM), at 1-2; Global Privacy Alliance (comment 38,
NPRM), at 5-6; Bank Policy Institute (comment 39, NPRM), at 2;
American Financial Services Association (comment 41, NPRM), at 4;
National Association of Dealer Counsel (comment 44, NPRM), at 1; ACA
International, (comment 45, NPRM), at 4; National Automobile Dealers
Association (comment 46, NPRM), at 11; National Independent
Automobile Dealers Association (comment 48, NPRM), at 2-3; Money
Services Round Table (comment 53, NPRM), at 1-4; Software &
Information Industry Association (comment 56, NPRM), at 1-3; Gusto
and others (comment 11, Workshop), at 2; Association of National
Advertisers (comment 5, Workshop), at 1-3; internet Association
(comment 9, Workshop), at 2-3.
\69\ Electronic Transactions Association (comment 27, NPRM), at
1-2.
\70\ CTIA (comment 34, NPRM), at 5.
---------------------------------------------------------------------------
The Commission, however, believes the elements provide sufficient
flexibility for financial institutions to adopt information security
programs suited to the size, nature, and complexity of their
organization and information systems. The elements for the information
security programs set forth in this section are high-level principles
that set forth basic issues the
[[Page 70279]]
programs must address, and do not prescribe how they will be addressed.
For example, the requirement that the information security program be
based on a risk assessment sets forth only three general items the
assessment must address: (1) Criteria for evaluating risks faced by the
financial institution; (2) criteria for assessing the security of its
information systems; and (3) how the identified risks will be
addressed. Other than meeting these basic requirements, financial
institutions are free to perform their risk assessments in whatever way
they choose, using whatever method or approach works best for them, as
long as the method identifies reasonably foreseeable risks. The other
elements are similarly flexible. The two elements that are more
prescriptive, encryption and multi-factor authentication, allow
financial institutions to adopt alternative solutions when necessary.
Comments concerning individual elements are addressed separately in the
more detailed analysis below.
Cost
Another common theme among the comments from industry groups was
the proposed information security program elements would be
prohibitively expensive, especially for smaller businesses.\71\
Commenters argued the Proposed Rule would have required financial
institutions to implement expensive changes to their systems and hire
highly-compensated professionals to do so.\72\ Industry groups were
particularly concerned about the requirement that financial
institutions designate a single qualified individual to coordinate
their information security programs, arguing this would require hiring
professionals that were both expensive, with salaries of more than
$100,000 suggested by some, and in limited supply.\73\ Overall, several
commenters argued some financial institutions would be unable to afford
to bring themselves into compliance with the Proposed Rule.\74\
---------------------------------------------------------------------------
\71\ American Council on Education (comment 24, NPRM), at 13-14;
Wisconsin Bankers Association (comment 37, NPRM), at 1-2; American
Financial Services Association (comment 41, NPRM), at 4; National
Association of Dealer Counsel (comment 44, NPRM), at 1; National
Automobile Dealers Association (comment 46, NPRM), at 11; National
Independent Automobile Dealers Association, (comment 48, NPRM), at
3; Gusto and others (comment 11, Workshop), at 2-4; National
Pawnbrokers Association (comment 3, NPRM), at 2; see also Remarks of
James Crifasi, Safeguards Workshop Tr., supra note 17, at 72-74
(describing study that found compliance would be expensive for
automobile dealers).
\72\ See, e.g., Slides Accompanying Remarks of James Crifasi,
FTC, ``NADA Cost Study: Average Cost Per U.S. Franchised
Dealership,'' Event Materials, Information Security and Financial
Institutions: An FTC Workshop to Examine Safeguards Rule (July 13,
2020) https://www.ftc.gov/system/files/documents/public_events/1567141/slides-glb-workshop.pdf (hereinafter Safeguards Workshop
Slides), at 25 (estimating an upfront cost of $293,975 per
dealership, and an recurring annual cost of $276,925); see also
Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at
72-75; Remarks of Brian McManamon, Safeguards Workshop Tr., supra
note 17, at 78 (estimating the average annual salary of a CISO can
range from $180,000 to upwards of $400,000); Slides Accompanying
Remarks of Lee Waters, ``Estimated Costs of Proposed Changes,''
Safeguards Workshop Slides, at 26 (estimating the annual costs of a
security program to include: Multi-factor authentication, $50 for
smart card readers, and $10 each for smart cards; a CISO, either an
in-house CISO, $180,000, an in-house cybersecurity analyst, $76,000,
or an outsourced cybersecurity contractor, between $120,000 and
$240,000; penetration testing, average cost $4,800; and physical
security, $215,000 for construction, and $10,000 to $20,000 for new
or upgraded locks); see also Remarks of Lee Waters, Safeguards
Workshop Tr., supra note 17, at 75-76.
\73\ See, e.g., Slides Accompanying Remarks of Lee Waters,
``Estimated Costs of Proposed Changes,'' Safeguards Workshop Slides,
supra note 72, at 26 (estimating costs of an in-house CISO to be
$180,000 annually, and an in-house cybersecurity analyst to be
$76,000 annually; and estimating an outsourced cybersecurity
contractor would cost between $120,000 to $240,000 annually); see
also Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17,
at 75-76; Remarks of Brian McManamon, Safeguards Workshop Tr., supra
note 17, at 78 (estimating that the average annual salary of a CISO
can range from $180,000 to upwards of $400,000).
\74\ See Remarks of Lee Waters, Safeguards Workshop Tr., supra
note 17, at 119-20 (noting when small businesses have to spend money
to hire third-party vendors and security experts to comply with
regulations, that affects consumer prices and small business profit
margins); Slides Accompanying Remarks of James Crifasi, ``NADA Cost
Study: Average Cost Per U.S. Franchised Dealership,'' Safeguards
Workshop Slides, supra note 72, at 25; see also Remarks of James
Crifasi, supra note 17, at 73 (noting the requirements ``start
becoming a little bit unaffordable here.'').
---------------------------------------------------------------------------
The Commission recognizes properly securing information systems can
be an expensive and technically difficult task. However, the Commission
believes the additional costs imposed by the Proposed Rule are
mitigated for several reasons and, ultimately, those costs are
justified in order to protect customer information as required by the
GLBA.\75\ First, for almost 20 years, financial institutions have been
required under the current Safeguards Rule to have information security
programs in place. The current Safeguards Rule requires financial
institutions to ``develop, implement, and maintain a comprehensive
[written] information security program . . . appropriate to [the
financial institutions'] size and complexity, the nature and scope of
[their] activities, and the sensitivity of any customer information at
issue.'' \76\ This comprehensive program must be coordinated by one or
more individuals and based on a risk assessment.\77\ As such, financial
institutions complying with the current Rule will not be required to
establish an information security program from scratch. Instead, they
can compare their existing programs to the revised Rule, and address
any gaps. The Commission believes many of the requirements set forth in
the Final Rule are so fundamental to any information security program
that the information security programs of many financial institutions
will already include them if those programs are in compliance with the
current Safeguards Rule.
---------------------------------------------------------------------------
\75\ The Small Business Administration's Office of Advocacy
commented it was concerned the FTC had not gathered sufficient data
as to either the costs or benefits of the proposed changes for small
financial institutions. Office of Advocacy, U.S. Small Business
Administration (comment 28, NPRM), at 3-4. The FTC shares the Office
of Advocacy's interest in ensuring that regulatory changes have an
evidentiary basis. Many of the questions on which the FTC sought
public comment, both in the regulatory review and in the proposed
Rule context, specifically related to the costs and benefits of
existing and proposed Rule requirements. Following the initial round
of commenting, the Commission conducted the FTC Safeguards Workshop
and solicited additional public comments with the explicit goal of
gathering additional data relating to the costs and benefits of the
proposed changes. See Public Workshop Examining Information Security
for Financial Institutions and Information Related to Changes to the
Safeguards Rule, 85 FR 13082 (Mar. 6, 2020). As detailed throughout
this document, the Commission believes there is a strong evidentiary
basis for the issuance of the final Rule.
\76\ 16 CFR 314.3.
\77\ 16 CFR 314.4.
---------------------------------------------------------------------------
Second, a number of commenters who raised concerns about the costs
imposed by the Rule believed the Proposed Rule would have required the
hiring of a highly-compensated expert to serve as a Chief Information
Security Officer (CISO).\78\ It is correct the Proposed Rule would have
modified the current requirement of designating an ``employee or
employees to coordinate your information security program'' by
requiring the designation of a single qualified individual responsible
for
[[Page 70280]]
overseeing and implementing the security program. This individual was
referred to in the Proposed Rule as a Chief Information Security
Officer or ``CISO.'' As discussed in detail below, the Final Rule does
not use this term, though the concept is the same: The person
designated to coordinate the information security program need only be
``qualified.'' No particular level of education, experience, or
certification is prescribed by the Rule. Accordingly, financial
institutions may designate any qualified individual who is appropriate
for their business. Only if the complexity or size of their information
systems require the services of an expert will the financial
institution need to hire such an individual.\79\
---------------------------------------------------------------------------
\78\ Several speakers at the Safeguards Workshop also raised
this concern. See, e.g., Slides Accompanying Remarks of James
Crifasi, ``NADA Cost Study: Average Cost Per U.S. Franchised
Dealership,'' in Safeguards Workshop Slides, supra note 72, at 25
(estimating appointing a CISO to increase program accountability
would be a one-time, up-front cost of $27,500, with a recurring
annual cost of $51,000); Remarks of James Crifasi, Safeguards
Workshop Tr., supra note 17, at 72-75; Slides Accompanying Remarks
of Lee Waters, ``Estimated Costs of Proposed Changes,'' in
Safeguards Workshop Slides, supra note 72, at 26 (estimating costs
of an in-house CISO to be $180,000 annually, and an in-house
cybersecurity analyst to be $76,000 annually; and estimating that an
outsourced cybersecurity contractor would cost between $120,000 to
$240,000 annually); Remarks of Lee Waters, Safeguards Workshop Tr.,
supra note 17, at 75-76; Remarks of Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 78 (estimating that the average
annual salary of a CISO can range from $180,000 to upwards of
$400,000).
\79\ See, e.g., Remarks of Brian McManamon, Safeguards Workshop
Tr., supra note 17, at 89-90 (noting the size of a financial
institution and the amount and nature of the information it holds
factor into an appropriate information security program); see also
Slides Accompanying Remarks of Rocio Baeza, ``Models for Complying
to the Safeguards Rule Changes,'' in Safeguards Workshop Slides,
supra note 72, at 27-28 (describing three different compliance
models: In-house, outsource, and hybrid, with costs ranging from
$199 per month to more than $15,000 per month); Remarks of Rocio
Baeza, Safeguards Workshop Tr., supra note 17, at 81-83 (describing
three compliance models in more detail).
---------------------------------------------------------------------------
Finally, the Commission believes while large financial institutions
may well incur substantial costs to implement complex information
security programs, there are much more affordable solutions available
for financial institutions with smaller and simpler information
systems. For example, there are very low-cost or even free
vulnerability assessment programs available: ``virtual CISO'' services
enable a third party to provide security support for many companies,
splitting the cost of information security professionals among them;
many applications and hardware have built-in encryption requirements;
\80\ and there are affordable multi-factor authentication solutions
aimed at businesses of various sizes.
---------------------------------------------------------------------------
\80\ See Remarks of Brian McManamon, Safeguards Workshop Tr.,
supra note 17, at 78 (describing virtual CISO services).
---------------------------------------------------------------------------
Considering these points, although there will undoubtedly be
expenses involved for some, or even many, financial institutions to
update their programs, the Commission believes these expenses are
justified because of the vital importance of protecting customer
information collected, maintained, and processed by financial
institutions. Congress recognized the importance of securing consumers'
sensitive financial information when it passed the GLBA, which required
the FTC to promulgate the Safeguards Rule. The importance, as well as
the difficulty, of protecting customer information has only increased
in the more than twenty years since the passage of the GLBA. The
Commission believes the amendments to the Safeguards Rule are necessary
to ensure the purposes of the GLBA are satisfied, and so consumers can
have confidence financial institutions are providing reasonable
safeguards to protect their information.
``Sensitive'' Customer Information
Several industry groups also suggested significant portions of the
Proposed Rule should not apply to all customer information, but rather
only to some subset of particularly ``sensitive'' customer information,
such as account numbers or social security numbers.\81\ These
commenters generally argued the definition of ``customer information''
is too broad, as it will include information the commenters felt is not
particularly sensitive, such as name and address, and does not justify
extensive safeguards.\82\
---------------------------------------------------------------------------
\81\ See, e.g., Electronic Transactions Association (comment 27,
NPRM), at 2-4; CTIA (comment 34, NPRM), at 10; Global Privacy
Alliance (comment 38, NPRM), at 7-8; American Financial Services
Association (comment 41, NPRM), at 5; ACA International (comment 45,
NPRM), at 13; Money Services Round Table (comment 53, NPRM), at 6-7.
\82\ See, e.g., Electronic Transactions Association (comment 27,
NPRM), at 2; Global Privacy Alliance (comment 38, NPRM), at 7.
---------------------------------------------------------------------------
The Commission does not agree that some portion of customer
information is not entitled to the protections required by the Final
Rule. The Safeguards Rule defines ``customer information'' as ``any
record containing nonpublic personal information'' about a customer
handled or maintained by or on behalf of a financial institution.\83\
The Final Rule defines ``nonpublic personal information'' as
``personally identifiable financial information,'' but does not include
information that is ``publicly available.'' Although this definition is
broad, the Commission believes information covered by it is rightfully
considered sensitive and should be protected accordingly. The
businesses regulated by the Safeguards Rule are not just any
businesses, but are financial institutions and are responsible for
handling and maintaining financial information that is both important
to consumers and valuable to attackers who try to obtain the
information for financial gain. Even the fact that a consumer is a
customer of a particular financial institution is generally nonpublic
and can be sensitive. For example, the revelation of a customer
relationship between a consumer and a particular type of financial
institution, such as debt collectors or payday lenders, may make those
customers' information more vulnerable to compromise by facilitating
social engineering or similar attacks. The nature of the relationship
between customers and their financial institutions makes all nonpublic
information held by the financial institution inherently sensitive and
worthy of the level of protection set forth in the Rule.
---------------------------------------------------------------------------
\83\ 16 CFR 314.2(b).
---------------------------------------------------------------------------
Although the Commission believes all customer information should be
safeguarded by financial institutions and declines to exclude any
portion of that information from protection under any of the provisions
of the Rule, it notes the Rule does contemplate financial institutions
will consider the sensitivity of particular information in designing
their information security programs and safeguards. The elements
required by this section are generally flexible enough to allow
financial institutions to treat various pieces of information
differently. For example, paragraph (c)(1) requires information
security programs to include safeguards that address access control of
customer information. The paragraph requires financial institutions to
develop measures to ensure only authorized users access customer
information, but does not prescribe any particular measures that must
be adopted. When designing these measures, a financial institution may
design a system in which more sensitive information is protected by
more stringent access controls. Even in the more specific provisions of
the Rule, there is flexibility to address the relative sensitivity of
information. For example, in Sec. 313.4(c)(5)'s requirement that
customer information be protected by multi-factor authentication,
financial institutions have flexibility to implement the multi-factor
authentication depending on the sensitivity of the information. The
financial institution may select factors such as SMS text messages to
access less sensitive information, but determine more sensitive
information should be protected by other, more secure, factors for
authentication.
Third-Party Standards and Frameworks
In addition, in the NPRM, the Commission asked whether the
Safeguards Rule should incorporate outside standards, such as the
National Institute of Standards and Technology (``NIST'') framework,
either as required elements of an information security program or as a
safe harbor that would
[[Page 70281]]
treat compliance with such a standard as compliance with the Safeguards
Rule. Some commenters advocated for the adoption of an outside standard
into the Safeguards Rule.\84\ Cisco Systems, Inc. suggested the
Safeguards Rule should be connected to NIST guidance, arguing this
would allow the Rule to evolve as NIST's guidance evolves.\85\ An
anonymous commenter suggested the Rule should comply with
``international standard ISO/IEC 27001.'' \86\ The National Consumer
Law Center argued certain financial institutions with particularly
sensitive customer information should be required to comply with
guidelines issued by NIST and the Federal Financial Institutions
Examination Council (FFIEC).\87\ Other commenters acknowledged the
value of outside standards but were opposed to the Rule requiring
compliance with them.\88\
---------------------------------------------------------------------------
\84\ Cisco Systems, Inc. (comment 51, NPRM), at 4; National
Consumer Law Center and others (comment 58), at 2; Anonymous
(comment 2, Workshop).
\85\ Cisco Systems, Inc. (Comment 51, NPRM), at 4.
\86\ Anonymous (comment 2, Workshop). The ISO/IEC 27001 standard
is an information security standard issued by the International
Organization for Standardization. See ISO/IEC 27001 Information
Security Management, ISO, https://www.iso.org/isoiec-27001-information-security.html (last accessed 15 Dec. 2020).
\87\ National Consumer Law Center and others (comment 58, NPRM),
at 2.
\88\ HITRUST (comment 18, NPRM), at 2; see also Consumer Reports
(comment 52, NPRM), at 6-7 (discouraging the adoption of outside
standards as a safe harbor for companies).
---------------------------------------------------------------------------
Some commenters suggested while compliance with outside standards
should not be required, compliance should serve as a ``safe harbor''
for compliance with the Rule.\89\ On the other hand, Consumer Reports
noted while such standards can be helpful guidance, they should not be
a safe harbor for compliance with the Rule because financial
institutions must take steps to ensure they are responding to changing
information security threats regardless of the requirements of an
outside framework.\90\
---------------------------------------------------------------------------
\89\ Mortgage Bankers Association (comment 26, NPRM), at 2
(suggesting Rule be modified so financial institutions that use the
NIST Cybersecurity Framework would be in de facto compliance with
the Rule); see also National Pawnbrokers Association (comment 32,
NPRM), at 6-7 (advocating for the adoption of safe harbors for small
financial institutions without detailing what should be required to
qualify for the safe harbor).
\90\ Consumer Reports (comment 52, NPRM), at 6-7.
---------------------------------------------------------------------------
The Commission declines to change the Rule to incorporate or
reference a particular security standard or framework for a variety of
reasons. First, it is not clear the more detailed frameworks would
apply well to financial institutions of various sizes and industries.
In addition, mandating companies follow a particular security standard
or framework would reduce the flexibility built into the Rule.
Similarly, the Commission declines to make compliance with an outside
standard a safe harbor for the Rule. In such a scenario, the use of
safe harbors would not greatly enhance regulatory stability or
predictability for financial institutions because the Commission would
be required to actively monitor whether those standards continued to
provide equivalent protections for Safeguards compliance and modify the
Rule if a standard became inadequate. In addition, in investigating
possible violations of the Rule, the Commission would be required to
independently verify whether the financial institution had in fact
complied with the outside framework, which would require substantial
effort and expense on the part of the Commission and the target of the
investigation.
Specific Elements
In addition to these generally applicable comments, commenters
addressed many of the individual elements set forth by this section.
These elements are discussed in more detail below.
Paragraph (a)--Designation of a Single Qualified Individual
Proposed paragraph (a) changed the current requirement that
institutions designate an ``employee or employees to coordinate your
information security program'' to instead require the financial
institution to designate ``a qualified individual responsible for
overseeing and implementing your information security program and
enforcing your information security program.'' \91\ This individual was
referenced in the Proposed Rule as a Chief Information Security Officer
or ``CISO.''
---------------------------------------------------------------------------
\91\ Section 314.4(a).
---------------------------------------------------------------------------
The notice of proposed rulemaking for the Proposed Rule emphasized
the use of the term ``CISO'' was for clarity in the Proposed Rule.\92\
Despite the use of the term ``CISO,'' the Proposed Rule did not require
financial institutions to actually grant that title to the designated
individual. Commenters that responded to this proposal, however,
generally assumed the person designated to coordinate and oversee a
financial institution's information security program would be required
to have the qualifications, duties, responsibilities, and accompanying
pay of a CISO as that position is generally understood in the
information security field.\93\ The position of CISO is generally
limited to large companies with fairly complex information security
systems, so the salary of this position is often very high.\94\
Accordingly, many commenters argued hiring a CISO would be
prohibitively expensive for many financial institutions.\95\
Additionally, commenters argued the hiring of such an in-demand
professional would be difficult because of a general shortage of such
professionals available for hiring.\96\
---------------------------------------------------------------------------
\92\ 84 FR 13165.
\93\ U.S. Chamber of Commerce (comment 33, NPRM), at 10;
National Automobile Dealers Association (comment 46), at 17-19;
National Independent Automobile Dealers Association (comment 48,
NPRM), at 5; ACA International (Comment 45, NPRM), at 8.
\94\ See. e.g., Brian McManamon, Safeguards Workshop Tr., supra
note 17, at 78 (estimating the average annual salary of a CISO can
range from $180,000 to upwards of $400,000).
\95\ National Automobile Dealers Association (comment 46, NPRM),
at 17-19; National Independent Automobile Dealers Association
(comment 48, NPRM), at 5; U.S. Chamber of Commerce (comment 33,
NPRM), at 10; ACA International (comment 45, NPRM), at 8.
\96\ National Automobile Dealers Association (comment 46, NPRM),
at 18-19; U.S. Chamber of Commerce (comment 33, NPRM), at 10; ACA
International (comment 45, NPRM), at 8.
---------------------------------------------------------------------------
By using the term ``CISO,'' the Commission did not intend to
require all financial institutions hire a highly qualified professional
with an extremely high salary, regardless of the financial
institutions' size or complexity. The Proposed Rule required only that
financial institutions designate a ``qualified individual'' to oversee
and enforce their information security program, without specifying any
particular level of experience, education, or compensation, or
requiring any particular duties outside of overseeing the financial
institution's information security program and other requirements
specifically set forth in the Rule.\97\ The use of the term ``CISO'' in
the Proposed Rule, however, caused confusion about the requirements of
this section. Accordingly, the Final Rule replaces the term ``CISO''
with ``Qualified Individual'' to refer to the individual designated
under this section of the Rule.
---------------------------------------------------------------------------
\97\ 84 FR 13175.
---------------------------------------------------------------------------
The use of the term ``Qualified Individual'' is meant to clarify
the only requirement for this designated individual is that he or she
be qualified to oversee and enforce the financial institution's
information security program. What qualifications are necessary will
depend upon the size and complexity of a financial institution's
information system and the volume and sensitivity of the customer
information the financial institution
[[Page 70282]]
possesses or processes. The Qualified Individual of a financial
institution with a very small and simple information system will need
less training and expertise than a Qualified Individual for a financial
institution with a large, complex information system. The exact
qualifications will depend on the nature of the financial institution's
information system. Each financial institution will need to evaluate
its own information security needs and designate an individual with
appropriate qualifications to meet those needs.
The Commission believes, in many cases, financial institutions'
current coordinators, whether their own employees or third-party
contractors, may be qualified for this role.\98\ Because the current
Safeguards Rule requires financial institutions to designate an
``employee or employees to coordinate your information security
program,'' financial institutions in compliance with that Rule will
already have one or more information security coordinators. Although
the current Rule does not expressly require that these coordinators be
qualified for that position, the current Rule requires a financial
institution to maintain ``appropriate'' safeguards, regularly test
those safeguards, and evaluate and adjust the information security
program in light of that testing.\99\ In order to effectively comply
with these ongoing requirements, a financial institution's coordinator
must have some level of information security training and knowledge
and, therefore, will likely be an appropriate Qualified Individual
under the Final Rule. Accordingly, in many cases this amendment to the
Rule will not require any additional hiring expenses.
---------------------------------------------------------------------------
\98\ Remarks of James Crifasi, Safeguards Workshop Tr., supra
note 17, at 74 (stating car dealerships can rely on existing staff
for this role); Remarks of Lee Waters, Safeguards Workshop Tr.,
supra note 17, at 78-79 (stating any dealership with any IT staff at
all would have someone who could assume the role of ``qualified
individual,'' perhaps requiring some additional research or outside
help); Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note
17, at 81-82 (stating companies may use an existing employee for the
role and ``for any areas where there may be skill gaps, that can be
supplemented with either certifications or some type of
education.'').
\99\ 16 CFR 314.4.
---------------------------------------------------------------------------
In addition to explicitly requiring that the information security
program coordinator be qualified for the role, the Commission proposed
to require the designation of a single employee, as opposed to the
multiple coordinators allowed by the existing Rule. Some commenters
objected to this proposal on the grounds that it would interfere with
financial institutions' flexibility in organizing their information
security personnel.\100\ For example, the Consumer Data Industry
Association (``CDIA'') commented the designation of a single
coordinator would interfere with financial institutions' ability to
organize their program ``to share responsibilities among different
personnel with different strengths.'' \101\ Similarly, ACA
International argued this requirement would prevent financial
institutions from having multiple staff members share responsibilities
for information security programs.\102\
---------------------------------------------------------------------------
\100\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 5; Consumer Data Industry Association
(comment 36, NPRM), at 5; National Association of Dealer Counsel
(comment 44, NPRM), at 2; ACA International (comment 45, NPRM), at
7-8; Money Services Round Table (comment 53, NPRM), at 10; Gusto and
others (Comment 11, Workshop), at 2; see also Remarks of James
Crifasi, Safeguards Workshop TR, supra note 17, at 74 (stating
``when we're talking about a small and medium business [. . .] we
really need to see that `qualified individual' be a mix of folks'').
\101\ Consumer Data Industry Association (comment 36, NPRM), at
5.
\102\ ACA International (comment 45, NPRM), at 7-8. NPA raised
similar concerns. National Pawnbrokers Association (comment 3,
Workshop), at 2.
---------------------------------------------------------------------------
Other commenters argued the designation of a single individual as
the coordinator of the information security program provides no proven
benefits over the use of multiple coordinators.\103\ Similarly, NADA
argued that, while the appointment of a single qualified individual
might improve accountability, improving accountability does not improve
security.\104\ On the other hand, a group of consumer and advocacy
groups including the National Consumer Law Center (``NCLC'') argued
appointing a single individual as the coordinator of the information
security program can increase security and prevent security events
based on lack of accountability and poor coordination.\105\
---------------------------------------------------------------------------
\103\ Consumer Data Industry Association (comment 36, NPRM), at
5; National Automobile Dealers Association (comment 46, NPRM), at
19; ACA International (comment 45, NPRM), at 8.
\104\ National Automobile Dealers Association (comment 46,
NPRM), at 19.
\105\ National Consumer Law Center and others (comment 58,
NPRM), at 3 (arguing that a clear line of reporting with a single
responsible individual could have prevented the Equifax consumer
data breach).
---------------------------------------------------------------------------
The Commission retains the requirement to designate a single
qualified individual, because it believes there are clear benefits to
the designation of a single coordinator. Designating a single
coordinator to oversee an information security program clarifies lines
of reporting in enforcing the program, can avoid gaps in responsibility
in managing data security, and improve communication.\106\
---------------------------------------------------------------------------
\106\ Remarks of Adrienne Allen, Safeguards Workshop Tr., supra
note 17, at 182-84 (stating that without a single responsible
individual, information security staff ``can fall into traps of each
relying on someone else to make a hard call . . . [In a program
without a single coordinator] issues can sometimes fall through the
cracks.''); Remarks of Michele Norin, Safeguards Workshop Tr., supra
note 17, at 184-85 (``I think it's extremely important to have a
person in front of the information security program. I think that
there are so many components to understand, to manage, to keep an
eye on. I think it's difficult to do that if it's part of someone
else's job. And so I found that it's extremely helpful to have a
person in charge of that program just from a pure basic management
perspective and understanding perspective.'').
---------------------------------------------------------------------------
The Commission disagrees with the commenter who stated improved
accountability does not lead to improved security. The goal of
improving accountability is to ensure information security staff and
financial institution management give the necessary attention and
resources to information security. In addition, an individual that has
clear responsibility for the strength of a financial institution's
information security program will be accountable to improve the program
and ensure it protects customer information.\107\
---------------------------------------------------------------------------
\107\ See, e.g., Federal Trade Commission Staff Comment on the
Preliminary Draft for the NIST Privacy Framework: A Tool for
Improving Privacy through Enterprise Risk Management (Oct. 24,
2019), at 12-14 (suggesting NIST clarify that one person should be
in charge of the program). https://www.ftc.gov/system/files/documents/advocacy_documents/ftc-staff-comment-preliminary-draft-nist-privacy-framework/p205400nistprivacyframeworkcomment.pdf.
---------------------------------------------------------------------------
The major breach that occurred at national consumer reporting
agency Equifax in 2017 demonstrates the importance of clear lines of
reporting and accountability in management of information security
programs. The U.S. House Committee on Oversight and Government Reform
issued a report on the breach that identified Equifax's organization as
one of the major causes of the breach.\108\ The report indicated
Equifax's division of responsibility for information security between
two individuals that reported to two different company officers
contributed to failures of communication, oversight, and enforcement
that led to millions of consumers' data being compromised.\109\
Increasing accountability for individuals and organizations can
directly lead to improved security for customer information.
---------------------------------------------------------------------------
\108\ U.S. House, Committee on Oversight and Government Reform,
Majority Staff Report, The Equifax Data Breach, at 55-62, 115th
Congress (Dec. 2018).
\109\ Id.
---------------------------------------------------------------------------
Finally, the Commission does not believe the requirement to
designate a single Qualified Individual would
[[Page 70283]]
prevent the approach of having multiple people responsible for
different aspects of the program, as some commenters asserted. While
the Qualified Individual appointed as the coordinator of the
information security program would have ultimate responsibility for
overseeing and managing the information security program, financial
institutions may still assign particular duties and responsibilities to
other staff members.\110\ A financial institution may organize its
personnel in teams or share decision making between individuals.
Moreover, the Rule does not require this be the Qualified Individual's
sole job--he or she may have other duties. The Rule requires only that
one individual assume the ultimate responsibility for overseeing and
enforcing the program.
---------------------------------------------------------------------------
\110\ See Remarks of Adrienne Allen, Safeguards Workshop Tr.,
supra note 17, at 189-90 (noting that, even where there is a single
point person, decision makers rarely operate ``in a vacuum.'').
---------------------------------------------------------------------------
Accordingly, the Final Rule requires designation of a single
Qualified Individual, as proposed, but no longer uses the term
``CISO.''
Third-Party Coordinators
The Proposed Rule stated that the Qualified Individual would not
need to be an employee of the financial institution, but could be an
employee of an affiliate or a service provider. This change was
intended to accommodate financial institutions that may prefer to
retain an outside expert, lack the resources to employ a qualified
person to oversee a program, or decide to pool resources with
affiliates to share staff to manage information security. The Proposed
Rule required, however, that to the extent a financial institution used
a service provider or affiliate, the financial institution must still:
(1) Retain responsibility for compliance with the Rule; (2) designate a
senior member of its personnel to be responsible for direction and
oversight of the Qualified Individual; and (3) require the service
provider or affiliate to maintain an information security program that
protects the financial institution in accordance with the Rule.
