As security threats continue to evolve and become much more sophisticated, businesses need to ensure their data and environment is secure. The Safeguards Rule helps do just that. With recent changes in the regulatory requirements, we’ve outlined everything you need to know about the Safeguards Rule and how to be defensible.

What is the Safeguards Rule?

Part of the Gramm-Leach-Bliley-Act (GLBA), the Safeguards Rule is designed to define standards for protecting the integrity of customer’s private personal information (PPI). It was implemented by the Federal Trade Commission in 2003 and has been used regulate financial institutions for nearly twenty years to ensure customer data is secure.

Safeguards Rule Modifications

To keep up with current technology, the Safeguards Rule was amended last year. There are five main modifications to the rule, which include:

• Provisions on what aspects should be included in an information security program
• Guidelines on information security program reporting
• Definitions of several new terms
• New exemptions for small businesses
• Expanded definition of what’s considered a financial institution

Under the updated guidelines, the expanded definition of a financial institution includes collection agencies, mortgage brokers, mortgage lenders, payday lenders, real estate appraisers, check cashers, and tax preparers. These organizations must be compliant with the Safeguards Rule by June 9, 2023, or risk non-compliance fines and penalties.

Components of a Safeguards Rule Compliant Information Security Program

With more organizations needing to comply with the Safeguards Rule, we’ve outlined what your information security program should entail. There are nine main components including:

1. Appoint a Qualified Individual to Oversee Your Information Security Program: Each financial institution as defined in the Safeguards Rule should appoint a qualified individual or oversee and manage their information security program. This individual could be an internal employee, or you can have a managed services provider like TPx oversee your information security program.
2. Perform a Risk Assessment: Before your information security can be properly built out, you need to understand where you may have risk within your infrastructure. A risk assessmentidentifies your risk, so you know where to focus your efforts on improving security. A managed services provider like TPx, can perform your risk assessment and provide a roadmap of recommendations to lower your risk.
3. Put Safeguards in Place to Controls Risks: Making sure your environment is locked down is important to manage and lower your risk. By limiting access controls to people who have a legitimate need for access can reduce risk along with using encrypted technology and enabling multi-factor authentication (MFA).
4. Test Your Infrastructure Regularly: Just because you have security protocols and procedures in place, doesn’t mean your work is complete. Institutions need to perform regular penetration and vulnerability scansto identify any vulnerabilities within your infrastructure. Completing a scan can also help ensure your security can stand up to an attack.
5. Implement Security Awareness Training: Train your staff to use cybersecurity best practices and give them the tools and information they need to be able to identify cyber threats. Many security breaches are often caused by human error, so enabling security awareness trainingfor your staff is critical. There should also be specialized training for individual(s) overseeing your information security program.
6. Select and Monitor Knowledgeable Service Providers: If you choose to work with a services provider for your information security program, you must ensure security expectations are being met. Furthermore, you need to do periodic assessments of your partnership with the third-party vendor.
7. Regularly Update Your Information Security Program: The security landscape is ever evolving, which is why you need to update your information security program regularly. With new threats emerging daily, your information security program needs to be agile to adjust to the risks and vulnerabilities you find in your risk assessment and penetration and vulnerability scans. Keeping you’re your program current with changes in technology and threats is critical.
8. Create and Implement an Incident Response Plan: No organization is free from attacks. Financial institutions need to create and regularly test an incident response plan in the event you become a target of an attack. An incident response plan details what happens in the event of a security incident.
9. Report Regularly to Governing Body: The individual in charge of overseeing your information security program should report regularly on risk assessments, vulnerabilities and mitigation, and any security incidents to your board of directors or governing body.

TPx Can Help You Become Defensible

We’re here to help become defensible and stay secure. TPx is a trusted managed services provider for financial institutions from coast to coast. Our certified experts on staff can address all your cybersecurity needs as they relate to the Safeguards Rule. Contact us and become defensible before time runs out.