When was the safeguards rule originated?

Start Preamble

Federal Trade Commission.

ACTION:

Notice of proposed rulemaking; request for public comment.

SUMMARY:

The Federal Trade Commission (“FTC” or “Commission”) requests public comment on its proposal to amend the Standards for Safeguarding Customer Information (“Safeguards Rule” or “Rule”). The proposal contains five main modifications to the existing Rule. First, it adds provisions designed to provide covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program. Second, it adds provisions designed to improve the accountability of financial institutions' information security programs. Third, it exempts small businesses from certain requirements. Fourth, it expands the definition of “financial institution” to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities. Finally, the Commission proposes to include the definition of “financial institution” and related examples in the Rule itself rather than cross-reference them from a related FTC rule, the Privacy of Consumer Financial Information Rule.

DATES:

Written comments must be received on or before June 3, 2019.

ADDRESSES:

Interested parties may file a comment online or on paper by following the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Write “Safeguards Rule, 16 CFR part 314, Project No. P145407,” on your comment and file your comment online at https://www.regulations.gov by following the instructions on the web-based form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex B), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex B), Washington, DC 20024.

David Lincicum or Allison M. Lefrak, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580, (202) 326-2773 or (202) 326-2804.

SUPPLEMENTARY INFORMATION:

I. Background

The Gramm Leach Bliley Act (“GLB” or “GLBA”) was enacted in 1999.[1] The GLBA provides a framework for regulating the privacy and data security practices of a broad range of financial institutions. Among other things, the GLBA requires financial institutions to provide customers with information about the institutions' privacy practices and about their opt-out rights, and to implement security safeguards for customer information.

Subtitle A of Title V of the GLBA required the Commission and other federal agencies to establish standards for financial institutions relating to administrative, technical, and physical safeguards for certain information.[2] Pursuant to the Act's directive, the Commission promulgated the Safeguards Rule in 2002. The Safeguards Rule became effective on May 23, 2003.

The Safeguards Rule requires a financial institution to develop, implement, and maintain a comprehensive information security program that consists of the administrative, technical, and physical safeguards the financial institution uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.[3] The information security program must be written in one or more Start Printed Page 13159readily accessible parts.[4] The safeguards set forth in the program must be appropriate to the size and complexity of the financial institution, the nature and scope of its activities, and the sensitivity of any customer information at issue.[5] The safeguards must also be reasonably designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.[6]

In order to develop, implement, and maintain its information security program, a financial institution must identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, including in the areas of: 1. Employee training and management; 2. information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and 3. detecting, preventing, and responding to attacks, intrusions, or other systems failures.[7] The financial institution must then design and implement safeguards to control the risks identified through the risk assessment, and must regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures.[8] The financial institution is also required to evaluate and adjust its information security program in light of the results of this testing and monitoring, as well as any material changes in its operations or business arrangements, or any other circumstances that it knows or has reason to know may have a material impact on its information security program.[9] The financial institution must also designate an employee or employees to coordinate the information security program.[10]

Finally, the Safeguards Rule requires financial institutions to take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for customer information and require those service providers by contract to implement and maintain such safeguards.[11]

When the Commission issued the Rule in 2002, it opted to provide general requirements and guidance for the required information security program, without providing detailed descriptions of what the information security program should contain.[12] It took this approach in order to provide financial institutions with the flexibility to shape the information security programs to their particular business and to allow the programs to adapt to changes in technology and threats to the security and integrity of customer information.[13] While the Commission believes the proposed amendments continue to provide companies with flexibility, they also attempt to provide more detailed guidance as to what an appropriate information security program entails.

II. Regulatory Review of the Safeguards Rule

On August 29, 2016, the Commission solicited comments on the Safeguards Rule as part of its periodic review of its rules and guides.[14] The Commission sought comment on a number of general issues, including the economic impact and benefits of the Rule; possible conflicts between the Rule and state, local, or other federal laws or regulations; and the effect on the Rule of any technological, economic, or other industry changes. The Commission received 28 comments from individuals and entities representing a wide range of viewpoints.[15] Most commenters agreed that there is a continuing need for the Rule and that it benefits consumers and competition.[16] The Commission also generally asked commenters to weigh in on: 1. Whether the Commission should add more specific requirements for information security programs to the Rule; 2. whether the Rule should require the inclusion of an incident response plan; 3. whether the Rule should reference or incorporate any other information security standards or framework, such as the National Institute of Standards and Technology's Cybersecurity Framework or the Payment Card Industry Data Security Standard; 4. whether the Rule should contain its own definition of “financial institution” rather than cross-reference the definition set forth in the Privacy Rule; and 5. whether the definition of “financial institution” should be expanded.