The Commission received one comment on this aspect of the
provision. NADA argued that, because a senior member of a financial
institution's personnel must be responsible for the oversight of a
third-party Qualified Individual, the supervising individual would need
to be an expert in information security, and the financial institution
would still be required to hire an expensive employee to supervise the
third-party Qualified Individual.\111\ The Rule, however, does not
require individuals responsible for overseeing third-party Qualified
Individuals to be information security experts themselves. The senior
personnel that oversees the third-party Qualified Individual is charged
with supervising and monitoring the third-party so the financial
institution is aware of its data security needs and the safeguards
being used to protect its information systems. This person does not
need to be qualified to coordinate the information security program him
or herself. Technical staff are frequently supervised by employees or
officers with limited technical expertise.\112\ The Rule requires only
the same responsibilities a supervisor would have in overseeing an in-
house information security coordinator of a financial institution.
Accordingly, the Commission adopts the proposed paragraph without
modification.
---------------------------------------------------------------------------
\111\ National Automobile Dealers Association (comment 46,
NPRM), at 18.
\112\ See Remarks of James Crifasi, Safeguards Workshop Tr.,
supra note 17, at 79-80 (stating that, in his work as a third-party
information security service provider, he is often overseen by
executives without technical backgrounds); see also Remarks of Rocio
Baeza, Safeguards Workshop Tr., supra note 17, at 105-06 (noting
distinction in how executives and technical staff may understand
their organizations' use of encryption); Remarks of Karthik
Rangarajan, Safeguards Workshop Tr., supra note 17, at 196
(discussing challenges inherent in discussing technical issues with
board members who lack a technical background)and at 211 (noting
organizations can successfully manage their relationships with
third-party service providers without ``becom[ing] experts'' in the
services provided).
---------------------------------------------------------------------------
Proposed Paragraph (b)
The NPRM proposed amending paragraph (b) to clarify a financial
institution must base its information security program on the findings
of its risk assessment by adding an explicit statement that financial
institutions' ``information security program [shall be based] on a risk
assessment.'' \113\ In addition, the Proposed Rule removed existing
Sec. 314.4(b)'s requirement that the risk assessment must include
consideration of specific risks \114\ because these specific risks are
set forth elsewhere in the Proposed Rule.\115\ The Commission received
no comments on this paragraph and adopts paragraph (b) as proposed.
---------------------------------------------------------------------------
\113\ Proposed 16 CFR 314.4(b).
\114\ Proposed 16 CFR 314.4(b)(1), (2), and (3).
\115\ See, e.g., Proposed 16 CFR 314.4(c)(2) and (10) and (e).
---------------------------------------------------------------------------
Written Risk Assessment
Paragraph (b)(1) of the Proposed Rule required the risk assessment
be written and include: (1) Criteria for the evaluation and
categorization of identified security risks or threats the financial
institution faces; (2) criteria for the assessment of the
confidentiality, integrity, and availability of the financial
institution's information systems and customer information, including
the adequacy of the existing controls in the context of the identified
risks or threats to the financial institution; and (3) requirements
describing how identified risks will be mitigated or accepted based on
the risk assessment and how the information security program will
address the financial institution's risks. Commenters raised several
concerns about the Proposed Rule's provisions on risk assessment, none
of which merit changes to the Proposed Rule.
First, some commenters objected to the level of specificity of the
Proposed Rule, with some arguing the requirements were too specific,
and others arguing the requirements were not specific enough. With
respect to the Proposed Rule being too specific, commenters such as ACA
and U.S. Chamber of Commerce argued it removed financial institutions'
flexibility in performing risk assessments.\116\ The U.S. Chamber of
Commerce contended, because the criteria are too specific, a risk
assessment performed using them would not be ``sufficiently risk
based.'' \117\ CDIA expressed concern it was unclear ``what level of
specificity is required'' in the written risk assessment and if
detailed risk assessments are required, they ``could themselves become
a roadmap for a security breach.'' \118\
---------------------------------------------------------------------------
\116\ ACA International (comment 45, NPRM), at 12; U.S. Chamber
of Commerce (comment 33, NPRM), at 10.
\117\ U.S. Chamber of Commerce (comment 33, NPRM), at 10.
\118\ Consumer Data Industry Association (comment 36, NPRM), at
5.
---------------------------------------------------------------------------
In contrast, several other commenters recommended the Rule set
forth more specific criteria for risk assessments. Inpher suggested the
Commission add a requirement that risk assessments require financial
institutions to examine ``technologies that are deployed by [financial
institutions'] information security systems, and evaluate the
feasibility'' of adopting ``privacy enhancing technologies'' that would
better address vulnerabilities and thwart threats.\119\ Inpher also
recommended the Rule require financial institutions to conduct privacy
impact assessments with ``specific guidelines to review internal data
protection standards and adherence to fair information
[[Page 70284]]
principles.'' \120\ The Princeton Center suggested the Rule require
risk assessments to include threat modeling and adopt the concept of
defense in depth.\121\ HALOCK Security Labs recommended the Rule
specifically require ``a) That risk assessments should evaluate the
likelihood of magnitudes of harm that result from threats and errors,
b) That risk assessments should explicitly estimate foreseeable harm to
consumers as well as to the covered financial institutions, c) That
risk mitigating controls are commensurate with the risks they address,
[and] d) That risk assessments estimate likelihoods and impacts using
available data.'' \122\
---------------------------------------------------------------------------
\119\ Inpher, Inc. (comment 50, NPRM), at 4.
\120\ Id.
\121\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 2.
\122\ HALOCK Security Labs (comment 4, Workshop) at 2. See Rocio
Baeza (comment 12, Workshop) at 2-3 (suggesting a detailed list of
requirements for the risk assessment).
---------------------------------------------------------------------------
The Commission believes the Proposed Rule's provisions on risk
assessment strike the right balance between specificity and
flexibility. The amendments provide only a high-level list of criteria
the risk assessment must address. They essentially require that the
financial institution identify and evaluate risks to its systems,
evaluate the adequacy of its existing controls for addressing these
risks, and identify how these risks can be mitigated. These are core
requirements of any risk-assessment.\123\ The Rule does not require any
specific methodology or approach for performing the assessment.
Financial institutions are free to perform the risk assessment using
the method most suitable for their organization as long as that method
meets the general requirements set forth in the Rule. \124\ And while
the Commission agrees the additional requirements suggested by some
commenters may be beneficial in many, or even most, risk assessments,
it believes a more flexible requirement will better allow financial
institutions to find the risk assessment method that best fits their
organization and will better accommodate changes in recommended
approaches in the future.
---------------------------------------------------------------------------
\123\ See, e.g., Remarks of Chris Cronin, Safeguards Workshop
Tr., supra note 17, at 25 (stating that evaluating the likelihoods
and impacts of potential security risks and evaluating existing
controls is an important component of a risk assessment); Remarks of
Serge Jorgensen, Safeguards Workshop Tr., supra note 17, at 29-30
(emphasizing the importance of risk assessments as tools for
adjusting existing security measures to account for both current and
future security threats); Nat. Inst. of Sci. & Tech., U.S. Dept. of
Com., Special Publication 800-30 Rev. 1, Guide for Conducting Risk
Assessments 1 (2012) (describing the purpose of risk assessments as
the identification of and prioritization of risk in order to inform
decision making and risk response).
\124\ ACA International further argued because risk assessment
criteria are generally understood, they do not need to be included
in the Final Rule. ACA International (comment 45, NPRM). The
Commission believes it is helpful to be clear about the criteria the
risk assessment must contain, even if those criteria are commonly
understood.
---------------------------------------------------------------------------
In response to CDIA's concern about the risk assessment providing a
roadmap for bad actors, certainly, the written risk assessment will
include details about a financial institution's systems that could
assist an attacker if obtained by the attacker. Accordingly, the risk
assessment should be protected as any other sensitive information would
be. The Commission does not view this concern as a reason not to create
such a document. Indeed, the concern would apply to any written
document that provides information regarding a financial institution's
information security procedures, from a network diagram to written
security code.
Second, some commenters argued implementing the risk-assessment
provision as proposed would be too expensive and difficult for
financial institutions.\125\ For example, NADA argued the contemplated
risk assessment would be very costly because the criteria set out in
paragraph (b)(1) are ``well outside the scope of expertise of anyone
but the most sophisticated IT professionals.'' \126\ In response,
although the Commission declines to modify the provision, it addresses
NADA's concern in Sec. 314.6 by exempting financial institutions that
maintain information concerning fewer than 5,000 consumers from the
specific requirements of paragraph (b)(1), and from the requirement to
memorialize the risk assessment in writing. For those financial
institutions that do not qualify for this exemption, the Commission
believes they will be able to perform the required risk assessment in a
manner that is practical and affordable for their institution. There
are many resources available to financial institutions to aid in risk
assessment, including service providers that can assist institutions of
various sizes.\127\
---------------------------------------------------------------------------
\125\ National Association of Dealer Counsel (comment 44, NPRM),
at 3; National Automobile Dealers Association (comment 46, NPRM), at
20.
\126\ National Automobile Dealers Association (comment 46,
NPRM), at 20.
\127\ See, e.g., Slides Accompanying Remarks of Rocio Baeza, in
Safeguards Workshop Slides, supra note 72, at 27-28 (describing
three different compliance models: In-house, outsource, and hybrid,
with costs ranging from $199 per month to more than $15,000 per
month); Slides Accompanying the Remarks of Brian McManamon, ``Sample
Pricing,'' in Safeguards Workshop Slides, supra note 72, at 29
(estimating the cost of cybersecurity services based on number of
endpoints: $2K-$5K per month for 25-250 endpoints; $5K-$15K for 250-
750 endpoints; $15K-$30K for 750-1,000 endpoints; and $30K-$50K for
1,500-2,500 endpoints); see also Remarks of Brian McManamon,
Safeguards Workshop Tr., supra note 17, at 83-85.
---------------------------------------------------------------------------
While acknowledging there will be some cost to conducting a risk
assessment, the Commission believes a properly conducted risk
assessment is an essential part of a financial institution's
information security program. The entire Safeguards Rule, both as it
currently exists and as amended, requires that the information security
program be based on a risk assessment. An information security program
cannot properly guard against risks to customer information if those
risks have not been identified and assessed.\128\ The Commission
believes this requirement properly emphasizes the importance of robust
risk assessments, while providing financial institutions sufficient
flexibility in performing these assessments. Finally, the Commission
notes, because the current Rule also requires that a risk assessment be
performed, financial institutions that have complied with the current
Rule have already conducted a risk assessment. And, even if that risk
assessment was not memorialized in writing, the work conducted for that
risk assessment should be useful in performing future risk assessments.
---------------------------------------------------------------------------
\128\ See Remarks of Chris Cronin, Safeguards Workshop Tr.,
supra note 17, at 48-49 (noting all information security frameworks
and guidelines are based on risk analysis).
---------------------------------------------------------------------------
Third, NADA objected to the requirement that the risk assessment
describe how each identified risk will be ``mitigated or accepted,''
arguing it is not clear when it is appropriate to ``accept a risk.''
\129\ NADA argued that documenting a decision to accept a risk would
``create a record that can be distorted and second guessed after the
fact,'' and ``context is lost when it is written and reviewed after an
incident has occurred.'' \130\ The Rule does not require a financial
institution to mitigate every risk identified, no matter how remote or
insignificant. Instead, the Rule allows a financial institution to
accept a risk, if its assessment of the risk reveals that the chance it
will produce a security event is very small, if the consequences of the
risk are minimal, or the cost of mitigating the risk far outweighs the
benefit. In those cases, the financial institution may choose to accept
the risk. A financial institution concerned that its decision to accept
a risk will later be questioned may choose to set forth whatever
context or
[[Page 70285]]
explanation it sees fit in the written assessment.
---------------------------------------------------------------------------
\129\ National Automobile Dealers Association (comment 46, NPRM)
at 20.
\130\ Id.
---------------------------------------------------------------------------
Finally, while several commenters supported the idea of conducting
``periodic'' risk assessments as required by the Proposed Rule,\131\
NADA objected it is unclear how often financial institutions need to
conduct risk assessments under this section. \132\ In order to be
effective, a risk assessment must be subject to periodic reevaluation
to adapt to changes in both financial institutions' information systems
and changes in threats to the security of those systems. The Commission
declines, however, to set forth a specific schedule for risk
assessments. The Commission believes it would not be appropriate to set
forth an inflexible schedule for periodic risk assessments because each
financial institution must set its own schedule based on the needs and
resources of its institution.
---------------------------------------------------------------------------
\131\ Inpher, Inc. (comment 50, NPRM), at 3; Global Privacy
Alliance (comment 38, NPRM), at 11.
\132\ National Automobile Dealers Association (comment 46,
NPRM), at 20.
---------------------------------------------------------------------------
The Final Rule adopts Sec. 314.4(b) as proposed.
Paragraph (c)
Proposed paragraph (c) retained the existing Rule's requirement for
financial institutions to design and implement safeguards to control
the risks identified in the risk assessment. In addition, it added more
detailed requirements for what the safeguards must address (e.g.,
access controls, data inventory, disposal, change management,
monitoring). These specific requirements represent elements of an
information security program that the Commission views as essential and
should be addressed by all financial institutions.\133\
---------------------------------------------------------------------------
\133\ NADA disagreed with the Commission's statement in the NPRM
for the Proposed Rule that ``most financial institutions already
implement'' the specific requirements in paragraph (c), stating that
many financial institutions ``do not currently implement some or all
of these measures.'' National Automobile Dealers Association
(comment 46, NPRM), at 20. The Commission continues to believe most
financial institutions institute some form of most of these
measures, such as access control, secure disposal, and monitoring
authorized users, based on its enforcement and business outreach
experience. While NADA's statement that some financial institutions
implement none of the measures may be true, this underlines the
necessity of making these elements explicit requirements under the
Rule, as these elements are necessary for a reasonable information
security program for all financial institutions. Indeed, a financial
institution that utilizes none of these elements and exercises no
access control, no secure disposal procedures, and does not monitor
users of its systems is unlikely to be in compliance with the
current Rule.
---------------------------------------------------------------------------
As a preliminary matter, Global Privacy Alliance (GPA) argued all
of these elements should be made optional and financial institutions
should be required only to take these elements ``into consideration''
when designing their information security programs.\134\ While the
Commission agrees it is important that the Rule allow financial
institutions flexibility in designing their information security
programs, these elements are such important parts of information
security that each program must address them. For example, an
information security program that has no access controls or does not
contain any measures to monitor the activities of users on the systems
cannot be said to be protecting the financial institution's systems.
The Final Rule, therefore, continues to require each information
security program to contain safeguards that address these elements,
with modifications described below.
---------------------------------------------------------------------------
\134\ Global Privacy Alliance (comment 38, NPRM), at 6.
---------------------------------------------------------------------------
Access Controls
Proposed paragraph (c)(1) required financial institutions to
``place access controls on information systems, including controls to
authenticate and permit access only to authorized individuals to
protect against the unauthorized acquisition of customer information
and to periodically review such access controls.''
Commenters suggested a number of modifications to this provision.
First, GPA argued this provision should require controls on access to
information, rather than on information systems.\135\ Second, several
commenters suggested adding further safeguards to the ``access
control'' requirement. For example, the Princeton Center argued the
Rule should adopt the ``Principle of Least Privilege,'' a principle
that no user should have access greater than is necessary for
legitimate business purposes.\136\ Reynolds and Reynolds Company
(Reynolds) suggested the Rule clarify that financial institutions must
``vet, control, and monitor user access to sensitive information.''
\137\ Consumer Reports argued paragraph (c)(1) should be amended to
control access not just to authorized users, but to further limit
access to when such access is reasonably necessary.\138\ ACE argued
that any requirement for physical access control allow financial
institutions to determine which locations should have restricted
access, rather than limiting physical access to every building and
office within, say, a college campus.\139\ Finally, some commenters
argued the proposed language was too vague,\140\ particularly as it
applied to vendor-supplied services.\141\
---------------------------------------------------------------------------
\135\ Global Privacy Alliance (comment 38, NPRM), at 9-10.
\136\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 4-5.
\137\ Reynolds and Reynolds Company (comment 7, Workshop), at 7.
\138\ Consumer Reports (comment 52, NPRM), at 7.
\139\ American Council on Education (comment 24, NPRM), at 10.
\140\ National Automobile Dealers Association (comment 46,
NPRM), at 23; National Independent Automobile Dealers Association
(comment 48, NPRM), at 5; American Council on Education (comment 24,
NPRM), at 10;
\141\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 5; American Council on Education (comment 24,
NPRM), at 10.
---------------------------------------------------------------------------
In response to the comments, the Commission makes a number of
changes to this provision in the Final Rule. First, the Commission
clarifies that the Rule requires access controls, not just for
information systems, but for all customer information, whether it is
housed in information systems or in physical locations. To streamline
the Rule, the Final Rule combines the separate physical access controls
requirement found in proposed paragraph (c)(3) with this paragraph.
Physical access controls will generally be most important in situations
in which sensitive customer information is kept in physical form (such
as hard-copy loan applications, or printed consumer reports). It may
also require physical restrictions to access machines that contain
customer information (e.g., locked doors and/or key card access to a
computer lab).\142\ The Commission declines to make any changes in
response to ACE's concern that every physical location will need to be
protected--as the Rule states, physical controls must be implemented to
protect unauthorized access to customer information. Where no customer
information exists, the Rule would not require physical controls.
---------------------------------------------------------------------------
\142\ NIADA suggested instituting physical access controls would
cost a dealership $215,000 because each computer would need to have
its own lockable cubicle and there would need to be lockable offices
for all desks. See Remarks of Lee Waters, Safeguards Workshop Tr.,
supra note 17, at 76. As originally promulgated, the Rule already
requires financial institutions implement ``physical safeguards that
are appropriate to your size and complexity.'' 16 CFR 314.3. The
Final Rule's requirement is consistent with that longstanding
requirement. If computers have technical safeguards preventing
unauthorized users from accessing customer information, they usually
will not need to be in a lockable area, particularly if they are not
generally left unattended and are not likely to be stolen.
Similarly, desks would need to be in lockable offices only if they
contain accessible paper records. A lockable file cabinet may be a
more economical solution.
---------------------------------------------------------------------------
Second, the Commission agrees with the commenters who advocated
that the Rule implement the principle of least privilege. The
Commission does not believe it is appropriate, for example, for larger
companies to give all
[[Page 70286]]
employees and service providers access to all customer information.
Such overbroad access could create additional harm in the event of an
intruder gaining access to a system by impersonating an employee or
service provider. Accordingly, the Commission clarifies this in the
Final Rule by adding a requirement that not only must a financial
institution implement access controls, but it should also restrict
access only to customer information needed to perform a specific
function.
As to the suggestion the Commission impose monitoring requirements
for access, that requirement exists in paragraph (c)(8). And as to the
suggestion the requirement is too vague as to service providers, the
Commission believes the Final Rule is clear: When a vendor accesses the
financial institution's data or information systems, the financial
institution must ensure appropriate access controls are in place.
Separately, under paragraph (f), the financial institution must
reasonably oversee the vendor's safeguards, which would necessarily
include access controls for the vendor's system.
Finally, as to the suggestion the provision is vague generally, as
discussed above, the Final Rule seeks to preserve flexibility in its
provisions, both so that financial institutions can design programs
appropriate for their systems and so that changes in technology or
security practices will not render the Rule obsolete. The Commission
believes maintaining less prescriptive requirements is the best way to
achieve the goal of flexibility and protecting customer
information.\143\
---------------------------------------------------------------------------
\143\ NPA expressed concern about the effect of the Rule on
pawnbrokers who the commenter stated are required by law to allow
law enforcement access to their physical records. National
Pawnbrokers Association (comment 32, NPRM), at 7. Nothing in the
Rule conflicts with any such requirements. Law enforcement
appropriately accessing customer information under a law that
requires that access would be considered authorized use under those
circumstances.
---------------------------------------------------------------------------
Accordingly, the Commission combines paragraphs (c)(1) and (3) from
the Proposed Rule into revised paragraph (c)(1) of the Final Rule,
which requires implementing and periodically reviewing access controls
on customer information, including technical and, as appropriate,
physical controls to (1) authenticate and permit access only to
authorized users to protect against the unauthorized acquisition of
customer information and (2) limit authorized users' access only to
customer information that they need to perform their duties and
functions, or, in the case of customers, to access their own
information.\144\
---------------------------------------------------------------------------
\144\ As noted above, the Commission is also changing the term
``authorized individuals'' to ``authorized users.''
---------------------------------------------------------------------------
System Inventory
In the NPRM, the Commission proposed to require the financial
institution to ``[i]dentify and manage the data, personnel, devices,
systems, and facilities that enable [the financial institution] to
achieve business purposes in accordance with their relative importance
to business objectives and [the financial institution's] risk
strategy.'' \145\ This requirement was designed to ensure the financial
institution inventoried the data in its possession, inventoried the
systems on which that data is collected, stored, or transmitted, and
had a full understanding of the relevant portions of its information
systems and their relative importance.\146\ The Commission retains this
provision in the Final Rule without modification.
---------------------------------------------------------------------------
\145\ Proposed 16 CFR 314.4(c)(2).
\146\ See, e.g., Complaint at 11, FTC v. Wyndham Worldwide
Corp., No. CV 2:12-cv-01365-SPL (D. Ariz. June 26, 2012) (alleging
company failed to provide reasonable security by, among other
things, failing to inventory computers connected to its network).
---------------------------------------------------------------------------
Commenters raised two general objections to this provision. First,
some commenters argued it was too vague and that it was not clear how
such an inventory should be conducted or what systems should be
included.\147\ The Commission believes the language provides effective
guidance while still allowing a variety of approaches by financial
institutions in identifying systems involved in their businesses. This
provision requires a financial institution to identify all ``data,
personnel, devices, systems, and facilities'' that are a part of its
business and to determine their importance to the financial
institution. This inventory of systems must include all systems that
are a part of the business so the financial institution can locate all
customer information it controls, the systems connected to that
information, and how they are connected. This inventory forms the basis
of an information security program because a system cannot be protected
if the financial institution does not understand its structure or know
what data is stored in its systems.
---------------------------------------------------------------------------
\147\ National Automobile Dealers Association (comment 46,
NPRM), at 23-24; American Financial Services Association (comment
41, NPRM), at 5; American Council on Education (comment 24, NPRM),
at 10.
---------------------------------------------------------------------------
Second, ACE suggested the scope of this provision should be limited
to systems ``directly related to the privacy and security of `customer
information.' '' \148\ The Commission declines to make this change
because the purpose of this provision is to allow financial
institutions to obtain a clear picture of their systems and to identify
where customer information is kept and how it can be accessed. An
inventory must examine all systems in order to identify all systems
that contain customer information or are connected to systems that do.
If a financial institution does not first examine all systems and
instead limits the inventory to systems it considers to be directly
related to security, it could give an incomplete picture of the
financial institution's systems and could result in some customer
information or ways to connect to that information being
overlooked.\149\
---------------------------------------------------------------------------
\148\ American Council on Education (comment 24, NPRM), at 10.
\149\ Another commenter criticized proposed paragraph (c)(2)
because some financial institutions ``have no control'' over which
networks they transmit customer information. National Pawnbrokers
Association (comment 32, NPRM), at 7. Paragraph (c)(2) does not
require a financial system to identify all networks over which it
may transmit customer information. See also, infra, this document's
discussion of NPA's comments on Sec. 314.4(f) of the Final Rule,
noting financial institutions are generally not required to oversee
other entities' service providers over which they have no control.
---------------------------------------------------------------------------
The Commission adopts paragraph (c)(2) of the Proposed Rule as
final, without modifications.
Access to Physical Location
Proposed paragraph (c)(3) would have required that financial
institutions restrict access to physical locations containing customer
information only to authorized individuals. The Final Rule combines
this section with proposed paragraph (c)(1) in order to eliminate
redundancy and clarify that access controls must consider both
electronic and physical access.
Encryption
Proposed paragraph (c)(4) required financial institutions to
encrypt all customer information, both in transit over external
networks and at rest. The Proposed Rule allowed financial institutions
to use alternative means to protect customer information, subject to
review and approval by the financial institution's Qualified
Individual.
Several commenters supported the inclusion of an encryption
requirement.\150\ In fact, some suggested
[[Page 70287]]
the Proposed Rule did not go far enough in requiring encryption. Inpher
suggested the Rule should require encryption of customer information
when in use, in addition to when in transit or at rest.\151\ The
Princeton Center suggested requiring encryption of data while in
transit over internal networks, in addition to requiring it for
external networks, noting the blurring of the distinction between
internal and external networks.\152\
---------------------------------------------------------------------------
\150\ Inpher, Inc. (comment 50, NPRM), at 4; Princeton
University Center for Information Technology Policy (comment 54,
NPRM), at 3; Electronic Privacy Information Center (comment 55,
NPRM), at 8; National Consumer Law Center and others (comment 58,
NPRM), at 3.
\151\ Inpher, Inc. (comment 50, NPRM), at 4.
\152\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 3.
---------------------------------------------------------------------------
In contrast, others argued encryption could be too expensive and
technically challenging for some financial institutions and should not
be required in all cases.\153\ Indeed, GPA argued the Rule should not
require encryption at all, financial institutions should be free to
adopt other protective measures for customer information, and the Rule
should allow financial institutions to ``determine the controls that
are most appropriate for protecting the sensitive information that they
handle.'' \154\ Similarly, some commenters argued financial
institutions should be required to encrypt customer information only
when the risk to the customer information justifies it.\155\ Others
suggested encryption in more limited circumstances, such as on systems
``to which unauthorized individuals may have access,'' \156\ for
sensitive data,\157\ or for data in transit.\158\ The Mortgage Bankers
Association argued encryption at rest is unnecessary because customer
information at rest in a financial institution's system is sufficiently
protected by controlling access to the system.\159\ Two commenters
stated guidelines issued by the Federal Financial Institutions
Examination Council (FFIEC) do not require most banks to encrypt data
at rest, unless the institution's risk assessment indicates such
encryption is necessary.\160\
---------------------------------------------------------------------------
\153\ National Pawnbrokers Association (comment 32, NPRM), at 3;
U.S. Chamber of Commerce (comment 33, NPRM), at 11; CTIA (comment
34, NPRM) at 10; Wisconsin Bankers Association (comment 37, NPRM),
at 2.
\154\ Global Privacy Alliance (comment 38, NPRM), at 7-8.
\155\ Bank Policy Institute (comment 39, NPRM), at 14; Mortgage
Bankers Association (comment 26, NPRM), at 6; Global Privacy
Alliance (comment 38, NPRM), at 7-8.
\156\ Bank Policy Institute (comment 39, NPRM), at 14.
\157\ U.S. Chamber of Commerce (comment 33, NPRM), at 11;
American Financial Services Association (comment 41, NPRM), at 5;
ACA International (comment 45, NPRM), at 13; CTIA (comment 34,
NPRM), at 10.
\158\ Mortgage Bankers Association (comment 26, NPRM), at 6;
Wisconsin Bankers Association (comment 37, NPRM), at 2; American
Financial Services Association (comment 41, NPRM), at 5; Ken
Shaurette (comment 19, NPRM), (suggesting the Commission consider
whether ``databases, applications and operating systems are prepared
to fully support full encryption without significant performance
impact or ability to continue to function.''); National Automobile
Dealers Association (comment 46, NPRM), at 25-26 (arguing the terms
``at rest'' and ``in transit'' are unclear).
\159\ Mortgage Bankers Association (comment 26, NPRM), at 6.
\160\ Wisconsin Bankers Association (comment 37, NPRM), at 2
(discussing FFIEC Information Technology Booklet); American
Financial Services Association (comment 41, NPRM), at 5 (discussing
FFIEC Cybersecurity Assessment Tool).
---------------------------------------------------------------------------
The Commission declines to modify the encryption requirement from
the Proposed Rule. As to the comments that suggest the requirement
should be relaxed, the Commission notes there are numerous free or low
cost encryption solutions available to financial institutions,
particularly for data in transit,\161\ that make encryption a feasible
solution in most situations. For data at rest, encryption is now
cheaper, more flexible, and easier than ever before.\162\ In many
cases, widely used software and hardware have built-in encryption
capabilities.\163\
---------------------------------------------------------------------------
\161\ See Remarks of Matthew Green, Safeguards Workshop Tr,
supra note 17, at 225 (noting website usage of encryption is above
80 percent; ``Let's Encrypt'' provides free TLS certificates; and
costs have gone down to the point that if a financial institution is
not using TLS encryption for data in motion, it is making an unusual
decision outside the norm); Remarks of Rocio Baeza, Safeguards
Workshop Tr., supra note 17, at 106 (``[T]he encryption of data in
transit has been standard. There's no pushback with that.''); see
also National Pawnbrokers Association (comment 3, Workshop), at 2
(``[I]n states that allow us to use technology for the receipt of
information from consumer customers and software to print our pawn
tickets and store information, we believe our members have access
through their software providers to protections that comply with the
Safeguards Rule.'').
\162\ See Remarks of Wendy Nather, Safeguards Workshop Tr.,
supra note 17, at 267 (``we have a lot more options, a lot more
technologies today than we did before that are making both of these
solutions, both encryption and MFA, easier to use, more flexible, in
some cases cheaper, and we should be encouraging their adoption
wherever possible.''); Remarks of Matthew Green, Safeguards Workshop
Tr., supra note 17, at 265-66 (``I think that we're in a great time
when we've reached the point where we can actually mandate that
encryption be used. I mean, years ago--I've been in this field for
15, you know, 20 years now, I guess. And, you know, encryption used
to be this exotic thing that was very, very difficult to use, very
expensive and not really feasible for securing information security
systems. And we've reached the point where now it is something
that's come to be and we can actually build well. So I'm really
happy about that.'').
\163\ See Remarks of Randy Marchany, Safeguards Workshop Tr.,
supra note 17, at 229-30 (noting encryption is already built into
the Microsoft Office environment and a number of Microsoft products,
such as Spreadsheets, Excel, Docs, and PowerPoint, support that
encryption feature). Other applications that have encryption built
in include database applications; app platforms iOS and Android; and
development frameworks for web applications on banking sites.
---------------------------------------------------------------------------
In response to the argument that the Rule should not require
encryption at rest because FFIEC guidelines do not require it, the
Commission notes the Safeguards Rule is very different from the
guidelines issued by the FFIEC. The depository financial institutions
regulated by the banking agencies are subject to regular examinations
by their regulator. The guidelines created by the FFIEC are designed to
be used by the examiner, as part of those examinations, to evaluate the
security of the financial institution; the examiner thus has a direct
role in regularly verifying the financial institution has taken
appropriate steps to protect its customer information. In contrast, the
Safeguards Rule regulates covered financial institutions directly and
must be usable by those entities to determine appropriate information
security without any interaction between the financial institution and
the Commission. The Commission does not have the ability to examine
each financial institution and work with that institution to ensure
their information security is appropriate. Therefore, a requirement
that institutions encrypt information by default is appropriate for the
Safeguards Rule, as the Commission believes encryption of customer
information at rest is appropriate in most cases.