1. Whether the Safeguards Rule Should Include More Specific Requirements for Information Security Programs

Several commenters urged the Commission not to add more specific and prescriptive requirements for information security programs.[17] These commenters stated that financial institutions are familiar with the Rule in its current form and have established practices and policies in reliance on it; [18] that preserving the Rule's flexible guidelines for information security plans enables financial institutions to adapt quickly to the rapidly changing cybersecurity landscape; [19] and that additional prescriptive requirements for information security plans would negatively impact innovation.[20]

Some commenters asserted that a more prescriptive regulatory approach for information security programs in the Rule would not necessarily make institutions more secure and cautioned that regulation that adopts a checklist approach to information security plans risks creating complacency among companies.[21] A few commenters proposed that rather than amending the Rule to add more specific and prescriptive requirements for information security plans, the Commission should promote self-regulation as an appropriate tool to Start Printed Page 13160effectively promote information security.[22]

On the other hand, some commenters recommended that the FTC strengthen the Rule by including more detailed security requirements.[23] The Clearing House Association LLC (“The Clearing House”), a banking association and payments company that is owned by the largest commercial banks, argued that the Rule's requirements, at least with respect to large financial technology (“Fintech”) companies, should be more akin to the rules applicable to banks under the Federal Financial Institutions Examination Council (“FFIEC”) Interagency Guidelines. Among other things, these guidelines specify elements that financial institutions should include in a risk assessment; areas a financial institution must consider—such as access controls, encryption, and incident response—in developing security controls; and provisions that financial institutions must include in contracts with service providers. The Electronic Privacy Information Center (“EPIC”) recommended that certain practices set forth in the FTC's Safeguards Rule Guidance, such as employee background checks, authentication requirements, and encryption, should be mandatory.[24]

Having considered these comments, the Commission proposes to amend the Rule to include more specific security requirements. While the Commission agrees with those commenters that argued that the flexibility of the current Safeguards Rule is a strength that allows the Rule to adapt to changing technology and threats, the Commission believes that more specific requirements will benefit financial institutions by providing them more guidance and certainty in developing their information security programs, while largely preserving that flexibility. The Commission agrees that a checklist approach is not appropriate, which is why the proposed amendments retain the existing Rule's process-based approach, allowing companies to tailor their programs to their size and to the sensitivity and amount of customer information they collect. As to the commenters that stated that the current Rule works well and that companies have already developed compliance programs under it, the Commission does not believe the proposed new requirements would require an overhaul of existing compliance programs. Because the new requirements build on existing requirements, they will help companies benchmark and improve their current compliance programs, rather than having to start from scratch. Finally, the Commission recognizes that some of the financial institutions to which the Safeguards Rule applies—such as tax preparers or mortgage brokers—may be very small businesses with few customers. Accordingly, the proposed amendment would exempt smaller financial institutions from certain requirements of the amended Rule.

The Commission also agrees that very specific requirements for information security programs could become outdated and require frequent amendments. Accordingly, the proposed amendments provide more detailed requirements as to the issues and threats that must be addressed by the information security program, but do not require specific solutions to those problems. Instead, the proposed amendments retain the process-based approach of the Rule, while providing a more detailed map of what information security plans must address. As discussed in detail below, information security programs under the proposed amendments would still be based on risk assessments performed by the covered financial institutions and would be developed to address the specific risks and needs of the financial institution. The Commission continues to believe that a flexible, non-prescriptive Rule enables covered organizations to use it to respond to the changing landscape of security threats, to allow for innovation in security practices, and to accommodate technological changes and advances. The proposed amendments are designed to preserve that flexibility while doing more to ensure that financial institutions develop information security plans that are appropriate, reasonable, and designed to protect customer information.[25] Although the Commission believes the proposed approach is sufficiently flexible, it seeks comment on whether the approach creates unintended consequences for businesses, may be more stringent than necessary to achieve the objective, and/or unnecessarily modifies language without creating a material benefit to security.