Finally, while some commenters suggested eliminating the encryption
requirement for certain types of data (e.g., non-sensitive) or certain
categories of data (e.g., data at rest), the Commission notes, as
discussed in more detail above, the fact that an individual is a
customer of a financial institution alone may be sensitive. In any
event, the Rule provides financial institutions with flexibility to
adopt alternatives to encryption with the approval of the Qualified
Individual.
Similarly, the Commission declines to extend the encryption
requirement to data in use or to data transmitted over internal
networks, as some commenters suggested. The Commission does not believe
the technology that would encrypt data while in use (as opposed to in
transit or at rest) has been adopted widely enough at this time to
justify mandating its use by all financial institutions under the FTC's
jurisdiction. As to encryption of data transmitted over internal
networks, the Commission acknowledges, due to changes in network design
and the growth of cloud and mobile computing, the distinction between
internal and external networks is less clear than it once was. However,
the Commission believes requiring all financial institutions to encrypt
all communications over internal networks would be unduly burdensome at
this
[[Page 70288]]
time. There remain significant costs and technical hurdles to
encrypting transmissions on internal networks that would not be
reasonable to impose on all financial institutions, especially smaller
institutions with simpler systems that might realize less benefit from
this approach. While the Commission encourages financial institutions
to consider whether it would be appropriate for them to encrypt the
transmission of customer information over internal networks, it
declines to require this for all financial institutions.\164\
---------------------------------------------------------------------------
\164\ The Commission believes transmissions of customer
information to remote users or to cloud service providers should be
treated as external transmissions, as those transmissions are sent
out of the financial institution's systems.
---------------------------------------------------------------------------
Commenters pointed to three additional concerns about encryption,
none of which the Commission finds persuasive. First, the Bank Policy
Institute commented the encryption requirement would in fact weaken
security by blocking surveillance of the information by the financial
institution and requiring the ``broad distribution'' of encryption
keys.\165\ The Commission does not believe an encryption requirement
would weaken security. Encryption is almost universally recommended by
security experts and included in most security standards.\166\ Further,
new tools have been developed to address the issue the Bank Policy
Institute has raised. Many financial institutions have monitoring tools
on the edge of their networks to monitor data leaving the network. It
used to be the case these network monitoring tools could not see the
content of encrypted data as it left the corporate network and was
transmitted to the internet. However, there are now tools available
that can see the data as it departs the network, even if the data is
encrypted.\167\ Any marginal security costs of encryption are far
outweighed by the benefits of rendering customer information
unreadable.
---------------------------------------------------------------------------
\165\ Bank Policy Institute (comment 39, NPRM), at 13-14.
\166\ See, e.g., Payment Card Industry (PCI) Data Security
Standard Requirements and Security Assessment Procedures Version
3.2.1, PCI Security Standards Council (May 2018), https://www.pcisecuritystandards.org/document_library (last accessed 30 Nov.
2020) (Requirement 4 encrypt transmission of cardholder data across
open, public networks).
\167\ See, e.g., Encrypted Traffic Management, Broadcom Inc.,
https://www.broadcom.com/products/cyber-security/network/encrypted-traffic-management (last accessed 30 Nov. 2020); SSL Visibility, F5,
Inc., https://www.f5.com/solutions/application-security/ssl-visibility (last accessed 30 Nov. 2020).
---------------------------------------------------------------------------
Second, some commenters argued financial institutions should be
able to implement alternatives to encryption without obtaining approval
from the Qualified Individual.\168\ The New York Insurance Association
expressed concern financial institutions might feel they need to
encrypt all customer information because of the risk that the
alternative controls approved by the Qualified Individual would be
``second guessed'' in the event unencrypted data is compromised.\169\
The Commission, however, believes this concern is a core element of
information security based on risk assessment. Every aspect of an
information security program is based on the judgment of the financial
institution and its staff. The Qualified Individual's decision
concerning alternate controls, like other decisions by the financial
institution and its staff, will be subject to review in any enforcement
action to determine whether the decision was appropriate. If the
Qualified Individual is not required to make a formal decision, it is
much more likely a decision not to encrypt information will be made
even if there is no compensating control, or even made without the
Qualified Individual's knowledge.
---------------------------------------------------------------------------
\168\ Bank Policy Institute (comment 39, NPRM), at 14; New York
Insurance Association (comment 31, NPRM), at 1.
\169\ New York Insurance Association (comment 31, NPRM) at 1.
---------------------------------------------------------------------------
Third, the National Pawnbrokers Association (``NPA'') expressed
concern that if pawnbrokers are required to encrypt customer
information they may fall out of compliance with state and local
regulations concerning transaction reporting.\170\ NPA stated
pawnbrokers are often required by state or local law to report every
pawn transaction, along with nonpublic personally identifiable consumer
information, to law enforcement, and the agencies that receive this
information ``prefer to take this information electronically and in
unencrypted forms.'' \171\ The Commission believes if transmitting the
information in unencrypted form is a preference of the agencies and not
a requirement, then pawnbrokers can comply with both the Safeguards
Rule and these laws by encrypting any transmissions that include
customer information. If there are cases where a required transmission
of customer information cannot be encrypted for technical reasons, then
the pawnbroker's Qualified Individual will need to work with the law
enforcement agency to implement alternative compensating controls to
ensure the customer information remains secure during these
transmissions.\172\
---------------------------------------------------------------------------
\170\ National Pawnbrokers Association (comment 3, Workshop), at
2-3.
\171\ Id. at 2.
\172\ NADA suggested it is not clear how the encryption
requirement will apply to customer information held on a service
provider's system or on the systems of the subcontractors of the
service provider. National Automobile Dealers Association (comment
46, NPRM), at 21-22. The Commission believes the Final Rule lays out
a financial institution's obligations in this situation: It requires
customer information be encrypted unless infeasible. Section
314.4(e), in turn, requires financial institutions to require
service providers to implement and maintain appropriate safeguards
by contract and to periodically assess the continued adequacy of
those measures. A financial institution that uses a service provider
to store and process customer information must require that service
provider to encrypt that information and periodically determine
whether it continues to do so. If it is infeasible for the service
provider to meet these requirements then the financial institution's
Qualified Individual must work with the service provider to develop
compensating controls or cease doing business with the service
provider.
---------------------------------------------------------------------------
The Final Rule adopts this paragraph as paragraph (c)(3) without
revision.
Secure Development Practices
Proposed paragraph (c)(5) required financial institutions to
``[a]dopt secure development practices for in-house developed
applications utilized'' for ``transmitting, accessing, or storing
customer information.'' In this paragraph, the Commission proposed
requiring financial institutions to address the security of software
they develop to handle customer information, as distinct from the
security of their networks that contain customer information.\173\ In
addition, the Proposed Rule required ``procedures for evaluating,
assessing, or testing the security of externally developed applications
[financial institutions] utilize to transmit, access, or store customer
information.'' This provision required financial institutions to take
steps to verify that applications they use to handle customer
information are secure.\174\
---------------------------------------------------------------------------
\173\ See, e.g., Complaint, FTC v. D-Link Systems, Inc., No.
3:17-CV-00039-JD (N.D. Cal. March 20, 2017) (alleging company failed
to provide reasonable security when it failed to adequately test the
software on its devices).
\174\ See, e.g., Complaint, Lenovo, FTC No. 152-3134 (January 2,
2018) (alleging company failed to provide reasonable security by
failing to properly assess and address security risks caused by
third-party software).
---------------------------------------------------------------------------
Some commenters argued evaluating the security of externally
developed software would be too expensive or impractical for some
financial institutions,\175\ while others raised different concerns.
The American Council on Education suggested, in cases in which a
financial institution cannot obtain access to a software provider's
code or technical
[[Page 70289]]
infrastructure, then evaluating the security of its software is
infeasible.\176\ NADA further suggested in order to evaluate the
security of software, financial institutions would need to hire an
expensive IT professional.\177\
---------------------------------------------------------------------------
\175\ American Council on Education (comment 24, NPRM), at 11;
National Automobile Dealers Association (comment 46, NPRM), at 26-
27.
\176\ American Council on Education (comment 24, NPRM), at 11.
\177\ National Automobile Dealers Association (comment 46,
NPRM), at 26-27.
---------------------------------------------------------------------------
The Commission does not agree with these assertions. Evaluating the
security of software does not require access to the source code of that
software or access to the provider's infrastructure. For example, a
provider can supply the steps it took to ensure the software was
secure, whether it uses encryption to transmit information, and the
results of any testing it conducted. In addition, there are third party
services that assess software. An institution can also set up automated
searches regarding vulnerabilities, patches, and updates to software
listed on the financial institution's inventory. The exact nature of
the evaluation required will depend on the size of the financial
institution and the amount and sensitivity of customer information
associated with the software. If the software will be used to handle
large amounts of extremely sensitive information, then a more thorough
evaluation will be warranted. Likewise, the nature of the software used
will also affect the evaluation. Software that has been thoroughly
tested by third parties may need little more than a review of the test
results, while software that has not been widely used and tested will
require closer examination.
The Commission adopts proposed paragraph (c)(5) as paragraph (c)(4)
of the Final Rule.
Multi-Factor Authentication
Proposed paragraph (c)(6) required financial institutions to
``implement multi-factor authentication for any individual accessing
customer information'' or ``internal networks that contain customer
information.'' \178\ The Proposed Rule would have allowed financial
institutions to adopt a method other than multi-factor authentication
that offers reasonably equivalent or more secure access controls with
the written permission of its Qualified Individual. In the Final Rule,
the Commission retains the general requirements of proposed paragraph
(c)(6) as paragraph (c)(5), with some modifications described below.
---------------------------------------------------------------------------
\178\ Proposed 16 CFR 314.4(c)(6).
---------------------------------------------------------------------------
Although several commenters expressed support for including a
multi-factor authentication requirement in the Final Rule,\179\ others
opposed such a requirement. For example, ACE argued a blanket
requirement mandating multi-factor authentication for all institutions
of all sizes and complexities is not the best solution.\180\ The
National Independent Automobile Dealers Association (NIADA) commented
the costs of multi-factor authentication would be too high for some
financial institutions because it would need to be built into their
information systems from scratch.\181\ NIADA also argued adopting
multi-factor authentication would disrupt a financial institution's
activities as employees had to ``jump through multiple hoops to log
in.'' \182\ Cisco Systems, Inc. argued that while multi-factor
authentication is an effective safeguard, it should not be specifically
required by the Rule because, while it is currently good security
practice, in the future multi-factor authentication may become
outdated, and that allowing financial institutions to satisfy the Rule
in this way could result in inadequate protection.\183\
---------------------------------------------------------------------------
\179\ Justine Bykowski (comment 12, NPRM); Princeton University
Center for Information Technology Policy (comment 54, NPRM), at 6-7;
Electronic Privacy Information Center (comment 55, NPRM), at 8;
National Consumer Law Center and others (comment 58, NPRM), at 2;
see also Remarks of Wendy Nather, Safeguards Workshop Tr., supra
note 17, at 240-41 (discussing the security poverty line).
\180\ American Council on Education (comment 24, NPRM), at 11-
12.
\181\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 6; see also Ken Shaurette (comment 19, NPRM)
(questioning whether multi-factor authentication is appropriate for
all financial institutions).
\182\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 6.
\183\ Cisco Systems, Inc. (comment 51, NPRM), at 2-4.
---------------------------------------------------------------------------
Other commenters did not dispute the benefits of multi-factor
authentication generally, but argued the Rule should limit the multi-
factor authentication requirement. Some of these commenters stated the
Rule should only require multi-factor authentication when the financial
institution's risk assessment justifies it.\184\ Others argued there
should be a distinction between internal access and external access.
For example, some commenters argued the Rule should not require multi-
factor authentication when a user accesses customer information from an
internal network,\185\ because there are other controls on internal
access that make multi-factor authentication unnecessary.\186\ Another
commenter stated requiring multi-factor authentication when a customer
accesses their information from an external network could create
problems for some institutions.\187\ Finally, the Princeton Center
argued the Rule should be amended to clarify that multi-factor
authentication should be required for internal and external
networks.\188\
---------------------------------------------------------------------------
\184\ Bank Policy Institute (comment 39, NPRM), at 11-13; Global
Privacy Alliance (comment 38, NPRM), at 8.
\185\ Electronic Transactions Association (comment 27, NPRM), at
3 n.1; U.S. Chamber of Commerce (comment 33, NPRM), at 11; CTIA
(comment 34, NPRM), at 11; Global Privacy Alliance (comment 38,
NPRM), at 8; Bank Policy Institute (comment 39, NPRM), at 12;
National Automobile Dealers Association (comment 46, NPRM), at 28;
National Independent Automobile Dealers Association (comment 48,
NPRM), at 6; New York Insurance Association (comment 31, NPRM), at
1.
\186\ CTIA (comment 34, NPRM), at 11; Electronic Transactions
Association (comment 27, NPRM), at 3 n.1; U.S. Chamber of Commerce
(comment 33, NPRM), at 11.
\187\ American Council on Education (comment 24, NPRM), at 11.
\188\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 6-7; see also Remarks of Brian
McManamon, Safeguards Workshop Tr., supra note 17, at 102 (stating
his company TECH LOCK supports requiring multi-factor authentication
for users connecting from internal networks).
---------------------------------------------------------------------------
Finally, CTIA took issue with the proposed requirement that the
Qualified Individual be permitted to approve ``reasonably equivalent or
more secure'' controls if multi-factor authentication is not feasible,
suggesting instead that Qualified Individuals be permitted to approve
``effective alternative compensating controls.'' \189\
---------------------------------------------------------------------------
\189\ CTIA (comment 34, NPRM), at 11-12; see also Electronic
Transactions Association (comment 27, NPRM) at 3 (suggesting use of
the term ``alternative compensating controls'').
---------------------------------------------------------------------------
The Commission disagrees with the commenters who stated the Rule
should not include a multi-factor authentication requirement. As to
costs, many affordable multi-factor authentication solutions are
available in the marketplace.\190\ Most financial institutions will be
able to find a solution that is both affordable and workable for their
organization. In the cases when that it is not possible, the
[[Page 70290]]
Rule allows financial institutions to adopt reasonably equivalent
controls.\191\
---------------------------------------------------------------------------
\190\ See, e.g., Slides Accompanying Remarks of Brian McManamon,
``MFA/2FA Pricing (Duo),'' in Safeguards Workshop Slides, supra note
72, at 30 (setting forth prices for multi-factor/two-factor services
from Duo, including free services for up to ten users); Remarks of
Brian McManamon, Safeguards Workshop Tr., supra note 17, at 102-03;
Slides Accompanying Remarks of Lee Waters, ``Estimated Costs of
Proposed Changes,'' in Safeguards Workshop Slides, supra note 72, at
26 estimating costs of MFA to be $50 for smartcard or fingerprint
readers, and $10 each per smartcard); Slides Accompanying Remarks of
Wendy Nather, ``Authentication Methods by Industry,'' in Safeguards
Workshop Slides, supra note 72, at 37 (chart showing the use of MFA
solutions such as Duo Push, phone call, mobile passcode, SMS
passcode, hardware token, Yubikey passcode, and U2F token in
industries such as financial services and higher education); Remarks
of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 233-34.
\191\ See also Remarks of James Crifasi, Safeguards Workshop
Tr., supra note 17, at 103-04 (noting even where legacy systems do
not support multi-factor authentication, alternative measures can be
used and ``it's things that can easily be done.'')
---------------------------------------------------------------------------
As to potential disruptions requiring multi-factor authentication
may cause, the Commission notes that many organizations, both financial
institutions and otherwise, currently require employees to use multi-
factor authentication without major disruption.\192\ Many multi-factor
authentication systems are available that do not materially increase
the time it takes to log into a system as compared to the use of only a
password.\193\ In short, multi-factor authentication is an extremely
effective way to prevent unauthorized access to a financial
institution's information system,\194\ and its benefits generally
outweigh any increased time it takes to log into a system. In those
situations when the need for quick access outweighs the security
benefits of multi-factor authentication, the Rule allows the use of
reasonably equivalent controls.
---------------------------------------------------------------------------
\192\ See, e.g., Remarks of Randy Marchany, Safeguards Workshop
Tr., supra note 17, at 236-38 (describing how Virginia Tech
implemented multi-factor authentication in 2016 for its more than
156,000 users); Slides Accompanying Remarks of Wendy Nather,
``Authentication Methods by Industry,'' in Safeguards Workshop
Slides, supra note 72, at 37 demonstrating the types of multi-factor
authentication used by health care, financial services, higher
education and the Federal Government); Remarks of Wendy Nather,
Safeguards Workshop Tr., supra note 17, at 233-35.
\193\ See Remarks of Wendy Nather, Safeguards Workshop Tr.,
supra note 17, at 234 (describing how a phone call to a landline is
popular in some segments).
\194\ See, e.g., Remarks of Matthew Green, Safeguards Workshop
Tr., supra note 17, at 266 (explaining passwords are not enough of
an authentication feature but when MFA is used and deployed, the
defenders can win against attackers); id. at 239 (describing how
because smart phones have modern secure hardware processors,
biometric sensors and readers built in, increasingly consumers can
get the security they need through the devices they already have by
storing cryptographic authentication keys on the devices and then
using the phone to activate them).
---------------------------------------------------------------------------
Finally, although the Commission agrees the Rule should not lock
financial institutions into using outmoded or obsolete technologies,
the basic structure of using multiple factors to identify a user is
unlikely to be rendered obsolete in the near future. The Rule's
definition of multi-factor authentication addresses only this principle
and does not require any particular technology or technique to achieve
it. This should allow it to accommodate most changes in information
security practices. In the event of an unforeseen change to the
information security environment that would discount the value of
multi-factor authentication, the Commission will adjust the Rule
accordingly.\195\
---------------------------------------------------------------------------
\195\ The Mortgage Bankers Association expressed concern the
Proposed Rule would not allow the use of a single-sign on process,
where a user is given access to multiple applications with the use
of one set of credentials. Mortgage Bankers Association (comment 26,
NPRM), at 7. The Commission does not view the Rule as preventing
such a system, if the user has used multi-factor authentication to
access the system and the system is designed to ensure any user of a
given application has been subjected to multi-factor authentication.
---------------------------------------------------------------------------
The Commission agrees with the commenter who stated multi-factor
authentication is justified both when external users, such as
customers, and internal users, such as employees, access an information
system. Multi-factor authentication can prevent many attacks focused on
using stolen passwords from both employees and customers to access
customer information. Other common attacks on information systems, such
as social engineering or brute force password attacks, target employee
credentials and use those credentials to get access to an information
system.\196\ These attacks can usually be stopped through the use of
multi-factor authentication. Accordingly, the Final Rule requires
multi-factor authentication whenever any individual--employee, customer
or otherwise--accesses an information system. If a financial
institution determines it is not the best solution for its information
system, it may adopt reasonably equivalent controls with the approval
of the Qualified Individual.
---------------------------------------------------------------------------
\196\ See Remarks of Pablo Molina, Safeguards Workshop Tr.,
supra note 17, at 30 (mentioning ``phishing,'' or social
engineering, as a common type of cybersecurity attack); Remarks of
Lee Waters, Safeguards Workshop, supra note 17, at 91 (same);
Remarks of Michele Norin, Safeguards Workshop Tr., supra note 17, at
179 (same); see also Cyber Div., Fed. Bureau of Investigation,
Private Industry Notification No. 20200303-001, Cyber Criminals
Conduct Business Email Compromise through Exploitation of Cloud-
Based Email Services, Costing U.S. Businesses Over Two Billion
Dollars, (March 2020), https://www.ic3.gov/media/news/2020/200707-4.pdf, at 1-2, (last accessed 1 Dec. 2020) (``Between January 2014
and October 2019, the Internet Crime Complaint Center (IC3) received
complaints totaling over $2.1 billion in actual losses from
[Business Email Compromise (``BEC'')] scams targeting the largest
[cloud-based email] platforms. Losses from BEC scams overall have
increased every year since IC3 began tracking the scam in 2013 and
have been reported in all 50 states and in 177 countries.'').
---------------------------------------------------------------------------
The Commission recognizes the language of the Proposed Rule may
have created some confusion by its use of the term ``internal
networks'' to define the systems affected by the multi-factor
authentication requirement, instead of the term ``information systems''
as used other places in the Rule.\197\ In addition, the Commission
agrees with commenters that argued separating the multi-factor
authentication into two sentences created confusion.\198\ Accordingly,
the Commission modifies paragraph (c)(5) of the Final Rule, which was
proposed as paragraph (c)(6), to require financial institutions to
``[i]mplement multi-factor authentication for any individual accessing
any information system, unless your Qualified Individual has approved
in writing the use of reasonably equivalent or more secure access
controls.''
---------------------------------------------------------------------------
\197\ Consumer Data Industry Association (comment 36, NPRM), at
6-7; Cisco Systems, Inc. (comment 51, NPRM), at 3-4.
\198\ Bank Policy Institute (comment 39, NPRM), at 11.
---------------------------------------------------------------------------
Finally, the Commission declines to adopt CTIA's proposed
alternative that would allow Qualified Individuals to approve
``effective alternative compensating controls,'' even if they are not
``reasonably equivalent or more secure'' than multi-factor
authentication. Given the important role multi-factor authentication
has in access control, any alternative measure should provide at least
as much protection as multi-factor authentication.\199\
---------------------------------------------------------------------------
\199\ NADA argued, for financial institutions that have
appointed a third party to act as their information security
coordinator, this provision would require the institution to turn
over decisionmaking to someone ``with no stake in the business
outcome.'' National Automobile Dealers Association (comment 46,
NPRM), at 29-30. This concern misinterprets the role of the
Qualified Individual. Whether the Qualified Individual is inside the
company or at a third-party company, that individual will report to
and be supervised by senior management of a financial institution
(unless the Qualified Individual is the head of the financial
institution). If a Qualified Individual recommends a safeguard that
would not be practical for the business, the financial institution
is not required to adopt this safeguard but can use an alternative
adequate safeguard that will be functional. Indeed, when it comes to
third parties, the Rule specifically requires someone in the
financial institution direct and oversee the third party.
---------------------------------------------------------------------------
Audit Trails
Proposed paragraph (c)(7) required information security programs to
include audit trails designed to detect and respond to security
events.\200\ Audit trails are chronological logs that show who has
accessed an information system and what activities the user engaged in
during a given period.\201\
---------------------------------------------------------------------------
\200\ Proposed 16 CFR 314.4(c)(7).
\201\ See Information Technology Laboratory Computer Security
Resource Center, Glossary, National Institute of Standards and
Technology, https://csrc.nist.gov/glossary/term/audit-trail (last
accessed Dec. 2, 2020).
---------------------------------------------------------------------------
Some commenters supported this requirement.\202\ The Princeton
Center noted audit trails are ``crucial to designing effective security
measures
[[Page 70291]]
that allow institutions to detect and respond to security incidents.''
\203\ It also stated audit trails ``help understand who has accessed
the system and what activities the user has engaged in.'' \204\
---------------------------------------------------------------------------
\202\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 8; Electronic Privacy Information
Center (comment 55, NPRM), at 8.
\203\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 8.
\204\ Id.
---------------------------------------------------------------------------
Other commenters argued this requirement imposed unclear
obligations or would not improve security.\205\ For example, GPA
commented the Proposed Rule conflated the use of logs to reconstruct
past events and the active use of logs to monitor user activity.\206\
The American Financial Services Association argued adding logging
capabilities to some legacy systems would be expensive and
difficult.\207\ Another commenter argued the increased use of cloud
storage would mean that financial institutions might not have access to
any audit trails.\208\ In addition, NADA argued it did not believe
maintenance of logs would increase security but would instead create
records that could be sought by parties ``seeking to place blame'' for
breaches.\209\
---------------------------------------------------------------------------
\205\ National Automobile Dealers Association (comment 46,
NPRM), at 30-31; National Independent Automobile Dealers Association
(comment 48, NPRM), at 6; American Financial Services Association
(comment 41, NPRM), at 6; Global Privacy Alliance (comment 38,
NPRM), at 11.
\206\ Global Privacy Alliance (comment 38, NPRM), at 11.
\207\ American Financial Services Association (comment 41,
NPRM), at 6.
\208\ American Council of Education (comment 24, NPRM), at 12.
\209\ National Automobile Dealers Association (comment 46,
NPRM), at 30-31.
---------------------------------------------------------------------------
The Commission believes logging user activity is a crucial
component of information security because in the event of a security
event it allows financial institutions to understand what was accessed
and when. However, the term ``audit trails'' may have been unclear in
this context. In order to clarify that logging user activity is a part
of the user monitoring process, the Final Rule does not include
paragraph (c)(7) of the Proposed Rule and instead modifies the user
monitoring provision to include a requirement to log user
activity.\210\ By putting the ``monitoring'' and ``logging''
requirements together, the Final Rule provides greater clarity on the
comment raised by the GPA: Financial institutions are expected to use
logging to ``monitor'' active users and reconstruct past events.
---------------------------------------------------------------------------
\210\ See Final Rule, 16 CFR 314.4(c)(8).
---------------------------------------------------------------------------
Disposal Procedures
Proposed paragraph (c)(8) required financial institutions to
develop procedures for the secure disposal of customer information that
is no longer necessary for their business operations or other
legitimate business purposes.\211\ The Proposed Rule allowed the
retention of information when retaining the information is required by
law or where targeted disposal is not feasible.
---------------------------------------------------------------------------
\211\ Proposed 16 CFR 314.4(c)(8).
---------------------------------------------------------------------------
Some commenters supported the inclusion of a disposal requirement
as proposed or suggested that the disposal requirements should be
strengthened.\212\ Consumer Reports argued financial institutions
should be required to dispose of customer information when it is no
longer needed for the business purpose for which it was gathered.\213\
The Princeton Center suggested the Rule require disposal after a set
period unless the company can demonstrate a current need for the data
and that financial institutions periodically review their data
practices to minimize their data retention.\214\
---------------------------------------------------------------------------
\212\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 8; Electronic Privacy Information
Center (comment 55, NPRM), at 8; Consumer Reports (comment 52,
NPRM), at 7.
\213\ Consumer Reports (comment 52, NPRM), at 7-8.
\214\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 8-9.
---------------------------------------------------------------------------
Several other commenters opposed the disposal requirement as set
forth in the Proposed Rule. Some argued the requirement to dispose of
information goes beyond the Commission's authority under the GLB
Act.\215\ NADA argued the GLB Act does not ``contain[ ] any authority
to require financial institutions to delete any information'' and a
requirement to have procedures to delete information for which a
company has no legitimate business purpose would constitute a ``new
privacy regime.'' \216\ The American Financial Services Association
(AFSA) stated the requirement was too prescriptive and the Rule should
allow financial institutions to retain information as long as that
retention complies with the retention policy created by the financial
institution.\217\ AFSA further argued the proposed requirement exceeds
the Federal banking standards, pointing to the FFIEC Cybersecurity
Assessment Tool, which sets disposal of records ``according to
documented requirements and within expected time frames'' as a baseline
requirement for access and data management.\218\
---------------------------------------------------------------------------
\215\ National Automobile Dealers Association (comment 46,
NPRM), at 31; National Independent Automobile Dealers Association
(comment 48, NPRM), at 6.
\216\ National Automobile Dealers Association (comment 46,
NPRM), at 31-32.
\217\ American Financial Service Association (comment 41, NPRM),
at 6.
\218\ Cybersecurity Assessment Tool, FFIEC, https://www.ffiec.gov/pdf/cybersecurity/FFIEC_CAT_May_2017_Cybersecurity_Maturity_June2.pdf at 37 (last
visited December 3, 2020).
---------------------------------------------------------------------------
Yet other commenters suggested modifying the requirement. NADA
argued that if there was to be a disposal requirement, then it should
be modeled after the Disposal Rule, which requires businesses to
properly dispose of consumer reports, but does not have an explicit
requirement to dispose of information on any particular schedule.\219\
ACE suggested modifying the Proposed Rule to require disposal of
information only where there is no longer any ``legitimate purpose''
rather than any ``legitimate business purpose.'' \220\ It argued in
some cases a financial institution may have legitimate purposes for
retaining information that are not readily defined as ``business''
purposes, such as the retention of data by educational institutions for
institutional research or student analytics.\221\
---------------------------------------------------------------------------
\219\ National Automobile Dealers Association (comment 46,
NPRM), at 32.
\220\ American Council on Education (comment 24, NPRM), at 12.
\221\ Id.
---------------------------------------------------------------------------
The Commission believes requiring the disposal of customer
information for which the financial information has no legitimate
business purpose is within the authority granted by the GLB Act to
protect the security of customer information. The disposal of records,
both physical and digital, can result in exposure of customer
information if not performed properly.\222\ Similarly, if records are
retained when they are no longer necessary, there is a risk those
records will be subject to unauthorized access. The risk of
unauthorized access may be reasonable where the retention of data
provides some benefit. In situations where the information is no longer
needed for a legitimate business purpose, though, the risk to the
customer information becomes unreasonable because the retention is no
longer benefiting the customer or financial institution. Disposing of
unneeded customer information, therefore, is a vital part of protecting
customer information and serves the purpose of the GLB Act.\223\
---------------------------------------------------------------------------
\222\ See, e.g., Complaint, Rite Aid Corp., FTC No. 072-3121
(November 22, 2010) (alleging company failed to provide reasonable
data security when it failed to implement policies and procedures to
dispose securely of personal information).
\223\ As to the Princeton Center's suggestion financial
institutions periodically review their disposal practices (Princeton
University Center for Information Technology Policy (comment 54,
NPRM), at 8-9), the Commission believes this requirement is already
encompassed in the requirement contained in Sec. 314.4(g) to
periodically review their safeguards overall.
---------------------------------------------------------------------------
[[Page 70292]]
The Commission disagrees with commenters who suggested narrowing
the disposal requirement or doing away with it altogether. As noted
above, although no disposal requirement appears in FFIEC guidelines,
those guidelines represent a different regulatory approach and are not
an appropriate model for the Safeguards Rule.
Finally, as to setting retention periods or narrowing the
legitimate business purposes for which financial institutions may
retain customer information, the Commission recognizes financial
institutions need some flexibility. Whereas customers may want to, for
example, access and transfer older data in some circumstances, in other
circumstances, retaining such data would not be consistent with any
legitimate business purpose. The Commission believes the Princeton
Center's recommendation that companies be required to delete
information after a set period unless the information is still needed
for a legitimate business purpose properly balances the needs of
financial institutions with the need to protect customer information.
Thus, the Commission modifies proposed paragraph (c)(6) to require the
deletion of customer information two years after the last time the
information is used in connection with providing a product or service
to the customer unless the information is required for a legitimate
business purpose as paragraph (c)(6)(i) of the Final Rule. In addition,
paragraph (c)(6)(ii) of the Final Rule requires financial institutions
to periodically review their policies to minimize the unnecessary
retention of information.
Change Management
Proposed paragraph (c)(9) required financial institutions to adopt
procedures for change management.\224\ Change management procedures
govern the addition, removal, or modification of elements of an
information system.\225\ This paragraph required financial institutions
to develop procedures to assess the security of devices, networks, and
other items to be added to their information system, or the effect of
removing such items or otherwise modifying the information system. For
example, a financial institution that adds additional servers or other
machines to its information system would need to evaluate the security
of the new devices and the effect of adding them to the existing
network.
---------------------------------------------------------------------------
\224\ Proposed 16 CFR 314.4(c)(9).
\225\ See, e.g., Change Management, Rutgers OIT Information
Security Office, https://rusecure.rutgers.edu/content/change-management (last accessed 1 Dec. 2020).
---------------------------------------------------------------------------
Some commenters supported this requirement,\226\ while others
stated it was too broad and would impose unnecessary burdens on
financial institutions.\227\ In particular, NADA argued financial
institutions that have not made changes in their systems ``for some
time'' should not be required to create procedures for change
management.\228\ ACE argued including a change management requirement
is unnecessary because such a requirement is ``generally incorporated
into an organization's IT operations'' for non-security purposes and
the security considerations of those changes will be considered as part
of those procedures.\229\
---------------------------------------------------------------------------
\226\ Electronic Privacy Information Center (comment 55, NPRM),
at 8; National Consumer Law Center and others, (comment 58, NPRM) at
3.
\227\ American Council on Education (comment 24, NPRM), at 12-
13; National Automobile Dealers Association (comment 46, NPRM), at
33.
\228\ National Automobile Dealers Association (comment 46,
NPRM), at 32-33.
\229\ American Council on Education (comment 24, NPRM), at 12.
---------------------------------------------------------------------------
Alterations to an information system or network introduce
heightened risk of cybersecurity incidents; \230\ thus, it is important
to expressly require change management to be a part of an information
security program. The Commission agrees with ACE that many financial
institutions will already have change management procedures in place.
If those procedures adequately consider security issues involved in the
change, then they may satisfy this requirement.
---------------------------------------------------------------------------
\230\ See Remarks of Rocio Baeza, Safeguards Workshop Tr., supra
note 17, at 95 (``[E]very time there is a change to any of these
[network] environments, that is creating additional risk.'');
Remarks of Scott Wallace, Safeguards Workshop Tr., supra note 17, at
147-48 (giving an example of an incident in which network changes
led to the exposure of sensitive information); Remarks of Matthew
Green, Safeguards Workshop Tr., supra note 17, at 252 (noting it is
``a little dangerous'' to make ``major changes'' to an information
system at a time of heightened stress).
---------------------------------------------------------------------------
As to the comment a financial institution that has not made changes
to its environment in some time should not be required to have change
management processes, the Commission disagrees. Few information systems
can remain unchanged for a significant period of time, given the
changing technical requirements for business and security. Indeed, NADA
acknowledges financial institutions will need to ``adapt[] their
programs to keep up with changes in data security.'' \231\ For this
reason, all financial institutions must have procedures for when the
changes occur. As with all of the requirements of the Rule, though, the
exact nature of these procedures will vary depending on the size,
complexity and nature of the information system. A simple system may
have equally simple change management procedures.
---------------------------------------------------------------------------
\231\ National Automobile Dealers Association (comment 46,
NPRM), at 33 n.96.
---------------------------------------------------------------------------
The Commission adopts this proposed paragraph as paragraph (c)(7)
of the Final Rule without change.
System Monitoring
Proposed paragraph (c)(10) required financial institutions to
implement policies and procedures designed ``to monitor the activity of
authorized users and detect unauthorized access or use of, or tampering
with, customer information by such users.'' \232\ The Proposed Rule
required financial institutions to take steps to monitor those users
and their activities related to customer information in a manner
adapted to the financial institution's particular operations and needs.
---------------------------------------------------------------------------
\232\ Proposed 16 CFR 314.4(c)(10).
---------------------------------------------------------------------------
NADA stated this requirement would create unnecessary expense
because it would require financial institutions to ``continually
monitor all authorized use'' and would mean ``yet more new employees or
third-party IT consultants.'' \233\ The Commission disagrees, however,
noting that monitoring of system use can be automated.\234\ There is no
requirement a separate staff member would be required to exclusively
monitor system use.
---------------------------------------------------------------------------
\233\ National Automobile Dealer Association (comment 46, NPRM),
at 33.
\234\ See Remarks of Nicholas Weaver, Safeguards Workshop Tr.,
supra note 17, at 124-25.
---------------------------------------------------------------------------
In addition, one commenter stated monitoring the use of paper files
is impossible and should be excluded from this provision.\235\ The
Commission acknowledges monitoring of paper records is qualitatively
different than the monitoring of electronic records. This requirement
goes hand in hand with limiting access to documents, whether electronic
or paper. For example, if an institution has a file room and access to
the room is limited to particular employees (e.g., the payroll office),
the institution should have measures in place to ensure those access
controls are in fact being utilized (e.g., sign in with front desk,
logging of key card access, security camera).
---------------------------------------------------------------------------
\235\ American Financial Services Association (comment 41,
NPRM), at 6.
---------------------------------------------------------------------------
As discussed above, this paragraph is amended to also require the
logging of user activity, but is otherwise adopted as proposed as
paragraph (c)(8).
[[Page 70293]]
Proposed Paragraph (d)
Proposed paragraph (d)(1) retained the current Rule's requirement
that financial institutions ``[r]egularly test or otherwise monitor the
effectiveness of the safeguards' key controls, systems, and procedures,
including those to detect actual and attempted attacks on, or
intrusions into, information systems.''
Proposed paragraph (d)(2) provided further detail to this
requirement by stating the monitoring must take the form of either
``continuous monitoring'' or ``periodic penetration testing and
vulnerability assessments.'' The proposal explained continuous
monitoring is any system that allows real-time, ongoing monitoring of
an information system's security, including monitoring for security
threats, misconfigured systems, and other vulnerabilities.\236\ For
those who elected to engage in periodic penetration testing and
vulnerability assessment, the proposal required penetration testing at
least once annually (or more frequently if called for in the financial
institution's risk assessment) and vulnerability assessments at least
twice a year.\237\
---------------------------------------------------------------------------
\236\ Financial institutions that choose the option of
continuous monitoring would also be satisfying Sec. 314.4(c)(8).
\237\ Proposed 16 CFR 314.4(d)(1) and (2).
---------------------------------------------------------------------------
Some commenters thought the proposal went too far in requiring
continuous monitoring or penetration and vulnerability testing, while
others thought the proposal did not go far enough. On one hand, ACE
argued continuous monitoring is too burdensome and difficult for some
financial institutions,\238\ particularly those with ``highly
decentralized systems,'' such as colleges and universities, which could
be required to monitor their entire system.\239\ ACE further suggested
the Rule should not prescribe any particular testing methodology or
schedule and should allow financial institutions to develop a testing
approach appropriate for the financial institution.\240\ The NPA
commented penetration and vulnerability testing would be too expensive
for small pawnbrokers with small staffs and a small customer base,
where their members would be ``likely to notice a penetration of our
records.'' \241\ One commenter stated the requirements for monitoring
and testing were ``overlapping and confusing'' and suggested the
Commission avoid confusion by including continuous monitoring,
penetration testing, vulnerability scanning, periodic risk assessment
reviews, and logging as optional components of an information security
program to be included on an as-needed basis.\242\ Some commenters
recommended the testing requirement be limited to electronic data and
exclude monitoring of physical data.\243\ The American Financial
Services Association argued the testing of physical safeguards required
by paragraph (d)(1) ``would be impossible.'' \244\ Finally, CTIA
argued, for entities that choose the approach of penetration and
vulnerability testing, these tests should be required less
regularly.\245\
---------------------------------------------------------------------------
\238\ American Council on Education (comment 24, NPRM), at 13-
14.
\239\ American Council on Education (comment 24, NPRM), at 13.
\240\ American Council on Education (comment 24, NPRM), at 14.
\241\ National Pawnbrokers Association (comment 3, Workshop), at
2.
\242\ Global Privacy Alliance (comment 38, NPRM), at 10-11.
\243\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 6; American Financial Services Association
(comment 41, NPRM), at 6.
\244\ American Financial Services Association (comment 41,
NPRM), at 6.
\245\ CTIA (comment 34, NPRM) at 12-13 (arguing penetration
testing should be required only once every two years and
vulnerability testing be required only once a year).
---------------------------------------------------------------------------
On the other hand, the Princeton Center suggested, rather than
requiring either continuous monitoring or penetration testing, the Rule
should require both. It noted continuous monitoring is very effective
at detecting problems with, and threats to, ``off-the-shelf systems''
but penetration testing is better at ``for checking the interaction
between systems, proprietary systems, or subtle security issues.''
\246\ Similarly, the MSRT was concerned that the Proposed Rule
suggested annual penetration testing alone could protect financial
institutions, rather than serve as a supplement to proper
monitoring.\247\
---------------------------------------------------------------------------
\246\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 5.
\247\ Money Services Round Table (comment 53, NPRM), at 9; see
also Gusto and others (Comment 11, Workshop), at 2 (arguing
penetration testing and vulnerability assessments both have their
weaknesses and financial institutions should develop a testing
program that it is appropriate for them).
---------------------------------------------------------------------------
The Commission agrees with commenters who pointed out the
difficulty of applying certain testing requirements to physical
safeguards. Although the general testing requirement set forth in
paragraph (d)(1) should apply to physical safeguards (e.g., testing
effectiveness of physical locks), the continuous monitoring,
vulnerability assessment, and penetration testing in paragraph (d)(2)
is not relevant to information in physical form. Accordingly, the final
version of paragraph (d)(2) is limited to safeguards on information
systems.
The Commission also agrees biannual vulnerability testing may not
be sufficient to detect new threats. Thus, given the relative ease with
which vulnerability assessments can be performed, it modifies the Final
Rule to require financial institutions to perform assessments when
there is an elevated risk of new vulnerabilities having been introduced
into their information systems, in addition to the required biannual
assessments.
Beyond these modifications, the Commission believes the proposal
struck the right balance between flexibility and protection of customer
information, and adopts the proposed provision as final. For commenters
concerned about costs of testing and continuous monitoring, the
Commission notes the Rule requires one, not both. Although many
financial institutions may choose to use both, the Commission agrees
the costs of requiring both for all financial institutions may not be
justified. \248\ As to arguments that the testing required by the Rule
is too frequent and will therefore be too costly, the Commission does
not agree vulnerability assessments will be costly. Indeed, there are
resources for free and automated vulnerability assessments.\249\ And
although the Commission acknowledges penetration testing can be a
somewhat lengthy and costly process for large or complex systems,\250\
a longer period between penetration tests will leave information
systems vulnerable to attacks that exploit weaknesses normally revealed
by penetration testing.
---------------------------------------------------------------------------
\248\ The Commission believes a system for continuous monitoring
will include some form of vulnerability assessment as part of
monitoring the information system.
\249\ Remarks of Frederick Lee, Safeguards Workshop Tr., supra
note 17, at 139-40.
\250\ See id. at 129-30 (noting the cost of a penetration test
can increase significantly depending on the complexity of the system
to be tested and the scope of the test).
---------------------------------------------------------------------------
Two other portions of the Final Rule should help financial
institutions concerned about the costs of monitoring and testing.
First, because the Commission is limiting the definition of
``information system'' in the Final Rule, financial institutions will
be able to limit this provision's application by segmenting their
network and conducting monitoring or testing only of systems that
contain customer information or that are connected to such systems.
Second, this requirement does not apply to those institutions that
[[Page 70294]]
maintain records on fewer than 5,000 individuals. Accordingly, for
example, it should not apply to businesses small enough for staff to
personally know a majority of customers.
Finally, the Commission does not believe the testing requirements
are duplicative of other provisions of the Final Rule. The provision
relating to additional risk assessments, Sec. 314.4(b)(2), requires a
financial institution to reevaluate its risks and to determine if
safeguards should be modified or added--it does not require testing to
detect threats and technical vulnerabilities in the existing system.
Section 313.4(c)(8)'s requirement that financial institutions monitor
users' activity in an information system is focused on one aspect of
information security--detecting and preventing unauthorized access and
use of the system. The requirement of this paragraph, on the other
hand, is focused on testing the overall effectiveness of a financial
institution's safeguards. It is broader than paragraph (c)(8)'s
requirement and is necessary to ensure financial institutions test the
strength of their safeguards as a whole.
Accordingly, the Final Rule requires financial institutions to
perform vulnerability assessments at least once every six months and,
additionally, whenever there are material changes to their operations
or business arrangements and whenever there are circumstances they know
or have reason to know may have a material impact on their information
security program.
Proposed Paragraph (e)
Proposed paragraph (e) set forth a requirement that financial
institutions implement policies and procedures ``to ensure that
personnel are able to enact [the financial institution's] information
security program.'' This requirement included four components: (1)
General employee training; (2) use of qualified information security
personnel; (3) specific training for information security personnel;
and (4) verification that security personnel are taking steps to
maintain current knowledge on security issues.
General Employee Training
Proposed paragraph (e)(1) required financial institutions to
provide their personnel with ``security awareness training that is
updated to reflect risks identified by the risk assessment.'' \251\
---------------------------------------------------------------------------
\251\ Proposed 16 CFR 314.4(e)(1).
---------------------------------------------------------------------------
While one commenter specifically supported the inclusion of this
training requirement,\252\ the U.S. Chamber of Commerce argued the Rule
should not have any specific training requirements at all.\253\ NADA
stated the requirement that the training be ``updated to reflect risks
identified by the risk assessment'' will require companies to develop
individualized training programs to suit their financial institution
and that such a process would be expensive and unnecessary because
``general security awareness'' is generally enough for most financial
institutions.\254\
---------------------------------------------------------------------------
\252\ Electronic Privacy Information Center (comment 55, NPRM),
at 8.
\253\ U.S. Chamber of Commerce (comment 33, NPRM), at 12; see
also American Financial Services Association (comment 41, NPRM), at
6 (stating the Commission should acknowledge that a training program
for a small financial institution will be different than a program
for a larger program).
\254\ National Automobile Dealers Association (comment 46,
NPRM), at 34.
---------------------------------------------------------------------------
Given the current Rule includes a similar training requirement and
training remains a vital part of effective information security, the
Commission declines to eliminate it. The Commission believes the Final
Rule's training requirement retains the same flexibility as the
existing Rule and allows financial institutions to adopt a training
program appropriate to their organization.
The Commission disagrees with NADA's concern the requirement to
update training programs would be too expensive. Without a requirement
that the training program be updated based on an assessment of risks,
employees may be subject to the same training year after year, which
might reflect obsolete threats, as opposed to addressing current ones.
The Commission interprets this provision to require only that the
training program be updated as necessary based on changes in the
financial institution's risk assessment. The provision also gives
financial institutions the flexibility to use programs provided by a
third party, if that program is appropriate for the financial
institution. In order to clarify updates are required only when needed
by changes in the financial institution or new security threats,
though, the Final Rule states training programs need to be updated only
``as necessary.''
Information Security Personnel
Proposed paragraph (e)(2) required financial institutions to
``[u]tiliz[e] qualified information security personnel,'' employed
either by them or by affiliates or service providers, ``sufficient to
manage [their] information security risks and to perform or oversee the
information security program.'' \255\ This proposed provision was
designed to ensure information security personnel used by financial
institutions are qualified for their positions and information security
programs are sufficiently staffed.
---------------------------------------------------------------------------
\255\ Proposed 16 CFR 314.4(e)(2).
---------------------------------------------------------------------------
Some commenters argued this provision was too vague because it does
not define what personnel are necessary and what ``qualified''
means.\256\ NADA argued hiring additional staff to meet this
requirement could be prohibitively expensive.\257\
---------------------------------------------------------------------------
\256\ National Automobile Dealers Association (comment 46,
NPRM), at 35; National Independent Automobile Dealers Association
(comment 48, NPRM), at 7.
\257\ National Automobile Dealers Association (comment 46,
NPRM), at 35.
---------------------------------------------------------------------------
As discussed in relation to the appointment of a ``Qualified
Individual,'' the Commission believes a more specific definition of
``qualified'' would not be appropriate because each financial
institution has different needs and different levels of training,
experience, and expertise will be appropriate for the information
security staff of each institution. The term ``qualified'' conveys only
that staff must have the abilities and expertise to perform the duties
required by the information security program.\258\ The Commission
declines to include a more prescriptive set of qualification
requirements in the Final Rule.\259\
---------------------------------------------------------------------------
\258\ NADA also asks whether this provision would require
financial institutions to hire more personnel if they do not have
enough qualified staff. Id. The Final Rule does require the hiring
of additional personnel if existing personnel are not enough to
maintain the financial institution's information security program.
\259\ One commenter, on the other hand, approved of the decision
not to define ``qualified'' in the Proposed Rule, but argued the
requirement in its totality was unclear because it did not set forth
``how the Commission would hold covered entities accountable.''
American Council on Education (comment 24, NPRM) at 14. The
Commission believes the term ``qualified'' provides a clear enough
requirement to allow a financial institution's compliance to be
evaluated.
---------------------------------------------------------------------------
As to the concern about expense, the Commission acknowledges hiring
employees or retaining third parties to maintain financial
institutions' information security programs can be a substantial
expense. But the expense is necessary to effectuate Congressional
intent that financial institutions implement reasonable safeguards to
protect customer information. The Rule requires only that a financial
institution have personnel ``sufficient'' to manage its risk and to
maintain its information security program. A financial institution is
required only to have the staff necessary to maintain its information
security. An information security program that is not properly
maintained cannot offer the protection it is designed to provide. A
financial institution that
[[Page 70295]]
does not comply with this requirement, by definition, has insufficient
staffing, and thus, cannot reasonably protect customer information.
Although the expense is necessary, the level of expense is
mitigated by several factors. First, existing financial institutions
should already have information security personnel (either in the form
of employees or third-party service providers) qualified to perform the
duties necessary to maintain reasonable security in order to comply
with the requirements of the current Rule. Depending on the skills of
those employees, additional staffing may not be necessary to meet the
demands of the Final Rule. Second, the required staffing will vary
greatly based on the size and complexity of the information system. A
financial institution with an extremely simple system may not require
even a single full time employee. Finally, the Rule allows the use of
service providers to meet this requirement. This can significantly
reduce costs as services exist to share the expense of qualified
personnel and offer information security support at significantly less
than the cost of employing a single qualified employee.\260\ The
Commission continues to believe utilizing qualified and sufficient
information security personnel is a vital part of any information
security program and accordingly, adopts proposed paragraph (e)(2) in
the Final Rule without modification.
---------------------------------------------------------------------------
\260\ See, e.g., Slides Accompanying Remarks of Rocio Baeza,
``Models for Complying to the Safeguards Rule Changes,'' in
Safeguards Workshop Slides, supra note 72, at 27-28 (describing
three different compliance models: In-house, outsource, and hybrid,
with costs ranging from $199 per month to more than $15,000 per
month); see also remarks of Rocio Baeza, Safeguards Workshop Tr.,
supra note 17, at 81-83; slides Accompanying Remarks of Brian
McManamon, ``Sample Pricing,'' in Safeguards Workshop Slides, supra
note 72, at 29 (estimating the cost of cybersecurity services based
on number of endpoints); Remarks of Brian McManamon, Safeguards
Workshop Tr., supra note 17, at 83-85.
---------------------------------------------------------------------------
Training of Security Personnel
The Proposed Rule also required financial institutions to
``[p]rovid[e] information security personnel with security updates and
training sufficient to address relevant security risks.'' \261\ This is
separate from paragraph (e)(1)'s requirement to train all personnel
generally.
---------------------------------------------------------------------------
\261\ Proposed 16 CFR 314.4(e)(3).
---------------------------------------------------------------------------
Some commenters argued providing ongoing training could be too
costly for some financial institutions.\262\ The Commission disagrees.
Maintaining awareness of emerging threats and vulnerabilities is a
critical aspect of information security. In order to perform their
duties, security personnel must be educated on the changing nature of
threats to the information systems they maintain. There are resources
that will allow smaller institutions to meet this requirement at little
or no cost, such as published security updates, online courses, and
educational publications.\263\ For financial institutions that utilize
service providers to meet information security needs, the service
provider is likely to include assurances that provided personnel will
be trained in current security practices. The Commission views the use
of such a service provider as meeting this requirement, as the
financial institution is ``providing'' the service as part of the price
it pays to the service provider. Thus, the Final Rule adopts paragraph
(e)(3) as proposed.\264\
---------------------------------------------------------------------------
\262\ National Automobile Dealers Association (comment 46,
NPRM), at 35.
\263\ See, e.g., Federal Trade Commission, Cybersecurity for
Small Business, https://www.ftc.gov/tips-advice/business-center/small-businesses/cybersecurity (last accessed 1 Dec. 2020); Remarks
of Kiersten Todt, Safeguards Workshop Tr. at 86-88 (describing the
resources of the Cyber Readiness Institute).
\264\ The Clearing House suggested the Rule should require
background checks on employees. The Clearing House (Comment 49,
NPRM) at 19.
---------------------------------------------------------------------------
Verification of Current Knowledge
Proposed paragraph (e)(4) required financial institutions to
``[v]erify[ ] that key information security personnel take steps to
maintain current knowledge of changing information security threats and
countermeasures.'' \265\ This requirement was intended to complement
the proposed requirement regarding ongoing training of data security
personnel, by requiring verification such training has taken place.
---------------------------------------------------------------------------
\265\ Proposed 16 CFR 314.4(e)(4).
---------------------------------------------------------------------------
NADA argued this requirement should not apply to smaller financial
institutions, stating the examples set forth in the Proposed Rule would
be difficult for some smaller financial institutions to perform.\266\
The examples provided with the Proposed Rule were that a financial
institution could: (1) Offer incentives or funds for key personnel to
undertake continuing education that addresses recent developments, (2)
include a requirement to stay abreast of security research as part of
their performance metrics, or (3) conduct an annual assessment of key
personnel's knowledge of threats related to their information system.
The Commission believes smaller financial institutions can take
advantage of any of these methods, particularly ``requiring key
personnel to undertake continuing education'' as part of that
personnel's duties. If they outsource responsibility for data security
to service providers, they can simply include these requirements in
their contracts.
---------------------------------------------------------------------------
\266\ National Automobile Dealers Association (comment 46,
NPRM), at 35-36.
---------------------------------------------------------------------------
The Commission believes the rapidly changing nature of information
security mandates this requirement, in order that information security
leadership can properly supervise the information security program.
Accordingly, the Final Rule adopts proposed paragraph (e)(4) without
change.
Proposed Paragraph (f)
Proposed paragraphs (f)(1) and (2) retained the current Rule's
requirement, found in existing paragraphs (d)(1) and (2), to oversee
service providers, and added a paragraph (f)(3), requiring financial
institutions also periodically assess service providers ``based on the
risk they present and the continued adequacy of their safeguards.''
\267\ The current Rule expressly requires an assessment of service
providers' safeguards only at the onboarding stage; proposed paragraph
(f)(3) required financial institutions to monitor their service
providers on an ongoing basis to ensure they are maintaining adequate
safeguards to protect customer information they possess or access.\268\
---------------------------------------------------------------------------
\267\ Proposed 16 CFR 314.4(g).
\268\ The Clearing House wrote in support of this element of the
Proposed Rule, noting it would bring the Safeguards Rule's
provisions relating to service provider oversight into better
alignment with security guidelines for banks. The Clearing House
(comment 49, NPRM), at 14.
---------------------------------------------------------------------------
Several commenters argued it would be costly and difficult for some
financial institutions to periodically assess their service
providers.\269\ These commenters were particularly concerned with
smaller financial institutions' ability to ``monitor'' larger service
providers.\270\ The Internet Association commented the requirement to
periodically assess service providers would be too onerous for the
service providers themselves, arguing the requirement would place
``service providers under constant surveillance by their financial
institution clients.'' \271\ HITRUST suggested the Rule should state
the periodic assessment requirement may be satisfied by requiring
service providers to obtain and maintain information
[[Page 70296]]
security certifications provided by third parties and based on proper
information security frameworks.\272\ In contrast, Consumer Reports
took issue with the Rule requiring only ``assessment'' of service
providers, and argued financial institutions should be required to
monitor their service providers for compliance.\273\ Yet other
commenters expressed confusion over the term ``service provider,''
asking whether it would cover national consumer reporting agencies that
smaller financial institutions would be hard-pressed to assess.\274\
---------------------------------------------------------------------------
\269\ National Automobile Dealers Association (comment 46,
NPRM), at 37; National Independent Automobile Dealers Association
(comment 48, NPRM), at 7; see also Wangyang Shen (comment 3, Privacy
Rule) (noting difficulty of supervising cloud services).
\270\ National Automobile Dealers Association (comment 46,
NPRM), at 22; National Association of Dealer Counsel (comment 44,
NPRM), at 3.
\271\ Internet Association (comment 9, Workshop), at 3-4.
\272\ HITRUST (comment 18, NPRM), at 3-4.
\273\ Consumer Reports (comment 52, NPRM) at 7.
\274\ American Financial Services Association (comment 41,
NPRM), at 7.
---------------------------------------------------------------------------
The Commission retains the service provider oversight requirement
from proposed paragraph (f) without modification. Some high profile
breaches have been caused by service providers' security failures,\275\
and the Commission views the regular assessment of the security risks
of service providers as an important part of maintaining the strength
of a financial institution's safeguards.
---------------------------------------------------------------------------
\275\ For example, in 2013, attackers were reportedly able to
use stolen credentials obtained from a third-party service provider
to access a customer service database maintained by national
retailer Target Corporation, resulting in the theft of information
relating to 41 million customer payment card accounts. Kevin McCoy,
Target to pay $18.5M for 2013 data breach that affected 41 million
consumers, USA Today, May 23, 2017, https://www.usatoday.com/story/money/2017/05/23/target-pay-185m-2013-data-breach-affected-consumers/102063932/.
---------------------------------------------------------------------------
The Commission disagrees with the commenters who expressed concerns
this provision, and particularly the assessment requirement, would
impose undue costs on financial institutions. The Rule would require
financial institutions only to assess the risks service providers
present and evaluate whether they continue to provide the safeguards
required by contract, which need not include extensive investigation of
a service provider's systems. In the case of large service providers,
this oversight may consist of reviewing public reports of insecure
practices, changes in the services provided, or security failures in
the services provided. In other circumstances, such as where a large
company hires a vendor to secure sensitive customer information,
certifications, reports, or even third-party audits may be appropriate.
The exact steps required depend both on the size and complexity of the
financial institution and the nature of the services provided by the
service provider. For this reason, the Commission declines to adopt the
suggestion to allow a financial institution to accept an information
security certification from the service provider to satisfy the service
provider oversight requirement. The fact that a company maintains an
information security certification may be a significant part of
assessing the adequacy of a service provider's safeguards, but the
Commission declines to prescribe a one-size-fits all approach, given
the variation in size and complexity of financial institutions and
their service providers.
To avoid imposing undue costs on financial institutions, the
Commission declines to require ongoing monitoring, rather than periodic
assessment, as recommended by Consumer Reports. The Commission believes
periodic assessment strikes the right balance between protecting
consumers and imposing undue costs on financial institutions. The
Commission acknowledges financial institutions may have limited
bargaining power in obtaining services from large service providers and
limited ability to demand access to a service provider's systems. In
those cases, any sort of hands-on assessment of the provider's systems
may not be possible.
As to the concern the assessment requirement will impose undue
burdens on the service providers themselves, the Commission does not
believe this concern justifies a modification to the proposed
requirement. First, the Rule does not require ``constant surveillance''
by financial institutions--they are required only to ``periodically
assess'' the risks presented by service providers. Second, as discussed
above, the supervision of service providers is a vitally important
aspect of information security, and while there may be some burdens on
the service providers associated with being supervised, these are
necessary burdens. A financial institution must be sure a service
provider is protecting the information of its customers, and any
expenses this involves are a necessary part of fulfilling this duty.
Finally, as to concerns about potential ambiguities in the
definition of service provider, the amendments preserve the definition
in the current Rule. Thus, entities subject to this requirement under
the Final Rule will remain the same as under the existing Rule and may
include consumer reporting agencies. As discussed above, even larger
service providers such as national CRAs can be subjected to some form
of review by financial institutions.\276\
---------------------------------------------------------------------------
\276\ The National Pawnbrokers Association expressed concern
they cannot control vendors of local law enforcement agencies to
whom they are required to provide customer information. National
Pawnbrokers Association (comment 32, NPRM), at 2. However, the Rule
does not require financial institutions oversee service providers
employed by other entities over which they have no control.
---------------------------------------------------------------------------
The Commission adopts proposed paragraph (f) in the Final Rule
without modification.
Proposed Paragraph (g)
Paragraph (g) of the Proposed Rule retained the language of
existing paragraph (e) in the current Rule, which requires financial
institutions to evaluate and adjust their information security programs
in light of the result of testing required by this section, material
changes to their operations or business arrangements, or any other
circumstances they know or have reason to know may have a material
impact on their information security program. The Commission received
no comments on this paragraph and adopts the language of the Proposed
Rule.
Proposed Paragraph (h)
Proposed paragraph (h) required financial institutions to establish
written incident response plans that addressed (1) the goals of the
plan; (2) the internal processes for responding to a security event;
(3) the definition of clear roles, responsibilities and levels of
decision-making authority; (4) external and internal communications and
information sharing; (5) identification of requirements for the
remediation of any identified weaknesses in information systems and
associated controls; (6) documentation and reporting regarding security
events and related incident response activities; and (7) the evaluation
and revision as necessary of the incident response plan following a
security event.
Several commenters supported the proposal to require an incident
response plan.\277\ The Credit Union National Association observed an
incident response plan ``helps ensure that an entity is prepared in
case of an incident by planning how it will respond and what is
required for the response.'' \278\ Consumer Reports noted a rapid
response to a security event can limit damage caused by the event.\279\
The
[[Page 70297]]
Princeton Center commented ``a written incident response plan is an
essential component of a good security system.'' \280\ HITRUST
commented incident response plans can help organizations ``to better
allocate limited resources.'' \281\ The South Carolina Department of
Consumer Affairs suggested the provision go further by requiring the
incident response plan include a process for notifying senior
information security personnel of the event.\282\
---------------------------------------------------------------------------
\277\ Consumer Reports (comment 52, NPRM), at 6; Princeton
University Center for Information Technology Policy (comment 54,
NPRM), at 7; Electronic Privacy Information Center (comment 55,
NPRM), at 8; Credit Union National Association (comment 30, NPRM),
at 2; Heartland Credit Union Association (comment 42, NPRM), at 2;
National Association of Federally-Insured Credit Unions (comment 43,
NPRM), at 1; HITRUST (comment 18, NPRM), at 2.
\278\ Credit Union National Association (comment 30, NPRM), at
2.
\279\ Consumer Reports (comment 52, NPRM), at 6.
\280\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 7.
\281\ HITRUST (comment 18, NPRM), at 2.
\282\ South Carolina Department of Consumer Affairs (comment 47,
NPRM), at 2.