2. Whether the Rule Should Require the Inclusion of an Incident Response Plan

The Commission sought comment on whether the Rule should require an incident response plan. Several commenters were opposed to adding such a requirement. Some of these commenters noted that states already require companies to notify consumers of a breach and that companies effectively must have some sort of incident response plan in place to meet this requirement, so there would be no need to add this requirement to the Rule.[26] Some commenters argued that such a requirement would be burdensome for many businesses.[27] Others stated that there is no need to add such a requirement because, for many financial institutions, in order to satisfy the Rule's current requirement to have a reasonable information security program, a financial institution would necessarily be required to have an incident response plan.[28] On the other hand, The Clearing House noted that an incident response program is “a crucial element of data security hygiene in the increasingly dangerous threat environment” and urged that the Commission impose this requirement on FTC-regulated financial institutions, especially since this is already a requirement for banks under the FFIEC Interagency Guidelines.[29]

The Commission agrees that the current Rule already requires many financial institutions to develop an incident response plan as part of their information security program. However, the Commission believes there is value to making such a requirement explicit. Accordingly, the Commission proposes an amendment to the Rule to require covered financial institutions to develop an incident response plan as part of their information security program, as described in greater detail below. The Start Printed Page 13161Commission does not agree that a process-based requirement that financial institutions plan for an incident encourages a “check the box” approach. Nor does the Commission agree that such an obligation is generally burdensome, particularly for businesses operating nationwide, given that many institutions already must develop a response plan to comply with state law.[30]

The proposed amendment lists several general areas that the plan would need to address, as discussed in greater detail below. The Commission seeks comment about the potential costs and benefits of this proposal. In particular, the Commission is interested in any data, research or case studies that the Commission could use to analyze what commenters advocate. The proposed amendment is designed to ensure that covered financial institutions are prepared in the event of a cybersecurity event, while still giving them ample flexibility to adapt the plan to the needs and resources of their business.

3. Whether the Safeguards Rule should reference or incorporate any other information security standards or framework, such as the National Institute of Standards and Technology's Cybersecurity Framework or the Payment Card Industry Data Security Standard

The Commission sought comment on whether the Rule should reference or incorporate any other information security standards or frameworks, such as the National Institute of Standards and Technology's (“NIST”) Cybersecurity Framework (the “Framework”) or the Payment Card Industry Data Security Standard (“PCIDSS”).

The majority of commenters advocated against referring to or incorporating any other information security standard or framework, such as the NIST Framework or PCIDSS, into the Rule.[31] Some commenters argued that the FTC should not adopt the NIST Framework as a binding set of obligations because it would lead to a “check the box” security mandate, and would add a layer of complexity to an already complex regulatory environment where institutions have to comply with numerous preexisting federal and state requirements.[32] The Electronic Transactions Association (“ETA”) argued that the Framework is “not designed to replace an organization's cybersecurity risk management” and that it is not intended to be a standard or checklist.[33]

A few commenters wrote in support of incorporating a reference to the NIST Framework in the Rule, while not requiring compliance with the Framework.[34] For example, the Financial Services Roundtable/BITS (“FSR/BITS”) argued that incorporating the NIST Framework in the Rule as an informative reference would help to address “the growing thicket of cybersecurity compliance obligations that are spreading across the financial services sector.” [35] FSR/BITS recommended further that the Commission modify the Rule so that financial institutions that use the NIST Framework would be found in de facto compliance with the Rule.[36]

With respect to the PCIDSS, numerous commenters opposed the Rule's reference or incorporation of PCIDSS.[37] Commenters argued such an amendment has the possibility of undermining the Rule's flexibility by imposing a “one-size-fits-all” approach.[38] MasterCard Worldwide, a co-founder and developer of PCIDSS, opposed this amendment to the Rule, highlighting that the PCIDSS was created by major card networks for participants in the card industry.[39] Whereas the PCIDSS may be appropriate for payment card issuers and acquirers, MasterCard argued, it would not necessarily apply well to other financial institutions.[40] Other comments agreed that incorporating PCIDSS would be inappropriate.[41] No commenters wrote in support of referencing or incorporating the PCIDSS into the Rule. Having considered these comments, the Commission declines to propose changing the Rule to incorporate or reference a particular security standard or framework. As noted above, for a variety of reasons, including questions about the applicability of the particular standards at issue to all financial institutions, the majority of commenters opposed referencing or incorporating any specific information security standard or framework into the Rule. Mandating that companies follow a particular security standard or framework would reduce the flexibility built into the current Rule. This proposal does not amend the Rule to allow compliance with such standards to serve as a safe harbor against Commission enforcement, as some commenters sought. The Commission seeks additional comment on how such a program could remain up to date and respond rapidly to changes in the security environment, and the workability of monitoring changing standards and adapting a safe harbor rule as needed.