---------------------------------------------------------------------------
Other commenters opposed requiring an incident response plan or
objected to particular aspects of the requirement. Some commenters
suggested requiring financial institutions to have incident response
plans is outside the Commission's authority under the GLB Act.\283\
NADA argued the requirement for an incident response plan was overbroad
in light of the broad definition of security event,\284\ and the
requirement was vague as to what the plan should include.\285\
---------------------------------------------------------------------------
\283\ National Automobile Dealer Association (comment 46, NPRM),
at 38; National Independent Automobile Dealers Association (comment
48, NPRM), at 7.
\284\ National Automobile Dealer Association (comment 46, NPRM),
at 38.
\285\ National Automobile Dealer Association (comment 46, NPRM),
at 12, 38-39. NPA also asked for greater detail on what constitutes
an ``incident.'' National Pawnbroker Association (comment 32, NPRM),
at 4.
---------------------------------------------------------------------------
Other commenters argued the requirement was too burdensome. ACE
argued ``the range of security events that might occur and their
potential impacts on institutional capacity to recover'' make
establishing an incident response plan that will allow an institution
to ``respond to, and recover from, any security event materially
affecting . . . customer information'' impossible.\286\ The Mortgage
Bankers Association (``MBA'') suggested ``institutions of smaller sizes
may not necessarily be capable of addressing all seven of the proposed
goals.'' \287\ Further, the MBA argued an incident response plan
requirement had ``the potential to cripple small businesses under the
pressure of repeatedly checking the boxes for potentially harmless
events.'' \288\
---------------------------------------------------------------------------
\286\ American Council on Education (comment 24, NPRM), at 15.
\287\ Mortgage Bankers Association (comment 26, NPRM), at 4.
\288\ Mortgage Bankers Association (comment 26, NPRM), at 4.
---------------------------------------------------------------------------
Finally, some commenters raised questions about what it means for
customer information to be in a financial institution's ``possession''
for purposes of the incident response plan requirement. ACE argued the
requirement does not adequately account for customer information held
in cloud storage operated by third parties, asserting such information
is not technically within the financial institution's possession.\289\
ACE suggested the provision should apply to customer information for
which the financial institution is responsible, instead.\290\
Relatedly, the NPA expressed concern pawnbrokers might be subject to
liability under the Proposed Rule when law enforcement agencies or
their third-party vendors make public disclosures of customer
information pawnbrokers are obligated to report.\291\
---------------------------------------------------------------------------
\289\ American Council on Education (comment 24, NPRM), at 15.
\290\ Id.
\291\ National Pawnbroker Association (comment 32, NPRM), at 4.
---------------------------------------------------------------------------
The Commission retains the requirement for financial institution to
develop and implement an incident response plan, with one modification
described below. The Commission believes the creation of an incident
response plan is directly related to safeguarding customer information
and is within its authority under the GLBA. The requirement to create
an incident response plan focuses on preparing financial institutions
to respond promptly and appropriately to security events, and
mitigating any weaknesses in their information systems in the process.
By responding quickly and promptly mitigating weaknesses, financial
institutions can stop ongoing or future compromise of customer
information.\292\ A well-organized response to a security event can
limit the number of consumers affected by an outside attacker by
promptly identifying the attack and taking steps to stop the attack.
---------------------------------------------------------------------------
\292\ See Remarks of Serge Jorgenson, Safeguards Workshop Tr.,
supra note 17, at 52 (observing a prompt response to an incident can
prevent a ``threat actor running around in my environment for days,
months, years, and able to access anything they want.'').
---------------------------------------------------------------------------
The Commission disagrees with the commenters who stated this
requirement was too burdensome. The Final Rule requires incident
response plans address ``security event[s] materially affecting the
confidentiality, integrity, or availability of customer information in
[a financial institution's] control.'' Significantly, the plan must
address events that ``materially'' affect customer information. Thus,
the required incident response plan does not require a plan to address
every security event that may occur. The plan need not include minute
details or all possible scenarios. Instead, the Rule requires the plan
to establish a system--for example, by laying out clear lines of
responsibility, systems for information sharing, and methods for
evaluating possible solutions--that will facilitate a financial
institution's response to security events regardless of the nature of
the event. A detailed approach may be appropriate for some financial
institutions, such as those with especially complicated systems or
personnel hierarchies, but the Rule is designed to give financial
institutions the flexibility needed to develop plans that best suit
their needs.\293\
---------------------------------------------------------------------------
\293\ Although the Commission agrees with the South Carolina
Department of Consumer Affairs that notification of senior personnel
is valuable, the requirement that the plan address ``the definition
of clear roles, responsibilities and levels of decision-making
authority'' will almost always result in communication of decision-
making to senior personnel authorized to make decisions about the
security response. Coupled with the requirement the Qualified
Individual report to the board or equivalent body on material events
affecting security, the Commission does not see the need to make
this change.
---------------------------------------------------------------------------
Moreover, the Commission believes the requirement is clear as to
what an incident response plan should include. The seven listed
requirements for the incident response plans provide sufficient
guidance to financial institutions designing incident response plans
while giving them flexibility to design a plan suited to their
organization. In addition, there are many resources for designing
incident response plans available for financial institutions, as well
as service providers that can assist with the design process.\294\
Individual institutions can determine the exact details of the plans.
---------------------------------------------------------------------------
\294\ See, e.g., FTC, Data Breach Response: A Guide for Business
(2019), www.ftc.gov/tips-advice/business-center/guidance/data-breach-response-guide-business; NIST, Guide for Cybersecurity Event
Recovery (2016), nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-184.pdf; Orion Cassetto, Incident Response Plan 101: How
to Build One, Templates and Examples, Exabeam: Information Security
Blog (November 21, 2018), www.exabeam.com/incident-response/incident-response-plan/ (last visited December 2, 2020).
---------------------------------------------------------------------------
To address questions about whether information is in the financial
institution's ``possession,'' the Commission is revising paragraph (h)
of the Final Rule to require financial institutions develop incident
response plans ``designed to promptly respond to, and recover from, any
security event materially affecting . . . customer information in your
control.'' (emphasis added) Replacing the term ``possession'' with
``control'' resolves the questions raised by ACE and the NPA regarding
[[Page 70298]]
whether financial institutions must plan for security events affecting
data that has been transferred to various kinds of third parties. Where
a financial institution has voluntarily opted to store its customer
information in the cloud, to whatever extent the information is no
longer in the ``possession'' of the financial institution, it is
certainly within the institution's ``control.'' By contrast, customer
information that has been obtained by a third party such as a law
enforcement agency, over whom a financial institution has no authority
and of whose actions the financial institution has no knowledge, cannot
fairly be said to be in the financial institution's control.
Consequently, the financial institution need not account for possible
disclosures of that information by the third party.\295\
---------------------------------------------------------------------------
\295\ NADA further argued the incident response plan constitutes
a de facto consumer notification requirement. National Automobile
Dealer Association (comment 46, NPRM), at 39. Financial institutions
have an independent obligation to perform notification as required
by state law, whether or not they have an incident response plan in
place. The fact that the Rule requires a plan that sets forth
procedures for satisfying that requirement does not impose any
independent notification requirement on the financial institution.
---------------------------------------------------------------------------
Notification of Security Events to the Commission
The Commission also requested comment on whether the Rule should
require financial institutions to report security events to the
Commission. Several commenters supported this requirement.\296\ The
Princeton University Center for Information Technology Policy noted
such a reporting requirement would ``provide the Commission with
valuable information about the scope of the problem and the
effectiveness of security measures across different entities'' and
``help the Commission coordinate responses to shared threats.'' \297\
The National Association of Federally-Insured Credit Unions argued
requiring financial institutions to report security events to the
Commission would provide an ``appropriate incentive for covered
financial companies to disclose information to consumers and relevant
regulatory bodies.'' \298\ NAFCU also suggested notification
requirements are important because they ``ensure independent assessment
of whether a security incident represents a threat to consumer
privacy.'' \299\
---------------------------------------------------------------------------
\296\ Consumer Reports (comment 52, NPRM), at 6; Princeton
University Center for Information Technology Policy (comment 54,
NPRM), at 7; Credit Union National Association (comment 30, NPRM),
at 2; Heartland Credit Union Association (comment 42, NPRM), at 2;
National Association of Federally-Insured Credit Unions (comment 43,
NPRM), at 1-2.
\297\ Princeton University Center for Information Technology
Policy (comment 54, NPRM), at 7.
\298\ National Association of Federally-Insured Credit Unions
(comment 43, NPRM), at 1.
\299\ National Association of Federally-Insured Credit Unions
(comment 43, NPRM), at 1-2.
---------------------------------------------------------------------------
Other commenters opposed the inclusion of a reporting
requirement.\300\ ACE argued such a requirement ``would simply add
another layer on top of an already crowded list of federal and state
law enforcement contacts and state breach reporting requirements.''
\301\ ACE also suggested any notification requirement should be limited
to a more restricted definition of ``security event'' than the
definition in the Proposed Rule, so financial institutions would only
be required to report incidents that could lead to consumer harm.\302\
---------------------------------------------------------------------------
\300\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 7; American Council on Education (comment 24,
NPRM), at 15.
\301\ American Council on Education (comment 24, NPRM), at 15.
\302\ Id.
---------------------------------------------------------------------------
The Commission agrees with commenters that stated a requirement
financial institutions report security events to the Commission would
have many benefits, including allowing the Commission to identify
emerging threats and assisting the Commission's enforcement of the
Rule. In addition, such a requirement would be unlikely to create a
significant burden on financial institutions because a security event
that leads to notification to the Commission is very likely to create
breach notification obligations under various state laws, and the
financial institution will thus already be engaged in notifying
consumers and state regulators. The addition of a notification to the
FTC would not require any significant additional preparation or effort.
However, because the notice of proposed rulemaking did not set forth a
detailed proposal for a notification requirement, the Final Rule does
not include such a requirement. Instead, the Commission is issuing a
supplemental notice of proposed rulemaking (SNPRM) that proposes adding
a requirement financial institutions notify the Commission of detected
security events under certain circumstances.\303\
---------------------------------------------------------------------------
\303\ Standards for Safeguarding Customer Information, SNPRM,
published elsewhere in this issue of the Federal Register.
---------------------------------------------------------------------------
Proposed Paragraph (i)
Proposed paragraph (i) required a financial institution's CISO to
``report in writing, at least annually, to [the financial
institution's] board of directors or equivalent governing body''
regarding the following information: (1) The overall status of the
information security program and financial institution's compliance
with the Safeguards Rule; and (2) material matters related to the
information security program, addressing issues such as risk
assessment, risk management and control decisions, service provider
arrangements, results of testing, security events or violations and
management's responses thereto, and recommendations for changes in the
information security program.\304\ For financial institutions that did
not have a board of directors or equivalent, the proposal required the
CISO to make the report to a senior officer responsible for the
financial institution's information security program.
---------------------------------------------------------------------------
\304\ Proposed 16 CFR 314.4(i).
---------------------------------------------------------------------------
One commenter supported this requirement.\305\ Additionally,
several workshop participants emphasized the value of communication
between information security leaders and corporate boards or their
equivalent. For example, workshop participant Michele Norin stated it
is ``important'' for the topic of information security to be discussed
at the level of the board or senior leadership regularly, and at least
once per year.\306\ Participant Adrienne Allen agreed annual reporting
made sense as a requirement, but noted for some financial institutions,
particularly those with an online presence, even more frequent
communication could be beneficial.\307\
---------------------------------------------------------------------------
\305\ Rocio Baeza (comment 12, Workshop), at 3-8 (supporting
requirement and providing sample report form and compliance
questionnaire); see also The Clearing House (comment 49, NPRM), at
15-16 (arguing that Rule should require more involvement from Board
and senior management).
\306\ Remarks of Michele Norin, Safeguards Workshop Tr., supra
note 17, at 194.
\307\ Remarks of Adrienne Allen, Safeguards Workshop Tr., supra
note 17, at 199-200.
---------------------------------------------------------------------------
ACE argued the Proposed Rule created too much emphasis on a single
annual report and should instead focus on regular reporting to the
Board or equivalent.\308\ It also expressed concern the report required
by the Proposed Rule would be too detailed and would not allow the
Board to see ``the forest for the trees,'' \309\ the requirements for
the report were too prescriptive, and the requirements focused too much
on compliance rather than security.\310\ Similarly, NADA argued the
report would not improve security but would instead create
``unnecessary liability exposure for the board/leadership of the
entity.'' \311\ HITRUST suggested
[[Page 70299]]
Qualified Individuals should be able to meet this reporting requirement
by submitting a report from an information security certification
program to the Board or equivalent body.\312\
---------------------------------------------------------------------------
\308\ American Council on Education (comment 24, NPRM), at 16.
\309\ Id.
\310\ Id.
\311\ National Automobile Dealer Association (comment 46, NPRM),
at 41. NADA also argued the reports by third-party Qualified
Individuals might not include useful information and were ``more
likely to be filled with platitudes and/or efforts to `upsell' the
dealership on additional CISO services.'' Id. at 42. NADA provided
no support for this claim. The Commission notes such a report would
not meet the requirements of this provision, and the financial
institution would be justified in terminating their relationship
with that provider or, at least, demanding a revised report that did
meet those requirements.
\312\ HITRUST (comment 18, NPRM), at 4.
---------------------------------------------------------------------------
The Commission adopts the proposal as final, with one modification
discussed below. This provision is intended to ensure the governing
body of the financial institution is engaged with and informed about
the state of the financial institution's information security program.
Likewise, this will create accountability for the Qualified Individual
by requiring him or her to set forth the status of the information
security program for the governing body.\313\ This will help financial
institutions to ensure their information security programs are being
maintained appropriately and given the necessary resources. Written
reports will create a record of decisions made and the information upon
which they were based, which may aid future decision-making.\314\
Management involvement in information security programs can improve the
strength of those programs and help to reduce breaches.\315\
---------------------------------------------------------------------------
\313\ See Remarks of Karthik Rangarajan, Safeguards Workshop
Tr., supra note 17, at (``If quarter over quarter, year over year,
this watermark isn't reducing, then board of directors should be
able to challenge us and say maybe you're not mapping your risks
correctly, or vice versa if it's reducing but we're seeing more
incidents, we're seeing potential breaches, things like that, then
the board of directors should be able to say maybe you don't have
the right risk quantification framework or the right risk management
framework.'').
\314\ Workshop participants Adrienne Allen, Karthik Rangarajan,
and Michele Norin each emphasized this point. See Safeguards
Workshop Tr., supra note 17, pp. 201-09.
\315\ See Juhee Kwon Jackie Rees Ulmer, & Tawei Wang, The
Association Between Top Management Involvement and Compensation and
Information Security Breaches, Journal of Information Systems,
Spring 2013, at 219-236 (``. . . the involvement of an IT executive
decreases the probability of information security breach reports by
about 35 percent . . .''); Julia L. Higgs, Robert E. Pinsker, Thomas
Joseph Smith, & George Young, The Relationship Between Board-Level
Technology Committees and Reported Security Breaches, Journal of
Information Systems, Fall 2016, at 79-98 (``[A]s a technology
committee becomes more established, its firm is not as likely to be
breached. To obtain further evidence on the perceived value of a
technology committee, this study uses a returns analysis and finds
that the presence of a technology committee mitigates the negative
abnormal stock returns arising from external breaches.'').
---------------------------------------------------------------------------
The Commission disagrees with the commenters who stated the
reporting requirement would be too prescriptive. In fact, the language
only requires reporting of (1) the overall status of the information
security program and its compliance with this Rule; and (2) material
matters related to the information security program. The language
includes examples of what material matters might include, such as risk
assessments and security events, but does not require all of them be
included. The financial institution and the Qualified Individual will
be responsible for determining what is material for their organization.
The Commission does not believe these requirements call for overly
detailed reports.\316\
---------------------------------------------------------------------------
\316\ Indeed, workshop participants discussed a variety of
strategies for meaningful communication between security personnel
and senior leadership. Participants noted the proper content, style,
and cadence of reporting (beyond the minimum annual report) will
vary depending on, among other things, the type of financial
institution in question and the level of familiarity of leadership
with the relevant technical issues. See Safeguards Workshop Tr.,
supra note 17, at 194-200.
---------------------------------------------------------------------------
Although the Commission agrees a certification report from a
Qualified Individual could be a part of the annual report and may cover
many material matters, it may not suffice in all cases; thus, the
Commission declines to include such a one-size-fits-all requirement.
As to the suggestion to require ``regular'' reporting, the
Commission agrees more regular reporting may be the best approach for
many financial institutions. To this end, the Commission modifies the
requirement in the final rule to say ``regularly, and at least
annually.'' \317\ Beyond this modification, the Final Rule adopts
proposed paragraph (i) as proposed.
---------------------------------------------------------------------------
\317\ NADA argued reports required by this provision would be
expensive because the Proposed Rule stated they would need to be
prepared by a ``CISO,'' which NADA takes to mean a highly
compensated expert of the type retained by the most sophisticated
large institutions. National Automobile Dealer Association (comment
46, NPRM), at 41. As discussed above, however, the Rule does not
require all financial institutions to retain such an expert.
Instead, the report will be made by the Qualified Individual, whose
expertise and compensation will vary according to the size and
complexity of a financial institution's information system.
---------------------------------------------------------------------------
Board Certification
The Commission specifically sought comment on whether the Board or
equivalent should be required to certify the contents of the report.
The two commenters who addressed this question stated they should
not.\318\ ACE noted ``governing boards generally will not have the
knowledge and expertise to independently certify'' the technical
aspects of the report and certification might require the employment of
outside auditors.\319\ The Commission agrees senior management of
financial institutions will often lack the technical expertise to
personally attest to its validity. In addition, the primary purpose of
the required report is to encourage communication between information
security personnel and senior management, not to show compliance with
the Rule. Requiring the governing board to certify the contents of the
report would likely transform the report into a compliance document and
might reduce its efficacy as a communication between the Qualified
Individual and the Board. Accordingly, the Commission declines to adopt
this requirement in the Final Rule.
---------------------------------------------------------------------------
\318\ National Automobile Dealer Association (comment 46, NPRM),
at 41 n.126; American Council on Education (comment 24, NPRM), at
16.
\319\ American Council on Education (comment 24, NPRM), at 16.
---------------------------------------------------------------------------
Sec. 314.5: Effective Date
The Proposed Rule set a new effective date for some portions of the
Rule. Proposed Sec. 314.5 provided certain elements of the information
security program would not be required until six months after the
publication of a final rule, rather than immediately upon publication.
The paragraphs that would have a delayed effective date were: Sec.
314.4(a), related to the appointment of a Qualified Individual; Sec.
314.4(b)(1), relating to conducting a written risk assessment; Sec.
314.4(c)(1) through (8), setting forth the new elements of the
information security program; Sec. 314.4(d)(2), requiring continuous
monitoring or annual penetration testing and biannual vulnerability
assessment; Sec. 314.4(e), requiring training for personnel; Sec.
314.4(f)(3), requiring periodic assessment of service providers; Sec.
314.4(h), requiring a written incident response plan; and Sec.
314.4(i), requiring annual written reports from the Qualified
Individual. All other requirements under the Safeguards Rule would
remain in effect during this six-month period. These remaining
requirements largely mirrored the requirements of the existing Rule.
All commenters that addressed this provision noted the difficulty
of complying with some of the provisions of the Proposed Rule, and
argued financial institutions should be given more time to comply with
them. ACE suggested financial institutions be given one year to create
a plan for compliance and two years to come into actual
compliance.\320\ AFSA suggested compliance not be required for two
[[Page 70300]]
years.\321\ ACA International requested the effective date be one year
after publication of the Rule.\322\
---------------------------------------------------------------------------
\320\ American Council on Education (comment 24, NPRM), at 4-5.
\321\ American Financial Services Association (comment 41,
NPRM), at 7.
\322\ ACA International (comment 45, NPRM), at 10-11.
---------------------------------------------------------------------------
The Commission agrees some financial institutions may need longer
to modify their information security programs to comply with the new
requirements in the Final Rule, especially given the current pandemic
and the strains it is placing on businesses. Accordingly, the Final
Rule extends the effective date for these enumerated provisions to one
year after the publication of this document.
Proposed Sec. 314.6: Exceptions
Proposed Sec. 314.6 exempted financial institutions that maintain
customer information concerning fewer than five thousand consumers from
certain requirements of the Proposed Rule, namely Sec. 314.4(b)(1),
requiring a written risk assessment; Sec. 314.4(d)(2), requiring
continuous monitoring or annual penetration testing and biannual
vulnerability assessment; Sec. 314.4(h), requiring a written incident
response plan; and Sec. 314.4(i), requiring an annual written report
by the CISO (as revised, the Qualified Individual).\323\ This proposed
section was designed to reduce the burden on smaller financial
institutions.
---------------------------------------------------------------------------
\323\ Proposed 16 CFR 314.6.
---------------------------------------------------------------------------
The Commission sought comment on whether it was appropriate to
include such an exemption, whether the specific exemptions were
appropriate, whether the use of the number of customers concerning whom
the financial institution retains customer information is the most
effective way to determine which financial institutions should be
exempted and, if so, whether five thousand customers was an appropriate
number. After reviewing the comments received, the Commission retains
the exemption for financial institutions with fewer than 5,000
customers as proposed.
Several commenters supported the inclusion of an exemption for
small financial institutions. Consumer Reports supported the exemption
as proposed.\324\ NPA supported the decision to base this exemption on
the number of customers whose information the financial institution
maintains, but questioned how the number of customers would be
determined.\325\ NPA asked whether the number of customers would be
counted on an annual basis or include all records the financial
institution maintains. It also asked if each transaction with a
customer would be counted separately.\326\
---------------------------------------------------------------------------
\324\ Consumer Reports (comment 52, NPRM), at 6; see also Credit
Union National Association (comment 30, NPRM), at 2 (noting the
exemption will be helpful for smaller businesses, but suggesting
other changes to the Proposed Rule so the exemption is not
required).
\325\ National Pawnbrokers Association (comment 32, NPRM), at 6.
\326\ Id.; see also National Independent Automobile Dealers
Association (comment 48, NPRM), at 3.
---------------------------------------------------------------------------
Some commenters argued the number of customers whose records a
financial institution maintains was the wrong measure by which to
assess whether the exemption should apply. For example, commenters
suggested the Rule should take into account businesses with revenue
beneath a certain threshold,\327\ the number of students enrolled at
covered educational institutions,\328\ or the number of individuals
employed by the financial institution.\329\
---------------------------------------------------------------------------
\327\ ACA International (comment 45, NPRM), at 11-12.
\328\ American Council on Education (comment 24, NPRM), at 5.
\329\ Ahmed Aly (comment 22, NPRM).
---------------------------------------------------------------------------
Additionally, some commenters argued the threshold for application
of the exemption should be higher. ACA International suggested the
exemption should apply to all financial institutions maintaining
records concerning fewer than 10,000 customers.\330\ AFSA suggested a
50,000 customer threshold.\331\ NADA \332\ and NIADA \333\ argued the
threshold should be raised to 100,000 customers. Without proposing a
specific alternative, NPA expressed concern the 5,000-customer
threshold may be too low, noting pawnbrokers who accept firearms as
collateral are required to keep customer records related to certain
transactions for twenty years.\334\
---------------------------------------------------------------------------
\330\ ACA International (comment 45, NPRM), at 11-12.
\331\ American Financial Services Association (comment 41,
NPRM), at 3-4.
\332\ National Automobile Dealers Association (comment 46,
NPRM), at 43-44. NADA also suggested information about customers for
which the nonpublic information has been removed should not be
counted to the total. If the information is anonymized or otherwise
transformed so it is no longer reasonably linkable to a customer,
that information will not count towards the exemption. NADA's
example of retaining only ``name, phone number, address, and VIN of
the vehicle they own,'' would still count as customer information
under the Rule.
\333\ National Independent Automobile Dealers Association
(comment 48, NPRM), at 3.
\334\ National Pawnbrokers Association (comment 32, NPRM), at 6.
---------------------------------------------------------------------------
As to the substance of the exemption, some commenters felt it did
not go far enough to relieve the burden of the rule for small financial
institutions. ACA International proposed eligible financial
institutions should also be exempt from the requirement to designate a
single qualified individual to oversee their information security
programs.\335\ The National Federation of Independent Business argued
businesses with 15 or fewer employees should be exempted from the Rule
entirely and instead held only to a requirement to take ``commercially
reasonable steps'' to safeguard customer information.\336\ The Small
Business Administration Office of Advocacy suggested, in the absence of
additional information regarding the impact of the proposed changes on
small businesses, the Rule should ``maintain the status quo'' for small
entities as defined by the Small Business Administration's size
standards.\337\
---------------------------------------------------------------------------
\335\ ACA International (comment 45, NPRM), at 12.
\336\ National Federation of Independent Business (comment 16,
NPRM), at 4.
\337\ Small Business Administration Office of Advocacy (comment
28, NPRM), at 6.
---------------------------------------------------------------------------
On the other hand, other commenters opposed the inclusion of any
exemption. The Independent Community Bankers of America noted the
Federal Financial Institutions Examination Council Interagency
Guidelines Establishing Standards for Safeguarding Customer Information
(``FFIEC Guidelines''), which detail how depository institutions are
required to protect customer information, include no exemption for
smaller institutions and suggested the Rule should also have no
exemption and apply equally to all financial institutions.\338\
---------------------------------------------------------------------------
\338\ Independent Community Bankers of America (comment 35,
NPRM), at 4; see also American Escrow (comment 6, Workshop), at 3
(arguing even small companies may need to comply with all portions
of the Rule to maintain consumer confidence); see also Caiting Wang
(Comment 6, Privacy) (suggesting exempted provisions should be
optional for smaller businesses, or the Commission create a fund to
enable small businesses to comply with these provisions).
---------------------------------------------------------------------------
Under the existing Rule, there is no exception for smaller
entities. Still, the Commission continues to believe it is appropriate
to exempt small businesses from some of the revised Rule's
requirements. Although the FFIEC Guidelines do not exempt small
businesses from its requirements, the FFIEC Guidelines regulate only
depository financial institutions subject to an entirely different
regulatory regime, including supervision by their regulatory agencies.
While the provisions from which eligible financial institutions are
exempt have significant benefits for the security of customer
information and other sensitive data,\339\
[[Page 70301]]
those provisions may be less necessary in situations where the overall
volume of retained data is low. This is true in part because the
potential for cumulative consumer harm is less where fewer consumers'
information may be exposed as the result of a security incident.\340\
---------------------------------------------------------------------------
\339\ See, e.g., Remarks of Brian McManamon, Safeguards Workshop
Tr., supra note 17, at 85 (noting continuous monitoring allows
organizations to detect and quickly respond to threats); Remarks of
Frederick Lee, Safeguards Workshop Tr., supra note 17, at 126-28
(Frederick Lee) (discussing benefits of penetration testing);
Remarks of Tom Dugas, Safeguards Workshop Tr., supra note 17, at 143
(noting the importance of vulnerability scans); Remarks of Michele
Norin, Safeguards Workshop Tr., supra note 17, 194-95 (asserting
annual reporting by the Qualified Individual to an organization's
board or equivalent is beneficial); Remarks of Adrienne Allen,
Safeguards Workshop Tr., supra note 17, at 201.
\340\ See Remarks of James Crifasi, Safeguards Workshop Tr.,
supra note 17, at 91-92 (noting companies that control large amounts
of consumer data should in most instances implement the full range
of data security safeguards, whereas small businesses with less data
may need to focus on cybersecurity basics); see also Remarks of Lee
Waters, Safeguards Workshop Tr., supra note 17, at 91 (``[T]he
amount of data [that a business holds] would definitely have an
influence on whether a business is even going to be attacked.'');
Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at
94 (citing the volume of consumer records held by an organization as
an important factor in assessing cybersecurity risk).
---------------------------------------------------------------------------
For similar reasons, the Commission finds the number of individuals
concerning whom a financial institution maintains customer information
is the appropriate measure of whether the exemption should apply to a
particular financial institution. The application of the exemption
should take into account both the potential burden of compliance to
financial institutions and the risk to consumers when standards are
relaxed--in other words, the purpose of the exemption is to avoid
imposing undue burden while assuring customer information is subject to
necessary protections. Even a very small financial institution,
depending on its business model, may retain very large quantities of
sensitive customer information.\341\ Adequate security is necessary to
protect such information, which may constitute an attractive target for
bad actors such as identity thieves; the value of the target is
correlated with the volume of information maintained.\342\ While a
business's revenue or number of employees may provide a measure of the
burden of compliance for that business, these figures do not capture
consumer risk. By contrast, the number of individuals about whom a
financial institution maintains customer information is a proxy for the
level of security necessary in light of both the risk of attack and the
potential consumer harm should a security incident occur.\343\ In
addition, basing the exemption on the number of individuals concerning
whom a financial institution maintains customer information provides an
incentive to financial institutions to reduce the amount of information
they retain. A financial institution may choose to dispose of
information so it holds information on few enough consumers to qualify
for exemption.\344\
---------------------------------------------------------------------------
\341\ See, e.g., Remarks of James Crifasi, Safeguards Workshop
Tr., supra note 17, at 91-92 (noting small businesses with an
enormous amount of consumer records need to follow all of the
safeguards and ``can't get away with just doing the basics''); see
also ACA International (comment 45, NPRM) at 11 (``Many small
financial institutions, including a number of ACA members, have
objectively limited operations in terms of number of employees and
revenues, but handle large volumes of consumer account data for each
of their clients on whose behalf they are collecting debts.'').
\342\ See. e.g., Remarks of Rocio Baeza, Safeguards Workshop
Tr., supra note 17, at 94 (opining ``the better indicators for
cybersecurity risk are going to be two things: The volume of
consumer records that a financial institution holds and also the
rate of change.''); Remarks of Lee Waters, Safeguards Workshop Tr.,
supra note 17, at 91 (noting the amount of data a company holds
influences whether it is going to be attacked).
\343\ See Remarks of Brian McManamon, Safeguards Workshop Tr.,
supra note 17, at 89-90 (noting the size of a financial institution
and the amount and nature of the information it holds factor into an
appropriate information security program).
\344\ The Commission understands this provision to count all
individual consumers about which a financial institution maintains
customer information, including both current and former customers.
The exemption counts consumers rather than transactions so a
financial institution that had 100 transactions with a single
customer would count only a single consumer.
---------------------------------------------------------------------------
The Final Rule adopts this section as proposed. The Commission
continues to believe the cutoff for financial institutions maintaining
information concerning 5,000 consumers appropriately balances the need
for security with the burdens on smaller businesses. The requirements
to which exempted financial institutions would still be required to
adhere are tailored to balance the importance of adequately securing
customer information against the need to limit financial burdens for
small businesses. Many of these requirements were already in force as
part of the existing Rule--for example, covered financial institutions
were already required to design and implement a written information
security program, conduct risk assessments, perform an initial
assessment of their service providers, and designate one or more
employees to oversee information security. For reasons discussed
elsewhere in this document, the new requirements that apply to exempted
financial institutions, such as the requirement to designate a single
qualified individual to oversee information security rather than one or
more individuals, will ensure financial institutions of all sizes
continue to adequately protect customer information in an environment
of increasing cybersecurity risk, while avoiding the imposition of
undue burden.
IV. Paperwork Reduction Act
The Paperwork Reduction Act (``PRA''), 44 U.S.C. 35, requires
Federal agencies to seek and obtain Office of Management and Budget
(OMB) approval before undertaking a collection of information directed
to ten or more persons.\345\ A ``collection of information'' occurs
when ten or more persons are asked to report, provide, disclose, or
record information in response to ``identical questions.'' \346\
Applying these standards, neither the Safeguards Rule nor the
amendments constitute a ``collection of information.'' \347\ The Rule
calls upon affected financial institutions to develop or strengthen
their information security programs in order to provide reasonable
safeguards. Under the Rule, each financial institution's safeguards
will vary according to its size and complexity, the nature and scope of
its activities, and the sensitivity of the information involved. For
example, a financial institution with numerous employees would develop
and implement employee training and management procedures beyond those
that would be appropriate or reasonable for a sole proprietorship, such
as an individual tax preparer or mortgage broker. Similarly, a
financial institution that shares customer information with numerous
service providers would need to take steps to ensure such information
remains protected, while a financial institution with no service
providers would not need to address this issue. Thus, although each
financial institution must summarize its compliance efforts in one or
more written documents, the discretionary balancing of factors and
circumstances the Rule allows--including the myriad operational
differences among businesses it contemplated--does not require entities
to answer ``identical questions'' and therefore does not trigger the
PRA's requirements.
---------------------------------------------------------------------------
\345\ 44 U.S.C. 3502(3)(A)(i).
\346\ See 44 U.S.C. 3502(3)(A).
\347\ See Standards for Safeguarding Customer Information, 67 FR
36484, 36491 (May 23, 2002).
---------------------------------------------------------------------------
The amendments to the Rule do not change this analysis because they
retain the existing Rule's process-based approach, allowing financial
institutions to tailor their programs to reflect the financial
institutions' size, complexity, and operations, and to the
[[Page 70302]]
sensitivity and amount of customer information they collect. For
example, amended Sec. 314.4(b) would require a written risk
assessment, but each risk assessment will reflect the particular
structure and operation of the financial institution and, though each
assessment must include certain criteria, these are only general
guidelines and do not consist of ``identical questions.'' Similarly,
amended Sec. 314.4(h), which requires a written incident response
plan, is only an extension of the preexisting requirement of a written
information security plan and would necessarily vary significantly
based on factors such as the financial institution's internal
procedures, which officials within the financial institution have
decision-making authority, how the financial institution communicates
internally and externally, and the structure of the financial
institution's information systems. Likewise, the proposed requirement
for Qualified Individuals to produce annual reports under proposed
Sec. 314.4(i) does not consist of answers to identical questions, as
the content of these reports would vary considerably between financial
institutions and Qualified Individuals are given flexibility in
deciding what to include in the reports. Finally, the modification of
the definition of ``financial institution'' to include ``activities
incidental to financial activities'' and therefore bring finders under
the scope of the Rule do not constitute a ``collection of
information,'' and therefore do not trigger the PRA's requirements.
V. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA), as amended by the Small
Business Regulatory Enforcement Fairness Act of 1996, requires an
agency to either provide an Initial Regulatory Flexibility Analysis
(IRFA) with a proposed Rule, or certify that the proposed Rule will not
have a significant impact on a substantial number of small
entities.\348\ The Commission published an Initial Regulatory
Flexibility Analysis in order to inquire into the impact of the
Proposed Rule on small entities. In response, the Commission received
comments that argued the revision to the Safeguards Rule would be
unduly burdensome for smaller financial institutions. The discussion
below summarizes these comments and the Commission's response to them.
---------------------------------------------------------------------------
\348\ 5 U.S.C. 603 et seq.
---------------------------------------------------------------------------
1. Description of the Reason for Agency Action
The Commission issues these amendments to clarify the Safeguards
Rule by including a definition of ``financial institution'' and related
examples in the Safeguards Rule rather than incorporating them from the
Privacy Rule by reference. The amendments also expand the definition of
``financial institution'' in the Rule to include entities engaged in
activities incidental to financial activities. This change would bring
``finders'' within the scope of the Rule. This change harmonizes the
Rule with other agencies' rules and requires finders that collect
consumers' sensitive financial information to comply with the
Safeguards Rule's process-based approach to protect that data.
In addition, the amendments modify the Safeguards Rule to include
more detailed requirements for the information security program
required by the Rule.
2. Issues Raised by Comments in Response to the IRFA
As stated above, the Commission received several comments that
argued the revised Safeguards Rule would impose unduly heavy burdens on
smaller businesses. The Small Business Administration's Office of
Advocacy commented it was concerned the FTC had not gathered sufficient
data as to either the costs or benefits of the proposed changes for
small financial institutions. The FTC shares the Office of Advocacy's
interest in ensuring regulatory changes have an evidentiary basis. Many
of the questions on which the FTC sought public comment, both in the
regulatory review and in the proposed rule context, specifically
related to the costs and benefits of existing and proposed Rule
requirements. Following the initial round of commenting, the Commission
conducted the FTC Safeguards Workshop and solicited additional public
comments with the explicit goal of gathering additional data relating
to the costs and benefits of the proposed changes.\349\ As detailed
throughout this document, the Commission believes there is a strong
evidentiary basis for the issuance of the Final Rule.
---------------------------------------------------------------------------
\349\ See Public Workshop Examining Information Security for
Financial Institutions and Information Related to Changes to the
Safeguards Rule, 85 FR 13082 (Mar. 6, 2020).
---------------------------------------------------------------------------
The Office of Advocacy also argued the Proposed Rule's requirements
were unduly prescriptive and should not be enacted as they apply to
small businesses until the Commission can ``ascertain the quantitative
impact on small entities.'' \350\ The Office of Advocacy, along with
other commenters, argued the amendments taken together would create a
large burden on smaller financial institutions. In particular,
commenters pointed to the requirements that financial institutions
appoint a chief information security officer, customer information be
encrypted, financial institutions utilize multi-factor authentication,
and financial institutions regularly update training programs. These
comments and the Commission's response are discussed at length above.
Most commenters did not provide any specific estimates of these
expenses, but two commenters did provide a summary of their expected
expenses.
---------------------------------------------------------------------------
\350\ Small Business Administration Office of Advocacy (comment
28, NPRM), at 6.
---------------------------------------------------------------------------
As discussed in the document, the Commission believes any burden
imposed by the revised Rule is substantially mitigated by the fact the
Rule continues to be process-based, flexible, and based on the
financial institution's size and complexity. In addition, the
amendments exempt institutions that maintain information on fewer than
5,000 consumers from certain requirements that require additional
written product and might pose a greater burden on smaller entities.
The Commission believes most of the entities covered by the exemption
will be small businesses. Finally, the Commission believes all
financial institutions, including small businesses, that comply with
the current Safeguards Rule will already be in compliance with most of
the new provisions of the revised Rule as part of their current
information security program.
In addition, in response to the comments concerned about the burden
of the amendments, the Commission extended the effective date from six
months after the publication of the Final Rule to one year after the
publication to allow financial institutions additional time to come
into compliance with the revised Rule. In addition, in response to
comments that argued hiring a chief information security officer would
be prohibitively expensive for small financial institutions, the
Commission amended the rule to clarify such an employee was not
required for all financial institutions. The Final Rule is modified to
clarify a financial institution need only appoint an individual who is
qualified to coordinate its information security program, and those
qualifications will vary based on the complexity of the program and
size and nature of the
[[Page 70303]]
financial institution. The Commission also clarified employee training
programs need to be updated only as necessary, to respond to a comment
regular updating would be difficult for smaller financial institutions.
3. Estimate of Number of Small Entities to Which the Amendments Will
Apply
As previously discussed in the IRFA, determining a precise estimate
of the number of small entities \351\--including newly covered entities
under the modified definition of financial institution--is not readily
feasible. Financial institutions already covered by the Rule as
originally promulgated include lenders, financial advisors, loan
brokers and servicers, collection agencies, financial advisors, tax
preparers, and real estate settlement services, to the extent they have
``customer information'' within the meaning of the Rule. Finders are
also covered under the Final Rule. However, it is not known whether any
finders are small entities, and if so, how many there are. The
Commission requested comment and information on the number of
``finders'' that would be covered by the Rule's modified definition of
``financial institution,'' and how many of those finders, if any, are
small entities. The Commission received no comments that addressed this
question.
---------------------------------------------------------------------------
\351\ The U.S. Small Business Administration Table of Small
Business Size Standards Matched to North American Industry
Classification System Codes (``NAICS'') are generally expressed in
either millions of dollars or number of employees. A size standard
is the largest a business can be and still qualify as a small
business for Federal Government programs. For the most part, size
standards are the annual receipts or the average employment of a
firm. Depending on the nature of the financial services an
institution provides, the size standard varies. By way of example,
mortgage and nonmortgage loan brokers (NAICS code 522310) are
classified as small if their annual receipts are $8.0 million or
less. Consumer lending institutions (NAICS code 522291) are
classified as small if their annual receipts are $41.5 million or
less. Commercial banking and savings institutions (NAICS codes
522110 and 522120) are classified as small if their assets are $600
million or less. Assets are determined by averaging the assets
reported on businesses' four quarterly financial statements for the
preceding year. The 2019 Table of Small Business Size Standards is
available at https://www.sba.gov/sites/default/files/2019-08/SBA%20Table%20of%20Size%20Standards_Effective%20Aug%2019%2C%202019_Rev.pdf.
---------------------------------------------------------------------------
4. Projected Reporting, Recordkeeping, and Other Compliance
Requirements
The Rule does not impose any reporting or any specific
recordkeeping requirements as discussed earlier. See supra Section IV
(Paperwork Reduction Act). With regard to other compliance
requirements, the addition of definitions and examples from the Privacy
Rule is not expected to have an impact on covered financial
institutions, including those that may be small entities. (The
preceding section of this analysis discusses classes of covered
financial institutions that may qualify as small entities.) The
addition of ``finders'' to the definition of financial institutions
imposes the obligations of the Rule on entities that engage in
``finding'' activity and also collect customer information.
The addition of more detailed requirements may require some
financial institutions to perform additional risk assessments or
monitoring, or to create additional safeguards as set forth in the
Proposed Rule. These obligations may require institutions to retain
employees or third-party service providers with skills in information
security, but, as discussed above, the Commission believes most
financial institutions will have already complied with many parts of
the Rule as part of their information security programs required under
the existing Rule. There may be additional related compliance costs
(e.g., legal, new equipment or systems, modifications to policies or
procedures), but, as discussed above, the Commission believes these are
limited by several factors, including the flexibility of the Rule, the
existing safeguards in place to comply with the existing Rule, and the
exemption for financial institutions that maintain less consumer
information.
Although two commenters provided summaries of the expected expenses
for some financial institutions to comply with the Rule, those
estimates did not provide sufficient detail to fully evaluate whether
they were accurate or representative of other financial institutions
and appeared to be based, at least in part, on a misunderstanding of
the requirement to appoint a Qualified Individual. The Commission
believes, for most smaller financial institutions, there are very low-
cost solutions for any additional duties imposed by the Final Rule.
This view is supported by the comments of several experts at the
Safeguards Rule Workshop.\352\
---------------------------------------------------------------------------
\352\ See, e.g., Remarks of Brian McManamon, Safeguards Workshop
Tr., supra note 17, at 78 (describing virtual CISO services);
Matthew Green, Safeguards Workshop Tr., supra note 17, at 225
(noting website usage of encryption for data in motion is above 80
percent; ``Let's Encrypt'' provides free TLS certificates; and costs
have gone down to the point that if a financial institution is not
using TLS encryption for data in motion, it is making an unusual
decision outside the norm); Rocio Baeza, Safeguards Workshop Tr.,
supra note 17, at 106 (``[T]he encryption of data in transit has
been standard. There's no pushback with that.''); Slides
Accompanying the Remarks of Lee Waters, ``Information Security
Programs and Smaller Businesses,'' in Safeguards Workshop Slides,
supra note 72, at 26 (``Estimated Costs of Proposed Changes,''
estimating costs of multi-factor authentication to be $50 for
smartcard or fingerprint readers, and $10 each per smartcard);
Slides Accompanying Remarks of Wendy Nather, Safeguards Workshop
Slides, supra note 72, at 37 (chart showing the use of multi-factor
authentication solutions such as Duo Push, phone call, mobile
passcode, SMS passcode, hardware token, Yubikey passcode, and U2F
token in industries such as financial services and higher
education).
---------------------------------------------------------------------------
The Commission believes the protection of consumers' financial
information is of the utmost importance and the cost of the safeguards
required to provide that protection is justified and necessary. The
Commission carefully balanced the cost of these requirements with the
need to protect consumer information and has made every effort to
ensure the Final Rule retains flexibility so financial institutions can
tailor information security programs to the size and complexity of the
financial institution, the nature and scope of its activities, and the
sensitivity of any customer information at issue.
5. Description of Steps Taken To Minimize Significant Economic Impact,
if Any, on Small Entities, Including Alternatives
The standards in the Final Rule allow a small financial institution
to develop an information security program appropriate to its size and
complexity, the nature and scope of its activities, and the sensitivity
of any customer information at issue. The amendments include certain
design standards (e.g., a company must implement encryption,
authentication, and incident response) in the Rule, in addition to the
performance standards (reasonable security) the Rule currently uses. As
discussed, while these design standards may introduce some additional
burden, the Commission believes many financial institutions' existing
information security programs already meet most of these requirements.
In addition, the requirements in the Final Rule, like those in the
existing Rule, are designed to allow financial institutions flexibility
in how and whether they should be implemented. For example, the
requirement encryption be used to protect customer information in
transit and at rest may be met with effective alternative compensating
controls if encryption is infeasible for a given financial institution.
In addition, the amendments exempt financial institutions that
maintain relatively small amounts of customer information from certain
requirements of the Final Rule. The exemptions would apply to financial
institutions that maintain customer information
[[Page 70304]]
concerning fewer than ten thousand consumers. The Commission believes
exempted financial institutions are generally, but not exclusively,
small entities. Such financial institutions are not required to perform
a written risk assessment, conduct continuous monitoring or annual
penetration testing and biannual vulnerability assessment, prepare a
written incident response plan, or prepare an annual written report by
the Qualified Individual. These exemptions are intended to reduce the
burden on smaller financial institutions. The Commission believes the
obligations subject to these exemptions are the ones most likely to
cause undue burden on smaller financial institutions.
Exempted financial institutions will still need to conduct risk
assessments, design and implement a written information security
program with the required elements, utilize qualified information
security personnel and train employees, monitor activity of authorized
users, oversee service providers, and evaluate and adjust their
information security program. These are core obligations under the Rule
any financial institution that collects customer information must meet,
regardless of size.
The Commission considered allowing compliance with a third-party
data security standard, such as the NIST framework, to act as a safe
harbor for compliance with the Rule. The Commission, however,
determined any reduction of burden created by allowing such safe
harbors is offset by issues they would cause. For example, such safe
harbors would require the Commission to monitor the third-party
standard or standards to determine whether they continued to align with
the Safeguards Rule. In addition, the Commission would still have to
investigate a company's compliance with the outside standard in any
enforcement action. The Commission also does not agree compliance with
an outside standard is likely to be less burdensome than complying with
the Safeguards Rule itself.
VI. Other Matters
Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.),
the Office of Information and Regulatory Affairs designated this rule
as not a ``major rule,'' as defined by 5 U.S.C. 804(2).
List of Subjects in 16 CFR Part 314
Consumer protection, Credit, Data protection, Privacy, Trade
practices.
For the reasons stated above, the Federal Trade Commission amends
16 CFR part 314 as follows:
PART 314--STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION
0
1. The authority citation for part 314 continues to read as follows:
Authority: 15 U.S.C. 6801(b), 6805(b)(2).
0
2. In Sec. 314.1, revise paragraph (b) to read as follows:
Sec. 314.1 Purpose and scope.
* * * * *
(b) Scope. This part applies to the handling of customer
information by all financial institutions over which the Federal Trade
Commission (``FTC'' or ``Commission'') has jurisdiction. Namely, this
part applies to those ``financial institutions'' over which the
Commission has rulemaking authority pursuant to section 501(b) of the
Gramm-Leach-Bliley Act. An entity is a ``financial institution'' if its
business is engaging in an activity that is financial in nature or
incidental to such financial activities as described in section 4(k) of
the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k), which
incorporates activities enumerated by the Federal Reserve Board in 12
CFR 225.28 and 225.86. The ``financial institutions'' subject to the
Commission's enforcement authority are those that are not otherwise
subject to the enforcement authority of another regulator under section
505 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6805. More specifically,
those entities include, but are not limited to, mortgage lenders, ``pay
day'' lenders, finance companies, mortgage brokers, account servicers,
check cashers, wire transferors, travel agencies operated in connection
with financial services, collection agencies, credit counselors and
other financial advisors, tax preparation firms, non-federally insured
credit unions, investment advisors that are not required to register
with the Securities and Exchange Commission, and entities acting as
finders. They are referred to in this part as ``You.'' This part
applies to all customer information in your possession, regardless of
whether such information pertains to individuals with whom you have a
customer relationship, or pertains to the customers of other financial
institutions that have provided such information to you.
0
3. Revise Sec. 314.2 to read as follows:
Sec. 314.2 Definitions.
(a) Authorized user means any employee, contractor, agent,
customer, or other person that is authorized to access any of your
information systems or data.
(b)(1) Consumer means an individual who obtains or has obtained a
financial product or service from you that is to be used primarily for
personal, family, or household purposes, or that individual's legal
representative.
(2) For example:
(i) An individual who applies to you for credit for personal,
family, or household purposes is a consumer of a financial service,
regardless of whether the credit is extended.
(ii) An individual who provides nonpublic personal information to
you in order to obtain a determination about whether he or she may
qualify for a loan to be used primarily for personal, family, or
household purposes is a consumer of a financial service, regardless of
whether the loan is extended.
(iii) An individual who provides nonpublic personal information to
you in connection with obtaining or seeking to obtain financial,
investment, or economic advisory services is a consumer, regardless of
whether you establish a continuing advisory relationship.
(iv) If you hold ownership or servicing rights to an individual's
loan that is used primarily for personal, family, or household
purposes, the individual is your consumer, even if you hold those
rights in conjunction with one or more other institutions. (The
individual is also a consumer with respect to the other financial
institutions involved.) An individual who has a loan in which you have
ownership or servicing rights is your consumer, even if you, or another
institution with those rights, hire an agent to collect on the loan.
(v) An individual who is a consumer of another financial
institution is not your consumer solely because you act as agent for,
or provide processing or other services to, that financial institution.
(vi) An individual is not your consumer solely because he or she
has designated you as trustee for a trust.
(vii) An individual is not your consumer solely because he or she
is a beneficiary of a trust for which you are a trustee.
(viii) An individual is not your consumer solely because he or she
is a participant or a beneficiary of an employee benefit plan that you
sponsor or for which you act as a trustee or fiduciary.
(c) Customer means a consumer who has a customer relationship with
you.
(d) Customer information means any record containing nonpublic
personal information about a customer of a financial institution,
whether in paper, electronic, or other form, that is handled
[[Page 70305]]
or maintained by or on behalf of you or your affiliates.
(e)(1) Customer relationship means a continuing relationship
between a consumer and you under which you provide one or more
financial products or services to the consumer that are to be used
primarily for personal, family, or household purposes.
(2) For example:
(i) Continuing relationship. A consumer has a continuing
relationship with you if the consumer:
(A) Has a credit or investment account with you;
(B) Obtains a loan from you;
(C) Purchases an insurance product from you;
(D) Holds an investment product through you, such as when you act
as a custodian for securities or for assets in an Individual Retirement
Arrangement;
(E) Enters into an agreement or understanding with you whereby you
undertake to arrange or broker a home mortgage loan, or credit to
purchase a vehicle, for the consumer;
(F) Enters into a lease of personal property on a non-operating
basis with you;
(G) Obtains financial, investment, or economic advisory services
from you for a fee;
(H) Becomes your client for the purpose of obtaining tax
preparation or credit counseling services from you;
(I) Obtains career counseling while seeking employment with a
financial institution or the finance, accounting, or audit department
of any company (or while employed by such a financial institution or
department of any company);
(J) Is obligated on an account that you purchase from another
financial institution, regardless of whether the account is in default
when purchased, unless you do not locate the consumer or attempt to
collect any amount from the consumer on the account;
(K) Obtains real estate settlement services from you; or
(L) Has a loan for which you own the servicing rights.
(ii) No continuing relationship. A consumer does not, however, have
a continuing relationship with you if:
(A) The consumer obtains a financial product or service from you
only in isolated transactions, such as using your ATM to withdraw cash
from an account at another financial institution; purchasing a money
order from you; cashing a check with you; or making a wire transfer
through you;
(B) You sell the consumer's loan and do not retain the rights to
service that loan;
(C) You sell the consumer airline tickets, travel insurance, or
traveler's checks in isolated transactions;
(D) The consumer obtains one-time personal or real property
appraisal services from you; or
(E) The consumer purchases checks for a personal checking account
from you.
(f) Encryption means the transformation of data into a form that
results in a low probability of assigning meaning without the use of a
protective process or key, consistent with current cryptographic
standards and accompanied by appropriate safeguards for cryptographic
key material.
(g)(1) Financial product or service means any product or service
that a financial holding company could offer by engaging in a financial
activity under section 4(k) of the Bank Holding Company Act of 1956 (12
U.S.C. 1843(k)).
(2) Financial service includes your evaluation or brokerage of
information that you collect in connection with a request or an
application from a consumer for a financial product or service.
(h)(1) Financial institution means any institution the business of
which is engaging in an activity that is financial in nature or
incidental to such financial activities as described in section 4(k) of
the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k). An institution
that is significantly engaged in financial activities, or significantly
engaged in activities incidental to such financial activities, is a
financial institution.
(2) Examples of financial institutions are as follows:
(i) A retailer that extends credit by issuing its own credit card
directly to consumers is a financial institution because extending
credit is a financial activity listed in 12 CFR 225.28(b)(1) and
referenced in section 4(k)(4)(F) of the Bank Holding Company Act of
1956 (12 U.S.C. 1843(k)(4)(F)), and issuing that extension of credit
through a proprietary credit card demonstrates that a retailer is
significantly engaged in extending credit.
(ii) An automobile dealership that, as a usual part of its
business, leases automobiles on a nonoperating basis for longer than 90
days is a financial institution with respect to its leasing business
because leasing personal property on a nonoperating basis where the
initial term of the lease is at least 90 days is a financial activity
listed in 12 CFR 225.28(b)(3) and referenced in section 4(k)(4)(F) of
the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).
(iii) A personal property or real estate appraiser is a financial
institution because real and personal property appraisal is a financial
activity listed in 12 CFR 225.28(b)(2)(i) and referenced in section
4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).
(iv) A career counselor that specializes in providing career
counseling services to individuals currently employed by or recently
displaced from a financial organization, individuals who are seeking
employment with a financial organization, or individuals who are
currently employed by or seeking placement with the finance, accounting
or audit departments of any company is a financial institution because
such career counseling activities are financial activities listed in 12
CFR 225.28(b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank
Holding Company Act, 12 U.S.C. 1843(k)(4)(F).
(v) A business that prints and sells checks for consumers, either
as its sole business or as one of its product lines, is a financial
institution because printing and selling checks is a financial activity
that is listed in 12 CFR 225.28(b)(10)(ii) and referenced in section
4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).
(vi) A business that regularly wires money to and from consumers is
a financial institution because transferring money is a financial
activity referenced in section 4(k)(4)(A) of the Bank Holding Company
Act, 12 U.S.C. 1843(k)(4)(A), and regularly providing that service
demonstrates that the business is significantly engaged in that
activity.
(vii) A check cashing business is a financial institution because
cashing a check is exchanging money, which is a financial activity
listed in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C.
1843(k)(4)(A).
(viii) An accountant or other tax preparation service that is in
the business of completing income tax returns is a financial
institution because tax preparation services is a financial activity
listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G)
of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).
(ix) A business that operates a travel agency in connection with
financial services is a financial institution because operating a
travel agency in connection with financial services is a financial
activity listed in 12 CFR 225.86(b)(2) and referenced in section
4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).
(x) An entity that provides real estate settlement services is a
financial institution because providing real estate settlement services
is a financial activity
[[Page 70306]]
listed in 12 CFR 225.28(b)(2)(viii) and referenced in section
4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).
(xi) A mortgage broker is a financial institution because brokering
loans is a financial activity listed in 12 CFR 225.28(b)(1) and
referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12
U.S.C. 1843(k)(4)(F).
(xii) An investment advisory company and a credit counseling
service are each financial institutions because providing financial and
investment advisory services are financial activities referenced in
section 4(k)(4)(C) of the Bank Holding Company Act, 12 U.S.C.
1843(k)(4)(C).
(xiii) A company acting as a finder in bringing together one or
more buyers and sellers of any product or service for transactions that
the parties themselves negotiate and consummate is a financial
institution because acting as a finder is an activity that is financial
in nature or incidental to a financial activity listed in 12 CFR
225.86(d)(1).
(3) Financial institution does not include:
(i) Any person or entity with respect to any financial activity
that is subject to the jurisdiction of the Commodity Futures Trading
Commission under the Commodity Exchange Act (7 U.S.C. 1 et seq.);
(ii) The Federal Agricultural Mortgage Corporation or any entity
chartered and operating under the Farm Credit Act of 1971 (12 U.S.C.
2001 et seq.);
(iii) Institutions chartered by Congress specifically to engage in
securitizations, secondary market sales (including sales of servicing
rights) or similar transactions related to a transaction of a consumer,
as long as such institutions do not sell or transfer nonpublic personal
information to a nonaffiliated third party other than as permitted by
Sec. Sec. 313.14 and 313.15; or
(iv) Entities that engage in financial activities but that are not
significantly engaged in those financial activities, and entities that
engage in activities incidental to financial activities but that are
not significantly engaged in activities incidental to financial
activities.
(4) Examples of entities that are not significantly engaged in
financial activities are as follows:
(i) A retailer is not a financial institution if its only means of
extending credit are occasional ``lay away'' and deferred payment plans
or accepting payment by means of credit cards issued by others.
(ii) A retailer is not a financial institution merely because it
accepts payment in the form of cash, checks, or credit cards that it
did not issue.
(iii) A merchant is not a financial institution merely because it
allows an individual to ``run a tab.''
(iv) A grocery store is not a financial institution merely because
it allows individuals to whom it sells groceries to cash a check, or
write a check for a higher amount than the grocery purchase and obtain
cash in return.
(i) Information security program means the administrative,
technical, or physical safeguards you use to access, collect,
distribute, process, protect, store, use, transmit, dispose of, or
otherwise handle customer information.
(j) Information system means a discrete set of electronic
information resources organized for the collection, processing,
maintenance, use, sharing, dissemination or disposition of electronic
information containing customer information or connected to a system
containing customer information, as well as any specialized system such
as industrial/process controls systems, telephone switching and private
branch exchange systems, and environmental controls systems that
contains customer information or that is connected to a system that
contains customer information.
(k) Multi-factor authentication means authentication through
verification of at least two of the following types of authentication
factors:
(1) Knowledge factors, such as a password;
(2) Possession factors, such as a token; or
(3) Inherence factors, such as biometric characteristics.
(l)(1) Nonpublic personal information means:
(i) Personally identifiable financial information; and
(ii) Any list, description, or other grouping of consumers (and
publicly available information pertaining to them) that is derived
using any personally identifiable financial information that is not
publicly available.
(2) Nonpublic personal information does not include:
(i) Publicly available information, except as included on a list
described in paragraph (l)(1)(ii) of this section; or
(ii) Any list, description, or other grouping of consumers (and
publicly available information pertaining to them) that is derived
without using any personally identifiable financial information that is
not publicly available.
(3) For example:
(i) Nonpublic personal information includes any list of
individuals' names and street addresses that is derived in whole or in
part using personally identifiable financial information (that is not
publicly available), such as account numbers.
(ii) Nonpublic personal information does not include any list of
individuals' names and addresses that contains only publicly available
information, is not derived, in whole or in part, using personally
identifiable financial information that is not publicly available, and
is not disclosed in a manner that indicates that any of the individuals
on the list is a consumer of a financial institution.
(m) Penetration testing means a test methodology in which assessors
attempt to circumvent or defeat the security features of an information
system by attempting penetration of databases or controls from outside
or inside your information systems.
(n)(1) Personally identifiable financial information means any
information:
(i) A consumer provides to you to obtain a financial product or
service from you;
(ii) About a consumer resulting from any transaction involving a
financial product or service between you and a consumer; or
(iii) You otherwise obtain about a consumer in connection with
providing a financial product or service to that consumer.
(2) For example:
(i) Information included. Personally identifiable financial
information includes:
(A) Information a consumer provides to you on an application to
obtain a loan, credit card, or other financial product or service;
(B) Account balance information, payment history, overdraft
history, and credit or debit card purchase information;
(C) The fact that an individual is or has been one of your
customers or has obtained a financial product or service from you;
(D) Any information about your consumer if it is disclosed in a
manner that indicates that the individual is or has been your consumer;
(E) Any information that a consumer provides to you or that you or
your agent otherwise obtain in connection with collecting on, or
servicing, a credit account;
(F) Any information you collect through an internet ``cookie'' (an
information collecting device from a web server); and
(G) Information from a consumer report.
(ii) Information not included. Personally identifiable financial
information does not include:
[[Page 70307]]
(A) A list of names and addresses of customers of an entity that is
not a financial institution; and
(B) Information that does not identify a consumer, such as
aggregate information or blind data that does not contain personal
identifiers such as account numbers, names, or addresses.
(o)(1) Publicly available information means any information that
you have a reasonable basis to believe is lawfully made available to
the general public from:
(i) Federal, State, or local government records;
(ii) Widely distributed media; or
(iii) Disclosures to the general public that are required to be
made by Federal, State, or local law.
(2) You have a reasonable basis to believe that information is
lawfully made available to the general public if you have taken steps
to determine:
(i) That the information is of the type that is available to the
general public; and
(ii) Whether an individual can direct that the information not be
made available to the general public and, if so, that your consumer has
not done so.
(3) For example:
(i) Government records. Publicly available information in
government records includes information in government real estate
records and security interest filings.
(ii) Widely distributed media. Publicly available information from
widely distributed media includes information from a telephone book, a
television or radio program, a newspaper, or a website that is
available to the general public on an unrestricted basis. A website is
not restricted merely because an internet service provider or a site
operator requires a fee or a password, so long as access is available
to the general public.
(iii) Reasonable basis. (A) You have a reasonable basis to believe
that mortgage information is lawfully made available to the general
public if you have determined that the information is of the type
included on the public record in the jurisdiction where the mortgage
would be recorded.