4. Whether the Safeguards Rule Should Contain its own Definition of “Financial Institution” Rather Than Cross-Reference the Definition set Forth in the Privacy Rule

The Commission also asked whether the Rule should be revised to incorporate a definition of “financial institution” and related examples in the Rule itself, rather than cross-reference reference definitions and examples set forth in the Privacy Rule.[42]

The term “financial institution” is defined in the Privacy Rule, and that term is cross-referenced in the Safeguards Rule.[43] Under the Dodd-Frank Act,[44] the majority of the Commission's rulemaking authority for the Privacy Rule was transferred to the Consumer Financial Protection Bureau, with the exception of rulemaking authority pertaining to certain motor vehicle dealers.[45] Accordingly, the Commission's Privacy Rule now applies only to certain motor vehicle dealers. The Safeguards Rule, however, still applies to all financial institutions within the FTC's general enforcement jurisdiction.[46] Thus, currently, the Start Printed Page 13162definition of “financial institution” in the Privacy Rule—which governs the scope of the Safeguards Rule—applies to all financial institutions within the Commission's jurisdiction, despite the fact that most types of financial institutions are no longer subject to the Privacy Rule. This creates a confusing situation where the Privacy Rule, on its face, appears to cover types of “financial institutions” that the Privacy Rule no longer covers.

To address this issue, the Commission proposes incorporating the definition of “financial institution” and the accompanying examples from the Privacy Rule into the Safeguards Rule.[47] None of the commenters voiced a view one way or the other on this issue. The Commission notes that this modification would have no substantive effect on the scope of the Rule or its enforcement.[48] This change will only increase the clarity of the Rule.

5. Whether, if the Safeguards Rule is Amended To Include its own Definition of “Financial Institution,” That Definition Should be Expanded to Also Include (1) Entities That are Significantly Engaged in Activities That the Federal Reserve Board has Found To Be Incidental to Financial Activities and/or (2) Activities That Have Been Found To Be Closely Related to Banking or Incidental to Financial Activities by Regulation or Order in Effect After the Enactment of the GLBA

Finally, the Commission asked about the scope of the definition of “financial institution.” When promulgating the Privacy Rule in 2000, the Commission determined that companies engaged in activities that are “incidental to financial activities” would not be considered “financial institutions.” [49] The Commission was the only agency to adopt this restrictive definition in its Privacy Rule, while the other agencies included incidental activities.[50] In addition, the Commission decided that activities that were determined to be financial in nature after the enactment of the GLBA would not be automatically included in its Privacy Rule; rather, the Commission would have to take additional action to include them.[51] The effect of these two decisions was to limit the activities covered by the Commission's rules to those set out in 12 CFR 225.28 as it existed in 2000, and to exclude any activities later determined by the Federal Reserve Board to be financial activities or incidental to those activities.[52] The definition from the Privacy Rule was incorporated into the Safeguards Rule.[53] Thus, in the Request for Comment,[54] the Commission sought comment on whether it should more closely align with other agencies and amend the Safeguards Rule to include “incidental” activities and activities determined to be financial or incidental after 1999.

In 2000, the Federal Reserve Board determined that acting as a “finder” is an activity that is “incidental to a financial activity.” [55] The Federal Reserve Board defined “finding” as bringing together buyers and sellers of products or services for transactions that the buyers and sellers themselves negotiate and consummate.

The majority of commenters who addressed the definition of “financial institutions” urged the Commission not to amend the definition to include more than those businesses that conduct traditional financial activities or to include activities determined to be financial in nature or incidental after the enactment of the GLBA.[56] For example, the Software & Information Industry Association (“SIIA”) commented that the Rule already has an impact beyond financial institutions themselves in encouraging entities that receive customer information from financial institutions to take measures to secure that data, even though they may not be legally obligated to do so under the Rule.[57] Per SIIA, this is because they are either contractually bound by partnerships with financial institutions, or compete for business on the ability to meet high security requirements.[58] The Securities Industry and Financial Markets Association (“SIFMA”) also opposed this amendment, claiming that the securities industry makes a proactive, regular effort to familiarize itself with other regulatory frameworks' definitions in order to satisfy the Rule's “reasonable” standard.[59] Thus, the Rule already implicitly requires their industry, SIFMA argues, “to understand the Privacy Act, Federal Reserve Board guidance, and the [GLBA's] impact. Creating new, or modifying existing, definitions in the Rule would eliminate the Rule's flexibility in this regard.” [60]