(B) You have a reasonable basis to believe that an individual's
telephone number is lawfully made available to the general public if
you have located the telephone number in the telephone book or the
consumer has informed you that the telephone number is not unlisted.
(p) Security event means an event resulting in unauthorized access
to, or disruption or misuse of, an information system, information
stored on such information system, or customer information held in
physical form.
(q) Service provider means any person or entity that receives,
maintains, processes, or otherwise is permitted access to customer
information through its provision of services directly to a financial
institution that is subject to this part.
(r) You includes each ``financial institution'' (but excludes any
``other person'') over which the Commission has enforcement
jurisdiction pursuant to section 505(a)(7) of the Gramm-Leach-Bliley
Act.
0
4. In Sec. 314.3, revise paragraph (a) to read as follows:
Sec. 314.3 Standards for safeguarding customer information.
(a) Information security program. You shall develop, implement, and
maintain a comprehensive information security program that is written
in one or more readily accessible parts and contains administrative,
technical, and physical safeguards that are appropriate to your size
and complexity, the nature and scope of your activities, and the
sensitivity of any customer information at issue. The information
security program shall include the elements set forth in Sec. 314.4
and shall be reasonably designed to achieve the objectives of this
part, as set forth in paragraph (b) of this section.
* * * * *
0
5. Revise Sec. 314.4 to read as follows:
Sec. 314.4 Elements.
In order to develop, implement, and maintain your information
security program, you shall:
(a) Designate a qualified individual responsible for overseeing and
implementing your information security program and enforcing your
information security program (for purposes of this part, ``Qualified
Individual''). The Qualified Individual may be employed by you, an
affiliate, or a service provider. To the extent the requirement in this
paragraph (a) is met using a service provider or an affiliate, you
shall:
(1) Retain responsibility for compliance with this part;
(2) Designate a senior member of your personnel responsible for
direction and oversight of the Qualified Individual; and
(3) Require the service provider or affiliate to maintain an
information security program that protects you in accordance with the
requirements of this part.
(b) Base your information security program on a risk assessment
that identifies reasonably foreseeable internal and external risks to
the security, confidentiality, and integrity of customer information
that could result in the unauthorized disclosure, misuse, alteration,
destruction, or other compromise of such information, and assesses the
sufficiency of any safeguards in place to control these risks.
(1) The risk assessment shall be written and shall include:
(i) Criteria for the evaluation and categorization of identified
security risks or threats you face;
(ii) Criteria for the assessment of the confidentiality, integrity,
and availability of your information systems and customer information,
including the adequacy of the existing controls in the context of the
identified risks or threats you face; and
(iii) Requirements describing how identified risks will be
mitigated or accepted based on the risk assessment and how the
information security program will address the risks.
(2) You shall periodically perform additional risk assessments that
reexamine the reasonably foreseeable internal and external risks to the
security, confidentiality, and integrity of customer information that
could result in the unauthorized disclosure, misuse, alteration,
destruction, or other compromise of such information, and reassess the
sufficiency of any safeguards in place to control these risks.
(c) Design and implement safeguards to control the risks you
identity through risk assessment, including by:
(1) Implementing and periodically reviewing access controls,
including technical and, as appropriate, physical controls to:
(i) Authenticate and permit access only to authorized users to
protect against the unauthorized acquisition of customer information;
and
(ii) Limit authorized users' access only to customer information
that they need to perform their duties and functions, or, in the case
of customers, to access their own information;
(2) Identify and manage the data, personnel, devices, systems, and
facilities that enable you to achieve business purposes in accordance
with their relative importance to business objectives and your risk
strategy;
(3) Protect by encryption all customer information held or
transmitted by you both in transit over external networks and at rest.
To the extent you determine that encryption of customer information,
either in transit over external networks or at rest, is infeasible, you
may instead secure such customer information using effective
[[Page 70308]]
alternative compensating controls reviewed and approved by your
Qualified Individual;
(4) Adopt secure development practices for in-house developed
applications utilized by you for transmitting, accessing, or storing
customer information and procedures for evaluating, assessing, or
testing the security of externally developed applications you utilize
to transmit, access, or store customer information;
(5) Implement multi-factor authentication for any individual
accessing any information system, unless your Qualified Individual has
approved in writing the use of reasonably equivalent or more secure
access controls;
(6)(i) Develop, implement, and maintain procedures for the secure
disposal of customer information in any format no later than two years
after the last date the information is used in connection with the
provision of a product or service to the customer to which it relates,
unless such information is necessary for business operations or for
other legitimate business purposes, is otherwise required to be
retained by law or regulation, or where targeted disposal is not
reasonably feasible due to the manner in which the information is
maintained; and
(ii) Periodically review your data retention policy to minimize the
unnecessary retention of data;
(7) Adopt procedures for change management; and
(8) Implement policies, procedures, and controls designed to
monitor and log the activity of authorized users and detect
unauthorized access or use of, or tampering with, customer information
by such users.
(d)(1) Regularly test or otherwise monitor the effectiveness of the
safeguards' key controls, systems, and procedures, including those to
detect actual and attempted attacks on, or intrusions into, information
systems.
(2) For information systems, the monitoring and testing shall
include continuous monitoring or periodic penetration testing and
vulnerability assessments. Absent effective continuous monitoring or
other systems to detect, on an ongoing basis, changes in information
systems that may create vulnerabilities, you shall conduct:
(i) Annual penetration testing of your information systems
determined each given year based on relevant identified risks in
accordance with the risk assessment; and
(ii) Vulnerability assessments, including any systemic scans or
reviews of information systems reasonably designed to identify publicly
known security vulnerabilities in your information systems based on the
risk assessment, at least every six months; and whenever there are
material changes to your operations or business arrangements; and
whenever there are circumstances you know or have reason to know may
have a material impact on your information security program.
(e) Implement policies and procedures to ensure that personnel are
able to enact your information security program by:
(1) Providing your personnel with security awareness training that
is updated as necessary to reflect risks identified by the risk
assessment;
(2) Utilizing qualified information security personnel employed by
you or an affiliate or service provider sufficient to manage your
information security risks and to perform or oversee the information
security program;
(3) Providing information security personnel with security updates
and training sufficient to address relevant security risks; and
(4) Verifying that key information security personnel take steps to
maintain current knowledge of changing information security threats and
countermeasures.
(f) Oversee service providers, by:
(1) Taking reasonable steps to select and retain service providers
that are capable of maintaining appropriate safeguards for the customer
information at issue;
(2) Requiring your service providers by contract to implement and
maintain such safeguards; and
(3) Periodically assessing your service providers based on the risk
they present and the continued adequacy of their safeguards.
(g) Evaluate and adjust your information security program in light
of the results of the testing and monitoring required by paragraph (d)
of this section; any material changes to your operations or business
arrangements; the results of risk assessments performed under paragraph
(b)(2) of this section; or any other circumstances that you know or
have reason to know may have a material impact on your information
security program.
(h) Establish a written incident response plan designed to promptly
respond to, and recover from, any security event materially affecting
the confidentiality, integrity, or availability of customer information
in your control. Such incident response plan shall address the
following areas:
(1) The goals of the incident response plan;
(2) The internal processes for responding to a security event;
(3) The definition of clear roles, responsibilities, and levels of
decision-making authority;
(4) External and internal communications and information sharing;
(5) Identification of requirements for the remediation of any
identified weaknesses in information systems and associated controls;
(6) Documentation and reporting regarding security events and
related incident response activities; and
(7) The evaluation and revision as necessary of the incident
response plan following a security event.
(i) Require your Qualified Individual to report in writing,
regularly and at least annually, to your board of directors or
equivalent governing body. If no such board of directors or equivalent
governing body exists, such report shall be timely presented to a
senior officer responsible for your information security program. The
report shall include the following information:
(1) The overall status of the information security program and your
compliance with this part; and
(2) Material matters related to the information security program,
addressing issues such as risk assessment, risk management and control
decisions, service provider arrangements, results of testing, security
events or violations and management's responses thereto, and
recommendations for changes in the information security program.
0
6. Revise Sec. 314.5 to read as follows:
Sec. 314.5 Effective date.
Section 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3),
(h), and (i) are effective as of December 9, 2022.
0
7. Add Sec. 314.6 to read as follows:
Sec. 314.6 Exceptions.
Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial
institutions that maintain customer information concerning fewer than
five thousand consumers.
By direction of the Commission, Commissioners Phillips and
Wilson dissenting.
April Tabor,
Secretary.
Note: The following appendix will not appear in the Code of
Federal Regulations.
[[Page 70309]]
Appendix--Statements Issued on October 27, 2021
Statement of Chair Lina M. Khan Joined by Commissioner Rebecca Kelly
Slaughter Regarding Regulatory Review of the Safeguards Rule
Today the FTC is significantly strengthening the Safeguards
Rule,\1\ first promulgated by the FTC twenty years ago pursuant to a
Congressional directive to protect personal information that is
stored by financial institutions. This revamping--the first time in
the Rule's history--is sorely needed. In the twenty years since the
Rule was first issued, the complexity of information security has
increased drastically, the use of computer networks in every aspect
of life has expanded exponentially, and, most notably, an unending
chain of damaging data breaches caused by inadequate security have
cost Americans heavily.\2\ The amendments adopted today require
financial institutions to develop information security programs that
can meet the challenges of today's security environment.
---------------------------------------------------------------------------
\1\ 16 CFR part 314. Pursuant to the Gramm Leach Bliley Act
(``GLB'' or ``GLBA''), Public Law 106-102, 113 Stat. 1338 (1999)
(codified as amended in scattered sections of 12 and 15 U.S.C.), the
Commission promulgated the Safeguards Rule in 2001.
\2\ See, e.g., 2020 Internet Crime Report, Fed. Bur.
Investigations,at 20 (Mar. 2021) (reporting consumer loss of over
$128 million resulting from corporate data breaches to those who
filed complaints in 2020 alone); Int'l Bus. Mach, Cost of a Data
Breach, at 4 (2021) (estimating that the average cost of single data
breach has risen to $4.24 million).
---------------------------------------------------------------------------
For Americans, the harms stemming from the types of security
vulnerabilities that this Rule addresses are all too real. Victims
of breaches have their most sensitive information exposed, making
them more vulnerable to identity theft, phishing attacks, and other
forms of fraud.\3\ In 2018, almost 10 percent of Americans suffered
some form of identity theft, costing many of them hundreds of
dollars and dozens of hours of time, an experience that many
describe as distressing.\4\ For some, the cost is much higher, with
victims losing tens of thousands of dollars.\5\
---------------------------------------------------------------------------
\3\ 2013 Identity Fraud Report: Data Breaches Becoming a
Treasure Trove for Fraudsters, Javelin Strategy, at 1 (Feb. 2013)
(reporting that 1 in 4 recipients of a data breach notification
become victims of identity theft); Michelle Singletary, Your online
profile may help identity thieves, Washington Post (Feb. 28, 2012),
https://www.washingtonpost.com/business/economy/michelle-singletary-your-online-profile-may-help-identity-thieves/2012/02/28/gIQAXFjygR_story.html (reporting that recipients of data breach
letters are 9.5% more likely to suffer identity theft).
\4\ See Erika Harrell, Victims of Identity Theft, 2018, U.S.
Dep't of Just., at 1 (Apr. 2021), https://bjs.ojp.gov/content/pub/pdf/vit18.pdf.
\5\ See 2021 Consumer Aftermath Report, Identity Theft Resource
Center (2021), at 6 (finding that in a study of 427 identity crime
victims, 21% of them suffered losses of over $20,000).
---------------------------------------------------------------------------
The Rule amendments the FTC is issuing today are strongly
supported by the evidence in the record.\6\ The evidence gathered
from information security experts, industry associations, and
consumer groups--those with hands-on experience in the area and
knowledge of the field--decisively show that the amendments are
necessary. Of course, all of this information supplements the
experience that Commission staff has obtained over twenty years of
enforcing the Rule, and gained through investigations of companies'
data security practices under the FTC's deception and unfairness
authority.
---------------------------------------------------------------------------
\6\ The Commission first sought public comments on the proposed
amendments in April 2019. See Privacy of Consumer Financial
Information Rule Under the Gramm-Leach-Bliley Act, 84 FR 13150;
Standards for Safeguarding Customer Information, 84 FR 13158 (April
4, 2019). The agency received almost 50 comments from consumer
groups, industry associations, and data security experts. See FTC
Seeks Comment on Proposed Amendments to Safeguards and Privacy
Rules, 16 CFR part 314, Project No. P145407, (FTC-2019-0019) (``2019
Safeguards and Privacy NPRM ''), https://www.regulations.gov/docket/FTC-2019-0019/document. Further, the Commission conducted a workshop
discussing the proposed amendments with information security
professionals and experts, including IT staff from financial
institutions covered by the Safeguards Rule. See Transcript,
Information Security and Financial Institutions: An FTC Workshop to
Examine Safeguards Rule, Fed. Trade Comm'n (July 13, 2020)
(``Safeguards Workshop''), https://www.ftc.gov/system/files/documents/public_events/1567141/transcript-glb-safeguards-workshop-full.pdf. Connected with the workshop, the Commission sought and
received another round of public comments on the amendments. The
eleven relevant public comments relating to the subject matter of
the July 13, 2020, workshop can be found here: Postponement of
Public Workshop Related to Proposed Changes to the Safeguards Rule,
85 FR 23354 (FTC-2020-0038) (Apr. 27, 2020) (``Workshop Comment
Docket''), https://www.regulations.gov/document/FTC-2020-0038-0001.
---------------------------------------------------------------------------
The dissent's conclusion that these amendments are unnecessary
is belied by both the reality of rampant data security breaches as
well as the robust evidentiary record. The recent history of major
data breaches affecting millions of consumers shows that more needs
to be done to protect consumers' sensitive information. Despite the
increasing sophistication of cyberattacks, many businesses continue
to offer inadequate security.\7\ In particular, the massive Equifax
breach, which the FTC alleged was caused by inadequate data security
that could have been easily corrected by the company, is a glaring
example of how a financial institution's lax security practices can
have devastating consequences for Americans.\8\ The dissent's
suggestion that our current framework is sufficient falls flat in
the face of such a stark example of the harm that can arise from
avoidable lax security practices by covered financial institutions.
Moreover, the dissent's complaint that the rule is also informed by
evidence arising from breaches and practices occurring in other
types of industries misses the mark. Not only is there substantial
evidence in the rulemaking record clearly illustrating security
lapses of financial institutions that are covered by the Rule,\9\
but the implication that we shouldn't use our broader knowledge of
common security pitfalls is unwise.
---------------------------------------------------------------------------
\7\ See, e.g., Electronic Privacy Information Center, Comment
Letter No. 55 on 2019 Safeguards and Privacy NPRM (FTC-2019-0019),
at 3 (Aug. 1, 2019) (citing dramatic increase in data breaches at
financial services firms affecting millions of consumers), https://www.regulations.gov/comment/FTC-2019-0019-0055; Consumer Reports,
Comment Letter No. 52 on 2019 Safeguards and Privacy NPRM (FTC-2019-
0019) (Aug. 2, 2019), https://www.regulations.gov/comment/FTC-2019-0019-0052 (noting several high profile data breaches at financial
institutions as evidence for the need for stronger regulation);
Inpher, Inc., Comment Letter No. 50 on 2019 Safeguards and Privacy
NPRM (FTC-2019-0019), at 1 (Aug. 1, 2019), https://www.regulations.gov/comment/FTC-2019-0019-0050 (pointing to major
breaches at financial institutions as evidence for the need of
stronger security regulations); Independent Community Bankers of
America, Comment Letter No. 35 on 2019 Safeguards and Privacy NPRM
(FTC-2019-0019) (Aug. 2, 2019), https://www.regulations.gov/comment/FTC-2019-0019-0035 (noting that FTC-regulated financial institutions
are subject to less stringent security requirements than those
regulated by banking agencies, even though many handle the same
types of information as those financial institutions); National
Consumer Law Center et al., Comment Letter No. 58 on 2019 Safeguards
and Privacy NPRM (FTC-2019-0019) (Aug. 2, 2019), https://www.regulations.gov/document/FTC-2019-0019-0058 (arguing that the
recent Equifax breach showed the need for strengthening the
Safeguards Rule); Cisco Systems, Inc., Comment Letter No. 51 on 2019
Safeguards and Privacy NPRM (FTC-2019-0019) (Aug. 2, 2019), https://www.regulations.gov/document/FTC-2019-0019-0051 (noting that
sophisticated hacking techniques used in state sponsored attacks are
likely to be adopted by ``more garden variety, less sophisticated
hackers.''); Safeguards Workshop, at 24-26 (July 13, 2020) (remarks
of Chris Cronin) (stating that many companies do not conduct
complete or adequate risk assessments). Id. at 38-39 (remarks of
Serge Jorgensen) (noting that businesses' understanding of the need
for security has improved, but that they continue to struggle to
implement controls across business units). Id. at 39-41 (remarks of
Chris Cronin) (stating that, ``as a rule,'' businesses of all sizes
are ``behind'' on cybersecurity, attributing this in part to
consultants whose advice about reasonable security is motivated by a
desire to ``make the clients happy''). Id. at 43 (remarks of Pablo
Molina) (citing ``the mounting losses that come from cybercrime'' as
evidence that many businesses are ``falling behind''
cybercriminals). Id. at 114 (remarks of Brian McManamon) (noting
that ``the proposed changes are the minimum necessary to have an
effective security program in place.''). Id. at 44 (remarks of Sam
Rubin) (noting that, in his experience, companies make significant
investments in technical security measures but that investment in
personnel to oversee and use those measures is ``a huge shortcoming
that I'm seeing in the field.''); The Clearing House Association
LLC, Comment Letter No. 49 on 2019 Safeguards and Privacy NPRM (FTC-
2019-0019), at 7-9 (Aug. 2, 2019), https://www.regulations.gov/comment/FTC-2019-0019-0049 (citing a 2018 study by the Center for
Financial Inclusion that showed widespread data security failures
among financial technology companies around the globe).
\8\ Press Release, Fed. Trade Comm'n, Equifax to Pay $575
Million as Part of Settlement with FTC, CFPB, and States Related to
2017 Data Breach, (July 22, 2019), https://www.ftc.gov/news-events/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related.
\9\ See infra, note 7.
---------------------------------------------------------------------------
The record evidence also shows that the amendment's requirements
track bedrock principles of data security and represent proven
elements of effective data security programs that reduce the risk of
breaches.\10\
[[Page 70310]]
The amended Rule requires that financial institutions' information
security plans address such core concepts as controlling who is
accessing their system,\11\ understanding their system,\12\
monitoring what users do in their system,\13\ and protecting the
information contained in their system.\14\ More particularly, it
also requires encryption of customer information and the use of
multifactor authentication. Adopting these practices will reduce the
chances of a breach occurring.
---------------------------------------------------------------------------
\10\ See, e.g., for Single Qualified Individual Requirement:
National Consumer Law Center et al., supra note 7, at 3 (arguing
that a clear line of reporting with a single responsible individual
could have prevented the Equifax consumer data breach); Safeguards
Workshop, at 182-84 (remarks of Adrienne Allen) (stating that
without a single responsible individual, information security staff
``can fall into traps of each relying on someone else to make a hard
call . . . [In a program without a single coordinator] issues can
sometimes fall through the cracks.''). Id. at 184-85 (remarks of
Michele Norin) (``I think it's extremely important to have a person
in front of the information security program. I think that there are
so many components to understand, to manage, to keep an eye on. I
think it's difficult to do that if it's part of someone else's job.
And so I found that it's extremely helpful to have a person in
charge of that program just from a pure basic management perspective
and understanding perspective.''); Risk Assessment Requirement: Id.
at 25 (remarks of Chris Cronin) (stating that evaluating the
likelihoods and impacts of potential security risks and evaluating
existing controls is an important component of a risk assessment).
Id. at 29-30 (remarks of Serge Jorgensen) (emphasizing the
importance of risk assessments as tools for adjusting existing
security measures to account for both current and future security
threats); Encryption Requirement: Princeton University Center for
Information Technology Policy, Comment Letter No. 54 on 2019
Safeguards and Privacy NPRM (FTC-2019-0019), at 3 (Aug. 2, 2019),
https://www.regulations.gov/document/FTC-2019-0019-0054 (noting the
effectiveness of encryption); Inpher, Inc., supra note 7, at 4;
Safeguards Workshop, at 225 (remarks of Matthew Green) (noting
website usage of encryption is above 80 percent; ``Let's Encrypt''
provides free TLS certificates; and costs have gone down to the
point that if a financial institution is not using TLS encryption
for data in motion, it is making an unusual decision outside the
norm). Id. at 106 (remarks of Rocio Baeza) (``[T]he encryption of
data in transit has been standard. There's no pushback with
that.''); Multifactor Authentication Requirement: Princeton
University Center for Information Technology Policy, supra note 10,
at 6-7; Electronic Privacy Information Center, supra, note 7, at 8;
National Consumer Law Center et al., supra note 7, at 2; Safeguards
Workshop, at 102 (remarks of Brian McManamon) (stating that his
company TECH LOCK supports requiring multi-factor authentication for
users connecting from internal networks). Id. at 266 (remarks of
Matthew Green) (explaining that passwords are not enough of an
authentication feature but when MFA is used and deployed, the
defenders can win against attackers). Id. at 239 (describing how
because smart phones have modern secure hardware processors,
biometric sensors and readers built in, increasingly consumers can
get the security they need through the devices they already have by
storing cryptographic authentication keys on the devices and then
using the phone to activate them); Incident Response Plan: Credit
Union National Association, Comment Letter No. 30 on 2019 Safeguards
and Privacy NPRM (FTC-2019-0019), at 2 (Aug. 1, 2019), https://www.regulations.gov/document/FTC-2019-0019-0030 (noting that that an
incident response plan ``helps ensure that an entity is prepared in
case of an incident by planning how it will respond and what is
required for the response.''). Consumer Reports, supra note 7, at 6
(observing that ``a written incident response plan is an essential
component of a good security system.''); HITRUST, Comment Letter No.
18 on 2019 Safeguards and Privacy NPRM (FTC-2019-0019), at 2 (July
1, 2019), https://www.regulations.gov/document/FTC-2019-0019-0018
(commenting that incident response plans can help organizations ``to
better allocate limited resources.). Safeguards Workshop, at 52
(remarks of Serge Jorgenson) (observing that a prompt response to an
incident can prevent a ``threat actor running around in my
environment for days, months, years, and able to access anything
they want.''); Board Reporting Requirement: Workshop participants
Adrienne Allen, Karthik Rangarajan, and Michele Norin each
emphasized that such reporting can aid decision making. See
Safeguards Workshop, at 201-09; see also Rocio Baeza, Comment Letter
No. 12 on Workshop Comment Docket (FTC-2020-0038), at 3-8 (Aug. 12,
2020), https://www.regulations.gov/comment/FTC-2020-0038-0012
(supporting requirement and providing sample report form and
compliance questionnaire); Juhee Kwon et al., The Association
Between Top Management Involvement and Compensation and Information
Security Breaches, J. L. Info. Sys., at 219-236 (2013) (``. . . the
involvement of an IT executive decreases the probability of
information security breach reports by about 35 percent . . .'');
Julia L. Higgs et al., The Relationship Between Board-Level
Technology Committees and Reported Security Breaches, J. L. Info.
Sys., at 79-98 (2016) (``[A]s a technology committee becomes more
established, its firm is not as likely to be breached. To obtain
further evidence on the perceived value of a technology committee,
this study uses a returns analysis and finds that the presence of a
technology committee mitigates the negative abnormal stock returns
arising from external breaches.'').
\11\ 16 CFR 314.4(c)(1).
\12\ 16 CFR 314.4(c)(2).
\13\ 16 CFR 314.4(c)(8).
\14\ 16 CFR 314.4(c)(3) and 314.4(c)(5).
---------------------------------------------------------------------------
In fact, it is likely that the massive breach at Equifax could
have been prevented or mitigated by adopting practices required by
these amendments. For example, the Commission's complaint alleged
that the vulnerability that led to the breach was not detected for
four months because Equifax's automated vulnerability scanner was
not configured to scan all of the networks in the system, something
that could have been prevented if Equifax had performed an adequate
inventory of its system as required by Sec. 314.4(c)(2) of the
amended Rule.\15\ Equifax allegedly did not encrypt the data of 145
million consumers as required by Sec. 314.4(c)(3) of the amended
Rule; such encryption might have prevented the intruders from
misusing individuals' sensitive information, even if they were able
to obtain it.\16\ In addition, the complaint charged that Equifax
did not adequately monitor activity on its network, which allowed
intruders to access and use their network undetected for months;
such monitoring will be required by Sec. 314.4(c)(8).\17\ Finally,
and perhaps most importantly, Equifax split authority over its
information security program between two people, which caused
failures of communications and oversight.\18\ Indeed, the U.S. House
Committee on Oversight and Government identified Equifax's
organization as one of the major causes of the breach.\19\
Appointing a single Qualified Individual as the coordinator of
Equifax's information security system, as required by Sec. 314.4(a)
of the amended Rule, could have helped prevent or limit the scope of
one of the largest breaches in American history. By implementing the
measures required in the amended Rule, financial institutions will
prevent or mitigate many future breaches, protecting consumers and
their information.
---------------------------------------------------------------------------
\15\ Compl. for Permanent Injunction & Other Relief., FTC v.
Equifax, Inc., No. 1:19-mi-99999-UNA (N.D. Ga. July 22, 2019) ] 17.
\16\ Id. ] 22.E.
\17\ Id. ] 22.F.
\18\ While the dissent questions the requirements in the Rule
regarding elevating security issues to the top levels of the
corporate structure, research supports these requirements. Boards
are becoming increasingly involved in cybersecurity governance, as
demonstrated by surveys of practitioners and the growth of
literature aimed at educating board members on cybersecurity. Some
studies suggest that Board attention to data security decisions can
dramatically improve data safeguarding. For example, one study found
a 35% decrease in the probability of information security breaches
when companies include the Chief Information Security Officer (or
equivalent) in the top management team and the CISO has access to
the board. See Juhee Kwon et al., supra note 10. see also Safeguards
Workshop, at 201-09.
\19\ U.S. H. Rep. Comm. on Oversight and Gov. Reform, Majority
Staff Report on The Equifax Data Breach, 115th Cong., at 55-62 (Dec.
2018).
---------------------------------------------------------------------------
There is also no support for the dissent's notion that the
amendments eliminate financial institutions' flexibility in a way
that will hurt smaller businesses. The amendments require that
information security programs address certain aspects of security,
but do not prescribe any particular method for doing so.
Specifically, the amended Rule requires that the information
security program address areas such as access control, change
management, information disposal, and monitoring user activity, but
it does not require that financial institutions take any particular
action in those areas. In fact, the Rule recognizes the concerns of
small businesses and adopts appropriate flexibilities. Section 314.6
of the revised Rule exempts financial institutions that maintain
information concerning fewer than 5,000 consumers from certain
requirements. In addition, financial institutions with smaller and
simpler systems may determine that minimal procedures are required
in those areas, and they retain flexibility under these amendments
to follow that route. Moreover, the record contains significant
evidence that there are free and low-cost solutions for smaller
businesses with more modest data security needs.\20\
---------------------------------------------------------------------------
\20\ See, e.g., Safeguards Workshop, at 267 (remarks of Wendy
Nather) (``we have a lot more options, a lot more technologies today
than we did before that are making both of these solutions, both
encryption and MFA, easier to use, more flexible, in some cases
cheaper, and we should be encouraging their adoption wherever
possible.''). Id. at 265-66 (remarks of Matthew Green) (``I think
that we're in a great time when we've reached the point where we can
actually mandate that encryption be used. . . . And we've reached
the point where now it is something that's come to be and we can
actually build well.''). Id. at 229-30 (remarks of Randy Marchany)
(noting that encryption is already built into the Microsoft Office
environment and that a number of Microsoft products, such as
Spreadsheets, Excel, Docs, and PowerPoint, support that encryption
feature). Id. at 225. Id. at 106 (Remarks of Rocio Baeza) (``[T]he
encryption of data in transit has been standard. There's no pushback
with that.''). Id. at 74 (remarks of James Crifasi) (stating that
car dealerships can rely on existing staff for the role of Qualified
Individual). Id. at 78-79 (remarks of Lee Waters) (stating that any
dealership with any IT staff at all would have someone who could
assume the role of ``qualified individual,'' perhaps requiring some
additional research or outside help). Id. at 81-82 (remarks of Rocio
Baeza) (stating that companies may use an existing employee for the
role and ``for any areas where there may be skill gaps, that can be
supplemented with either certifications or some type of
education.''). Id. at 89-90 (remarks of Brian McManamon) (noting
that the size of a financial institution and the amount and nature
of the information that it holds factor into an appropriate
information security program); Presentation Slides, Inf. Security &
Fin. Inst.: An FTC Workshop of GLB Safeguards, at 27-28 (July 13,
2020) (slides Accompanying remarks of Rocio Baeza, ``Models for
Complying to the Safeguards Rule Changes) (``Safeguards Workshop
Presentation Slides'') https://www.ftc.gov/system/files/documents/public_events/1567141/slides-glb-workshop.pdf (describing three
different compliance models: In-house, outsource, and hybrid, with
costs ranging from $199 per month to more than $15,000 per month).
Safeguards Workshop, at 81-83 (remarks of Rocio Baeza) (describing
three compliance models in more detail); Safeguards Workshop
Presentation Slides, at 29 (remarks of Brian McManamon, ``Sample
Pricing'') (estimating the cost of cybersecurity services based on
number of endpoints). Id. at 83-85.
---------------------------------------------------------------------------
[[Page 70311]]
We believe that these amendments represent a much-needed step
forward in protecting Americans' data security. Given growing
recognition that the requirements captured in the Rule represent
best practices, some financial institutions seem to have already
taken appropriate steps to protect customers' data and meet the
requirements set out in the amended Rule. It is important, though,
to require those that lag behind to strengthen their security and
prevent future breaches before they occur, rather than in the wake
of a devastating breach after the damage has already been done.
Joint Statement of Commissioners Noah Joshua Phillips and Christine S.
Wilson in the Matter of the Final Rule Amending the Gramm-Leach-Bliley
Act's Safeguards Rule
In 1999, Congress passed the Gramm-Leach-Bliley Act, which
charged the Federal Trade Commission (the ``Commission'') with
promulgating and enforcing a regulation to ensure that financial
firms take care to safeguard the information they collect from
consumers.\1\ The Safeguards Rule \2\ has established more data
security obligations for consumer financial data than for data
collected by non-financial firms, a gap that underlies our view--
shared by our colleagues--that congressional data security
legislation is warranted.
---------------------------------------------------------------------------
\1\ Public Law 106-102, 113 Stat. 1338 (1999). Notably, even as
it transferred authority for other consumer financial regulation to
the Consumer Financial Protection Bureau in the Dodd-Frank Act,
Congress left this rulemaking authority with the Commission, a vote
of confidence in our approach. 15 U.S.C. 6804(a)(1).
\2\ 16 CFR part 314.
---------------------------------------------------------------------------
One hallmark of the Safeguards Rule is its recognition that, in
a world of continuously evolving threats and standards, a one-size-
fits-all approach to data security may not work. Under Democratic
and Republic leadership, the Commission has repeatedly emphasized
this principle.\3\ We have traditionally eschewed an overly
prescriptive approach, both to data security in general and to the
Safeguards Rule itself.\4\ The FTC has never demanded ``perfect''
security because the Commission has recognized that data security is
neither cost- nor consequence-free, and often requires tradeoffs.\5\
At the same time, during our tenure, the Commission has continued to
enforce data security standards vigorously, including those embodied
in the Safeguards Rule.\6\
---------------------------------------------------------------------------
\3\ See, e.g., Federal Trade Commission, Statement Marking the
FTC's 50th Data Security Settlement, at 1 (Jan. 31, 2014), https://www.ftc.gov/system/files/documents/cases/140131gmrstatement.pdf
(``FTC Data Security Statement'') (``Through its settlements,
testimony, and public statements, the Commission has made clear that
it does not require perfect security; reasonable and appropriate
security is a continuous process of assessing and addressing risks;
there is no one-size-fits-all data security program; and the mere
fact that a breach occurred does not mean that a company has
violated the law.''); see also Prepared Statement of the Federal
Trade Commission: Before the Committee on Homeland Security and
Governmental Affairs Permanent Subcommittee on Investigations, 116
Cong. 3 (2019) (statement of Andrew Smith, Director, Bureau of
Consumer Protection) (``[t]here is no one-size-fits-all data
security program . . .''), https://www.ftc.gov/system/files/documents/public_statements/1466607/commission_testimony_re_data_security_senate_03072019.pdf. Federal
Trade Commission, Stick with Security: A Business Blog Series (Oct.
2017), https://www.ftc.gov/news-events/blogs/business-blog/2017/10/stick-security-ftc-resources-your-business.
\4\ FTC Notice of Proposed Rulemaking, 84 FR 13158 (Apr. 4,
2019), https://www.federalregister.gov/documents/2019/04/04/2019-04981/standards-for-safeguarding-customer-information (``The
Commission continues to believe that a flexible, non-prescriptive
Rule enables covered organizations to use it to respond to the
changing landscape of security threats, to allow for innovation in
security practices, and to accommodate technological changes and
advances.'').
\5\ Under the FTC's unfairness authority, the Commission brings
cases when companies under its jurisdiction fail to employ
``reasonable'' security. FTC Data Security Statement, supra note 3
(``The touchstone of the Commission's approach to data security is
reasonableness: a company's data security measures must be
reasonable and appropriate in light of the sensitivity and volume of
consumer information it holds, the size and complexity of its
business, and the cost of available tools to improve security and
reduce vulnerabilities.'').
\6\ See, e.g., In the matter of Ascension Data & Analytics, LLC,
FTC File No. 1923126 (2020), https://www.ftc.gov/enforcement/cases-proceedings/192-3126/ascension-data-analytics-llc-matter; U.S. v.
Mortgage Solutions FCS, Inc., Civ. Action No. 4:20-cv-110 (N.D. Cal
2020), https://www.ftc.gov/enforcement/cases-proceedings/182-3199/mortgage-solutions-fcs-inc; FTC v. Equifax, Inc., Civ. Action No.
1:19-cv-03297-TWT (N.D. Ga. 2019), https://www.ftc.gov/enforcement/cases-proceedings/172-3203/equifax-inc.
---------------------------------------------------------------------------
In March 2019, the Commission approved a Notice of Proposed
Rulemaking (``NPRM'') proposing additional requirements to the
Safeguards Rule. While we recognize the value in regularly reviewing
our rules and updating them as needed, we dissented then because the
proposal lacked data demonstrating the need for and efficacy of the
proposed amendments.\7\
---------------------------------------------------------------------------
\7\ Dissenting Statement of Commissioner Noah Joshua Phillips
and Commissioner Christine S. Wilson, Review of Safeguards Rule
(Mar. 5, 2019), https://www.ftc.gov/system/files/documents/public_statements/1466705/reg_review_of_safeguards_rule_cmr_phillips_wilson_dissent.pdf; See,
e.g., Noah Joshua Phillips (@FTCPhillips), Twitter (Mar. 5, 2019,
3:08 p.m.), https://twitter.com/FTCPhillips/status/1103024596247289867 (``A reexamination of the Rule may indeed be
appropriate and necessary; but, before we borrow from other existing
schemes, we must first understand whether the existing Rule is
inadequate for its purpose and whether the data supports the
efficacy of the alternatives.''); Christine S. Wilson, Remarks at
NAD 2020, One Step Forward, Two Steps Back: Sound Policy on Consumer
Protection Fundamentals 7-8 (Oct. 5, 2020), https://www.ftc.gov/system/files/documents/public_statements/1581434/wilson_remarks_at_nad_100520.pdf.
---------------------------------------------------------------------------
We appreciate Staff's diligent work on this rule and many of the
modifications made to the original proposal. The Federal Register
Notice does a commendable job of presenting the full panoply of
comments that the Commission received. The FTC is at its best when
it seeks input from experts, industry, and consumer groups; this
rulemaking process reflects a commitment to that approach. But the
comment period did not produce data demonstrating that the previous
iteration of the rule was inadequate, or that the costs and
consequences of the new prescriptive obligations will translate into
actual consumer safeguards. That was our concern, and the comments
did not allay it.
In fact, as several commenters observed, the new prescriptive
requirements could weaken data security by diverting finite
resources towards a check-the-box compliance exercise and away from
risk management tailored to address the unique security needs of
individual financial institutions. It is ironic that the revisions
mandate a risk assessment and then order firms to prioritize
specified precautions ahead of the risks and needs counseled by that
assessment. The revisions also impose intrusive corporate governance
obligations wholly unsupported by record evidence of prevalent
failures at the senior managerial level.
For these reasons, which we explain more fully below, we
dissent.
The Record Fails To Provide a Basis for the New Requirements
We expressed concern in March 2019 that some of the proposals in
the NPRM tracked issues that arose in cases involving firms not
covered by the Safeguards Rule. That is, those failures occurred at
companies to which the Safeguards Rule did not apply. And heightened
obligations imposed in a settlement context, when a company has
engaged in risky and allegedly illegal behavior, may not be
appropriate for all market participants. We did not see evidence
that covered firms had a systematic problem--i.e., that the Rule was
not
[[Page 70312]]
working.\8\ The Commission can--and does-- promote best practices
and reasonable care requirements through speeches, guidance,
reports, and the like, to help financial firms evaluate whether they
are taking proper precautions.\9\ But new rules that set concrete
standards for all companies, regardless of risk, require more
justification. Such rules make companies liable for penalties, and
could focus efforts on compliance to address penalty deterrence
rather than risk.
---------------------------------------------------------------------------
\8\ Commenters on the proposed rules reflected these same
concerns. See, e.g, CTIA (comment 34, NPRM) at 4, https://www.regulations.gov/comment/FTC/2019-0019-0034 (observing that most
examples cited in the NPRM are from non-financial firms and arguing
that the FTC's action in Equifax demonstrated that the agency is
able to use to the current framework effectively); Global Privacy
Alliance (comment 38, NPRM) at 4, https://www.regulations.gov/comment/FTC/2019-0019-0038 (the changes to the rules started not
from FTC experience but rather from state laws); Electronic
Transactions Association (comment 27, NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0027 (the current rule is
effective and there are no harms that warrant these changes);
National Automobile Dealers Association (comment 46, NPRM) at 6,
https://www.regulations.gov/comment/FTC/2019-0019-0046 (``[N]ew
requirements for all financial institutions should not be based on
unrelated enforcement actions that may not be generally applicable
to all financial institutions subject to the Rule.'').
\9\ Federal Trade Commission, Data Security, https://www.ftc.gov/datasecurity.
---------------------------------------------------------------------------
Dozens of commenters have shared their views on the Safeguards
proposal, and FTC Staff held a workshop to evaluate the need to
change the Rule. While there is no shortage of opinions as to the
need and benefits of the proposed changes (nor is there a shortage
of opinions critiquing the new requirements), this process failed to
provide evidence of market failure or other systemic problems \10\
necessitating the proposed changes for firms already governed by the
requirements of the Rule. In fact, one commenter that generally
supported the rule changes noted that it was not clear that the new
rules would have prevented the alleged lapses that led to the
Equifax breach, the largest Safeguards case on record.\11\
---------------------------------------------------------------------------
\10\ One study cited by commenters pointed toward widespread
problems among fintech firms ``including misuse of cryptography, use
of weak cryptography, and excessive permission requirements.'' The
Clearing House Association LLC (comment 49, NPRM) at 7-9, https://www.regulations.gov/comment/FTC/2019-0019-0049 (citing a 2018 study
by the Center for Financial Inclusion, https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2018/09/CFI43-CFI_Online_Security-Final-2018.09.12.pdf). This study
included firms from around the world and did not indicate that this
limited set of issues arose in U.S. firms covered by the Safeguards
Rule. See also National Automobile Dealers Association (comment 46,
NPRM) at 46, https://www.regulations.gov/comment/FTC/2019-0019-0046
(``These requirements have largely not been proven to be necessary
or effective.''). Participants at the FTC's July 2020 Workshop
generally agreed that companies could invest more in security, but
the fact of under-investment does not mean that these changes to the
Safeguards Rule constitute the best course of action. FTC,
Information Security and Financial Institutions: An FTC Workshop to
Examine Safeguards Rule Tr. at 23-70 (July 13, 2020), https://www.ftc.gov/system/files/documents/public_events/1567141/transcript-glb-safeguards-workshop-full.pdf (``Safeguards Workshop'').
\11\ Consumer Reports (comment 52, NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0052 at 2. Not all the
commenters agreed with this perspective, and some felt that these
rules would have prevented the Equifax breach. See National Consumer
Law Center and others (comment 58, NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0058. Chair Khan and
Commissioner Slaughter focus on the Equifax breach to justify the
adoption of prescriptive and complex data security measures,
measures that match the sophistication and complexity of the
consumer financial data managed by one of the largest credit
bureaus. But even assuming the new rules would have prevented it,
one (albeit) high-profile breach, without more, should not be
extrapolated to an entire industry with diverse business models
housing varied consumer financial data. Reasonable safeguards for a
company like Equifax, based on its size and complexity, the nature
and scope of its activities, and the sensitivity of the information
involved, would likely outpace procedures that would be appropriate
or reasonable for a sole proprietorship or small business.
---------------------------------------------------------------------------
That these proposals may constitute best practices appropriate
to certain firms or situations does not justify imposing them on
every firm and in every situation.\12\ The FTC historically has been
appropriately cautious in mandating specific security practices, and
we see no sound basis in the rulemaking record to change that
approach.\13\
---------------------------------------------------------------------------
\12\ While the Final Rule is based on proposals from New York
State Department of Financial Services (``NYDFS''), the FTC imposes
its requirements much more broadly than the NYDFS Cybersecurity
Requirements for Financial Services Companies, 23 NYCRR Pt. 500. The
NYDFS requirements exempt a much larger cross-section of
organizations from the most onerous, prescriptive, and expensive
provisions in their rule. 23 NYCRR Sec. 500.19. Nor do the
exceptions in the Final Rule, while helpful, suffice.
\13\ Unfortunately, this is not the first time this Commission
has emphasized what we can do over what we should do. See, e.g.,
Joint Statement of Commissioners Noah Joshua Phillips and Christine
S. Wilson, In the matter of Resident Home LLC, Commission File No.
2023179 (Oct. 7, 2021), https://www.ftc.gov/system/files/documents/public_statements/1597270/resident_home_dissenting_statement_wilson_and_phillips_final_0.pdf;
Joint Statement of Commissioners Noah Joshua Phillips and Christine
S. Wilson, U.S. v. iSpring Water Systems, LLC, Commission File No.
C4611 (Apr. 12, 2019), https://www.ftc.gov/system/files/documents/public_statements/1513499/ispring_water_systems_llc_c4611_modified_joint_statement_of_commissioners_phillips_and_wilson_4-12.pdf.
---------------------------------------------------------------------------
The Revised Safeguards Rule Is Premature
In our 2019 statement, we expressed concern that the proposals
in the NPRM were premature. They are based in large part on the New
York Department of Financial Service data security rules,\14\
adopted in 2016. At the same time, Congress and the Executive Branch
were evaluating new privacy and data security legislation that may
overlap with the proposed amendments.\15\
---------------------------------------------------------------------------
\14\ Cybersecurity Requirements for Financial Services
Companies, 23 NYCRR Pt. 500 (2016).
\15\ See Consumer Data Industry Association (comment 36, NPRM)
at 2, https://www.regulations.gov/document?D=FTC-2019-0019-0036
(noting that the NY rule is too recent and Congress is debating new
legislation that should be left to Congress to resolve); National
Automobile Dealers Association (comment 46, NPRM) at 46, https://www.regulations.gov/comment/FTC-2019-0019-0046 (The new rules ``are
premature as they are based on untested and new standards in a
rapidly changing environment, and in a context where federal debate
is ongoing.''); New York Insurance Association (comment 31, NPRM),
https://www.regulations.gov/comment/FTC-2019-0019-0031 (it is
premature to adopt these rules without the benefit of the state's
experience).
---------------------------------------------------------------------------
Since our original statement, we have been provided with no
additional information on the impact and efficacy of the NYDFS
rules.\16\ Without this critical input, we do not believe adopting
wholesale the NYDFS approach is the prudent course.\17\ We would
have been better served by monitoring the efficacy, costs and
unintended consequences of the NYDFS rules during this ramp-up
period. Imposing similar rules on far more firms across a broader
array of industries makes even less sense.
---------------------------------------------------------------------------
\16\ We appreciate the time and resources the NYDFS invested in
commenting on our proposed rule. Though the NYDFS does say that its
rules have ``enhanced cybersecurity protection across the financial
industry and fostered an environment in which the threat of a cyber
attack is taken seriously at all levels of New York's financial
services firms,'' it offers no supporting data. New York State
Department of Financial Services (comment 40, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0040.
\17\ As several commenters pointed out, the NYDFS rules are more
nuanced that the amendments introduced today. For instance, under
the NYDFS regulations, certain additional requirements only apply to
a category of sensitive data, a limitation not carried through to
the Safeguards Rule. See, e.g., U.S. Chamber of Commerce (comment
33, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0033;
CTIA (comment 34, NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0034; Electronic Transactions Association (comment 27,
NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0027. These
distinctions only raise more questions and concerns about basing our
regulations on the New York rules.
---------------------------------------------------------------------------
Congress, with the encouragement of the Commission, has
continued to consider legislative initiatives in this area.
Throughout 2019, 2020 and 2021, we saw the release of several draft
bills addressing data security, as well as privacy.\18\ And other
developments, such as data security requirements of the General Data
Protection Regulation \19\ and new cybersecurity incidents \20\
ensure that
[[Page 70313]]
these issues will continue to draw congressional attention. The
decisions about tradeoffs in this space are complex and significant
for consumers, business, and government; intrusive mandates are best
left to the people's representatives rather than to the vagaries of
the administrative rulemaking process.\21\
---------------------------------------------------------------------------
\18\ See, e.g., Fourth Amendment is Not for Sale Act, S. 1265,
117th Cong. (2021); Data Care Act of 2021, S. 919, 117th Cong.
(2021); Data Protection Act of 2021, S. 2134, 117th Cong. (2021);
SAFE DATA Act, S. 2499, 117th Cong. (2021); Consumer Online Privacy
Rights Act, S. 2968, 116th Cong. (2019). See also, California
Privacy Rights Act of 2020, Cal. Civ. Code Sec. 1798.100 et seq.;
Virginia Consumer Data Protection Act, Va. Code Sec. 59.1-575 et
seq.; and Colorado Privacy Act, 2021 Colo. ALS 483, 2021 Colo. Ch.
483, 2021 Colo. SB. 190.
\19\ Council Directive 2016/679, art. 32 2016 O.J. (L119).
\20\ See, e.g., Joseph Menn and Christopher Bing, Hackers of
SolarWinds stole data on U.S. sanctions policy, intelligence probes,
Reuters (Oct. 8, 2021), https://www.reuters.com/world/us/hackers-solarwinds-breach-stole-data-us-sanctions-policy-intelligence-probes-2021-10-07/; Stephanie Kelly and Jessica Resnick-ault, One
password allowed hackers to disrupt Colonial Pipeline, CEO tells
senators, Reuters (June 8, 2021), https://www.reuters.com/business/colonial-pipeline-ceo-tells-senate-cyber-defenses-were-compromised-ahead-hack-2021-06-08; Carly Page, The Accellion data breach
continues to get messier, TechCrunch (July 8, 2021), https://techcrunch.com/2021/07/08/the-accellion-data-breach-continues-to-get-messier/; Peter Valdes-Dapena, Volkswagen hack: 3 million
customers have had their information stolen, CNN (June 11, 2021),
https://www.cnn.com/2021/06/11/cars/vw-audi-hack-customer-information/.
\21\ Sen. Roger Wicker, Rep. Cathy McMorris Rodgers, & Noah
Phillips, FTC must leave privacy legislating to Congress, Wash.
Examiner (Sept. 29, 2021), https://www.washingtonexaminer.com/opinion/op-eds/ftc-must-leave-privacy-legislating-to-congress.
Substance aside, businesses and consumers need confidence to plan
around new rules. As the recent--and perhaps future--debate about
net neutrality rules has demonstrated, agency rules are subject to
disruptive swings that undermine such confidence.
---------------------------------------------------------------------------
The Revised Rules Inhibit Flexibility and Impose Substantial Costs
The Safeguards Rule originally drafted and evaluated by the
Commission embraced a flexible approach, emphasizing protections
targeted to a company's size and risk profile.\22\ As we wrote in
2019, these new rules move us away from that approach; that loss of
flexibility will impose costs without necessarily improving
safeguards for consumer data, which should be the point of this
exercise.
---------------------------------------------------------------------------
\22\ The Commission itself acknowledges the importance of
flexibility in issuing the Final Rule. See, e.g., Final Rule at 27
(``The Commission, however, believes that the elements provide
sufficient flexibilityfor financial institutions to adopt
information security programs suited to the size, nature, and
complexity of their organization and information systems.'')
---------------------------------------------------------------------------
Commenters and the Commission itself have noted that there are
financial impacts to these new requirements.\23\ The Small Business
Administration's Office of Advocacy stated its belief that the
Commission itself does not appear to understand fully the economic
impact of the proposed changes to the Safeguards Rule.\24\
---------------------------------------------------------------------------
\23\ See Final Rule; American Council on Education (comment 24,
NPRM) at 13-14, https://www.regulations.gov/comment/FTC-2019-0019-0024; Wisconsin Bankers Association (comment 37, NPRM) at 1-2,
https://www.regulations.gov/comment/FTC-2019-0019-0037; American
Financial Services Association (comment 41, NPRM) at 4, https://www.regulations.gov/comment/FTC-2019-0019-0041; National Association
of Dealer Counsel (comment 44, NPRM) at 1, https://www.regulations.gov/comment/FTC-2019-0019-0044; National Automobile
Dealers Association (comment 46, NPRM) at 11, https://www.regulations.gov/comment/FTC-2019-0019-0046; National Independent
Automobile Dealers Association, (comment 48, NPRM) at 3, https://www.regulations.gov/comment/FTC-2019-0019-0048; Gusto and others
(comment 11, Workshop) at 2-4, https://www.regulations.gov/comment/FTC-2019-0019-0011; National Pawnbrokers Association (comment 3,
NPRM) at 2, https://www.regulations.gov/comment/FTC-2019-0019-0032;
See also Remarks of James Crifasi, Safeguards Workshop, supra note
10, Tr. at 72-74, https://www.ftc.gov/system/files/documents/public_events/1567141/transcript-glb-safeguards-workshop-full.pdf
(study showing that compliance costs are unaffordable for small
businesses).
\24\ Small Business Administration Office of Advocacy (comment
28, NPRM) at 3-4, https://www.regulations.gov/comment/FTC-2019-0019-0028 (``An agency cannot consider alternatives that minimize any
significant economic impact if the agency does not know what the
economic impact of the proposed action is.'').
---------------------------------------------------------------------------
The burden of these new rules may also reduce competition and
innovation, as smaller firms less able to absorb the financial costs
cede ground to larger firms better equipped to handle new regulatory
mandates.\25\
---------------------------------------------------------------------------
\25\ See CTIA (comment 34, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0034 (noting the need for more study on the
costs to competition); U.S. Chamber of Commerce (comment 33, NPRM)
at 4, https://www.regulations.gov/comment/FTC-2019-0019-0033 (``Some
private organizations can absorb the added costs, while others
cannot.''). See also Christine S. Wilson, Remarks at the Future of
Privacy Forum, A Defining Moment for Privacy: The Time is Ripe for
Federal Privacy Legislation 13 (Feb. 6, 2020), https://www.ftc.gov/system/files/documents/public_statements/1566337/commissioner_wilson_privacy_forum_speech_02-06-2020.pdf
(``Importantly, the legislative framework should also consider
competition. Regulations, by their nature, will impact markets and
competition. GDPR may have lessons to teach us in this regard.
Research indicates that GDPR may have decreased venture capital
investment and entrenched dominant players in the digital
advertising market.''); Noah Joshua Phillips, Prepared Remarks at
internet Governance Forum USA, Keep It: Maintaining Competition in
the Privacy Debate (July 27, 2018), https://www.ftc.gov/system/files/documents/public_statements/1395934/phillips_-_internet_governance_forum_7-27-18.pdf (discussing the competition
impacts of new privacy rules).
---------------------------------------------------------------------------
Security itself may also suffer. A series of specific rules can
incentivize companies to move from a thoughtful assessment of risk
and precautions to a check-the-box exercise to ensure that they are
complying with regulatory mandates--in other words, from a focus on
real security to an emphasis on rule compliance.\26\ One commenter
cited data demonstrating that when security personnel are busy with
compliance and regulatory response, they have less time to focus on
a firm's actual security needs.\27\ Further, without the flexibility
to prioritize, finite resources may be diverted to areas of lower
risk but higher regulatory scrutiny; \28\ commenters noted the irony
of mandating a risk assessment and then ordering firms to prioritize
specified precautions ahead of the risks and needs counseled by that
assessment.\29\ And potentially innovative security practices that
address changing threats and needs may be discouraged.\30\ As
[[Page 70314]]
one commenter noted, ``[e]ven today's best practices will be
overtaken by future changes in both technology and the capabilities
of threat actors,'' \31\ and these proscriptive rules lose the
``self-modernizing'' nature of flexible requirements,\32\ locking in
place the primacy of current practices.\33\
---------------------------------------------------------------------------
\26\ See U.S. Chamber of Commerce (comment 33, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0033; Consumer Data
Industry Association (comment 36, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0036; Global Privacy
Alliance (comment 38, NPRM), https://www.regulations.gov/comment/FTC/2019-0019-0038. While some parts of the rule, such as encryption
requirements, allow security officials to make a written
determination that a different precaution is appropriate, it seems
unlikely that any individual security official will risk liability
to make such a determination and the specific requirements here will
likely become the default rule. American Council on Education
(comment 24, NPRM) at 12, https://www.regulations.gov/comment/FTC-2019-0019-0024 (``In the absence of a clear delineation by the
Commission of what alternatives an institutional information
security executive might approve that the Commission considers
reasonably equivalent, and assurance that they are reasonably
applicable in our contexts, that pressure release valve in the
requirement seems unlikely to release much pressure.''); Software
Information & Industry Association (comment 29, NPRM) at 3, https://www.regulations.gov/comment/FTC-2019-0019-0056 (``The mere threat of
a per se law violation will chill these approvals except in the most
ironclad circumstances, thereby potentially thwarting
industry[hyphen]wide adoption of new and better security
standards.''); New York Insurance Association (comment 31, NPRM),
https://www.regulations.gov/comment/FTC-2019-0019-0031 (``This runs
the risk that companies might feel compelled to encrypt all consumer
data regardless of whether the CISO's compensating controls would be
second guessed in the event a company were to lose unencrypted
customer information.''); Mortgage Bankers Association (comment 26,
NPRM) at 4, https://www.regulations.gov/comment/FTC-2019-0019-0026
(noting the obligation to prepare an incident response plan had
``the potential to cripple small businesses under the pressure of
repeatedly checking the boxes for potential harmless events.'').
\27\ Bank Policy Institute (comment 39, NPRM) at 6, https://www.regulations.gov/comment/FTC-2019-0019-0039 (``When the sector
surveyed its information security teams in late 2016, CISOs reported
that approximately 40% of their cyber team's time was spent on
compliance related matters, not on cybersecurity. Due to one
framework issuance, in particular, the reconciliation process
delayed one firm's implementation of a security event monitoring
tool intended to better detect and respond to cyber-attacks by 3-6
months. With respect to another issuance, another firm stated that
91 internal meetings were held to determine how that issuance
aligned with its program and in gathering data for eventual
regulatory requests.'').
\28\ See U.S. Chamber of Commerce (comment 33, NPRM) at 4,
https://www.regulations.gov/comment/FTC-2019-0019-0033 (``the
proposed requirements would increasingly divert company resources
toward compliance and away from risk management activities that are
tailored to businesses' unique security needs.''); Software
Information & Industry Association (comment 29, NPRM) at 3, https://www.regulations.gov/comment/FTC-2019-0019-0056 (``The effect of a
prescriptive approach in this enforcement structure is to place
companies in the position of forced compliance with potentially
unnecessary or inapplicable requirements without the appropriate
process for these covered entities to explain to a supervisory
authority why it is unnecessary.''); American Financial Services
Association (comment 41, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0041. In some cases, asking too much of small
businesses for whom all this is a substantial undertaking may lead
them to fail at even the basic protections. Safeguards Workshop,
supra note 10, Tr. at 118-19 (July 13, 2020), https://www.ftc.gov/system/files/documents/public_events/1567141/transcript-glb-safeguards-workshop-full.pdf.
\29\ See Bank Policy Institute (comment 39, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0039; Money Services Round
Table (comment 53, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0053.
\30\ See Consumer Data Industry Association (comment 36, NPRM)
at 7-8, https://www.regulations.gov/comment/FTC-2019-0019-0036
(minimization requirement can impact innovative uses more broadly).
\31\ See Cisco Systems Inc. (comment 51, NPRM) at 3, https://www.regulations.gov/comment/FTC-2019-0019-0051 (noting also in the
context of multi-factor authentication that there will come a time
when it is no longer the ``appropriate baseline'' and ``covered
entities could find themselves in full compliance with the rule as
long as they use access control technology no less protective than
MFA as defined in the Proposed Amendments.'').
\32\ National Automobile Dealers Association (comment 46, NPRM),
https://www.regulations.gov/comment/FTC-2019-0019-0046.
\33\ See CTIA (comment 34, NPRM) at 3-5, https://www.regulations.gov/comment/FTC-2019-0019-0034 (flexibility in the
rule allowed it to keep up with evolving threats, whereas new rule
could limit innovation); HITRUST Alliance (comment 18, NPRM),
https://www.regulations.gov/comment/FTC-2019-0019-0018 (expressing
concern about creating outdated requirements); The American
Financial Services Association (comment 41, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0041.
---------------------------------------------------------------------------
The reduction in flexibility and imposition of these costs must
be justified by a significant reduction in risk or some other
substantial consumer benefit. But the record provides scant support
for these tradeoffs. Or as one commenter put it:
[A]s with many of these requirements, we do not take issue with
the notion that there is merit to this step [requiring monitoring],
and that many financial institutions will implement some version of
this control. However, by making this an explicit, stand-alone
requirement, the Commission is enshrining costs and efforts that
will be extensive and will likely not be needed in all
circumstances.\34\
---------------------------------------------------------------------------
\34\ National Automobile Dealers Association (comment 46, NPRM)
https://www.regulations.gov/comment/FTC-2019-0019-0046 (arguing that
the Commission needs additional study into the costs and benefits);
See also Consumer Data Industry Association (comment 36, NPRM),
https://www.regulations.gov/comment/FTC-2019-0019-0036 (benefits of
new rule not justified by tradeoffs).
---------------------------------------------------------------------------
The Rules Involve the FTC in the Internal Governance Decisions of
Covered Firms
The specifics of the proposals also raise issues, as we
expressed in 2019, with regard to mandating the appropriate level of
board engagement,\35\ hiring and training requirements,\36\ and
program accountability structures.\37\ We wrote then, and remain
concerned now, that the Commission is substituting its own judgement
about governance decisions for those of private companies covered by
this Rule.
---------------------------------------------------------------------------
\35\ American Council on Education (comment 24, NPRM) at 16,
https://www.regulations.gov/comment/FTC-2019-0019-0024; National
Automobile Dealers Association (comment 46, NPRM) at 41, https://www.regulations.gov/comment/FTC-2019-0019-0046.
\36\ U.S. Chamber of Commerce (comment 33, NPRM) at 12, https://www.regulations.gov/comment/FTC-2019-0019-0033; National Automobile
Dealers Association (comment 46, NPRM) at 34-36, https://www.regulations.gov/comment/FTC-2019-0019-0046.
\37\ See Final Rule. See also American Council on Education
(comment 24, NPRM) at 14, https://www.regulations.gov/comment/FTC-2019-0019-0024 (critiquing the intrusion on personnel practices).
---------------------------------------------------------------------------
In certain extraordinary cases involving clear evidence of
management failure, we have imposed prescriptive governance
obligations on respondents.\38\ Those rare and egregious instances
cannot justify a similar approach in a broad rulemaking absent a
real record of widespread corporate mismanagement or failure at the
senior management level.
---------------------------------------------------------------------------
\38\ U.S. v. Facebook, Inc., Civ. Action No. 19-cv-2184 (D.D.C.
July 24, 2019), https://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc.
---------------------------------------------------------------------------
The Commission has elected to proceed with most of these
governance requirements, forcing the hand of management and shifting
their priorities to avoid the risk of regulatory action,\39\ without
clear evidence of their need or efficacy.
---------------------------------------------------------------------------
\39\ These governance rules may not even promote security. See
Consumer Data Industry Association (comment 36, NPRM), https://www.regulations.gov/comment/FTC-2019-0019-0036 (arguing that the
annual reporting will become a checkbox exercise).
---------------------------------------------------------------------------
Conclusion
Regularly reviewing our rules to ensure that they address the
current environment is an important part of the FTC's regular
process. But rules have far-reaching and frequently unintended
impacts in the real world; when imposing additional legal
obligations in the rulemaking context, we must do so with great
care. The amended Safeguards Rule replaces a rule that has worked
well for 20 years, a rule that took a principle-based approach in
order to provide financial institutions flexibility to determine the
appropriate and realistic security safeguards for their
organizations. The record before us at best fails to convince that
the changes are necessary and at worst raises concern about the
substantial costs and risks in imposing these amendments.
Accordingly, we dissent.
[FR Doc. 2021-25736 Filed 12-8-21; 8:45 am]
BILLING CODE 6750-01-P