In opposition to an expansion of the definition of financial institutions that might include incidental participants in financial transactions, the National Association of Convenience Stores (“NACS”) noted that some incidental participants—such as its members—do not store customer-identifying information, nor do they have continuing information-based relationships with consumers that would justify development and maintenance of a comprehensive security program.[61] Further, according to NACS, its members do not handle some of the most sensitive personal information such as Social Security numbers and driver's license numbers that are more commonly associated with identity theft.[62] Financial institutions, by contrast, do handle such sensitive personal consumer information.[63]

On the other hand, EPIC advocated that the Commission expand the scope of the Rule to include “all organizations and companies that collect consumer data,” such as educational institutions and commercial businesses that process student and consumer information.[64] In underscoring the importance of doing so, EPIC noted that such organizations frequently collect the same sensitive information as traditional financial institutions and are subject to the same security threats.[65]

Having considered these comments, the Commission proposes amending the definition of “financial institution” to include “incidental” activities and activities determined to be financial or incidental after 1999. This change would bring “finders” within the scope of the Rule. The Commission recognizes that commenters generally opposed revising the definition, but notes that commenters' concerns generally related Start Printed Page 13163to issues not presented by the proposed change (e.g., bringing such entities as convenience stores or securities firms within the Rule's ambit).

The Commission is not proposing such a broad expansion, however. The only effect of this proposed amendment would be to cause finders, whose activities often involve collection of financially sensitive personal information, to be covered by the Rule. This modification would ensure that finders adequately protect that information. Because they collect, maintain, and store sensitive consumer information, it is important for them to be subject to requirements to safeguard it. If this sensitive information were to get into the wrong hands, consumers could suffer identity theft, fraud, and other harms.

The Commission's proposed change would not bring any other activities under the coverage of the Rule because the Federal Reserve Board has not determined any activity other than finding to be financial in nature, or incidental to such activity, since the enactment of the GLBA. Further, it would harmonize the Commission's Rule with other regulators' Safeguards Rules—which already cover institutions engaged in activities incidental to financial activities—as well as Regulation P, which applies to all other financial institutions that are not covered by the Privacy Rule.[66] This harmonization will create a more consistent regulatory landscape that will help to treat businesses the same regardless of which agency is regulating them. Accordingly, the Commission's proposed amendment to section 314.1(b) indicates that the Rule's scope includes companies that engage in activities that are financial in nature or incidental to such financial activities. Likewise, the proposed definition of “financial institution” in proposed section 314.2(e)(1) also includes companies engaged in activities that are incidental to financial activities.

In connection with this proposal, the Commission requests comment on the impact of expanding the definition of “financial institutions” to include finders. Specifically, the Commission seeks information on 1. The number of finders in the marketplace that would be included in this definition; and 2. the costs and benefits, including the costs and benefits to finders and consumers, of this proposal.

III. Section-by-Section Analysis

As discussed above, the Commission proposes to amend the Safeguards Rule to include more detailed requirements for the development and establishment of the information security program required under the Rule. These amendments are based primarily on the cybersecurity regulations issued by the New York Department of Financial Services, 23 NYCRR 500 (“Cybersecurity Regulations”), and the insurance data security model law issued by the National Association of Insurance Commissioners (“Model Law”).[67] The Cybersecurity Regulations were issued in February 2017 after two rounds of public comment. The Model Law was issued in October 2017. The Commission believes that both the Cybersecurity Regulations and the Model Law maintain the balance between providing detailed guidance and avoiding overly prescriptive requirements for information security programs. The proposed amendments do not adopt either law wholesale, instead taking portions from each and adapting others for the purposes of the Safeguards Rule.[68]

The Commission is interested in receiving data, research, case studies, or other evidence related to business efforts to comply with the Cybersecurity Regulations or state laws mirroring the Model Law. The Commission is also interested in receiving comments on the extent to which the proposal would preempt existing state laws. Section 507(a) of the GLBA, 15 U.S.C. 6807(a), preserves a state “statute, regulation, order, or interpretation” that is not “inconsistent” with the privacy and security provisions of the GLBA. The Commission is interested in hearing about the effect of the proposal on companies' compliance with state and federal law. Finally, in light of the proposed amendments and the existence of several cybersecurity frameworks that require processes similar to the Proposed Rule, the Commission additionally requests comments on the potential for safe harbors against Commission enforcement of the Safeguards Rule, including evidence on the efficacy and utility of safe harbors in other contexts and perspectives on the viability of a safe harbor in the present context, especially as safe harbors relate to small business.

In addition to the amendments related to the requirements for information security programs, the Commission proposes amendments to the definition of “financial institution” and the addition of examples previously contained in the Privacy Rule, as discussed above. It also adds to the definition of “financial institution” entities that engage in activities incidental to financial activities. The following is a section-by-section analysis of the proposed amendments. The Commission seeks comments on the proposed amendments in general but also seeks comment on specific questions as set forth in the analysis below.

Proposed Amendments to Section 314.1: Purpose and Scope

The proposed amendment would add language from section 313.1(b) of the Privacy Rule, relating to the scope of the Rule and definition of financial institution, to section 314.1(b) of the Safeguards Rule. This addition would set forth the scope of the Safeguards Rule, which previously applied to the same entities as the Privacy Rule until the Dodd-Frank Act limited the scope of the Privacy Rule only to certain automobile dealers. As noted above, the Commission is proposing in a concurrent NPRM to amend the Privacy Rule to reflect the narrower scope of that regulation [69] and, in turn, proposes to amend the Safeguards Rule to clarify that it retains its original scope. Section 314.1(b) states that the Safeguards Rule applies to the handling of customer information by all financial institutions over which the Commission has jurisdiction. The proposed amendment sets forth the general definition of “financial institution” and provides examples of financial institutions under the Commission's jurisdiction, such as finance companies and mortgage brokers. The added language is taken largely from the existing Privacy Rule. The new language is not meant to change the scope of the Safeguards Rule, other than to reflect the proposed addition of “finders” to the Rule's scope, as discussed below.

Proposed Amendment to Section 314.2: Definitions

The proposed amendments to section 314.2 add definitions to terms introduced in the proposed amended Rule. The proposed amendments do not alter or remove any definitions in the existing Rule. Existing definitions are interspersed with new definitions in alphabetical order. The Commission is interested in hearing whether these updated definitions reflect current practices, or whether they need to be adjusted to avoid unintended consequences, modified or eliminated for smaller firms, or narrowed to avoid undue burden. Proposed paragraph (a), which states that terms used in the Safeguards Rule have the same meaning as set forth in the Privacy Rule, would be unchanged from the existing Rule. This provision will apply to terms defined in the Privacy Rule but not in the Safeguards Rule, such as “customer” and “nonpublic personal information.”

Proposed paragraph (b) would define an “authorized user” of an information system as any employee, contractor, agent or other person that participates in the business operations of an entity and is authorized to access and use any of that financial institution's information systems and data.[70] This term is used in proposed section 314.4(c)(10), which requires financial institutions to implement policies to monitor the activity of authorized users and detect unauthorized access to customer information.

Proposed paragraph (c) would define a “security event” as “an event resulting in unauthorized access to, or disruption or misuse of, an information system or information stored on such information system.”[71] This term is used in proposed provisions requiring financial institutions to establish written incident response plans designed to respond to security events and to implement audit trails to detect and respond to security events. It also appears in a proposed provision requiring a financial institution's chief information security officer to provide an annual report to the financial institution's governing body, which must identify all security events that took place that year.

Proposed paragraph (d) is the existing Rule's paragraph (b) and would not alter the definition of “customer information.”

Proposed paragraph (e) would define “encryption” as “the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.” This term is used in proposed section 314.4(c)(4), which generally requires financial institutions to encrypt customer information, with certain exceptions. This definition is adopted from the Model Law [72] and is intended to define the process of encryption while not requiring any particular technology or technique for achieving the protection provided by encryption. The Commission seeks comment on this definition.

As discussed above, proposed paragraph (f) would incorporate the definition of “financial institution” from the Privacy Rule. The Commission is proposing one substantive change to the definition of “financial institution” to include entities that are “significantly engaged in activities that are incidental” to financial activities as defined by the Bank Holding Company Act. As discussed above, this change would bring only one activity into the definition that was not covered before: The act of “finding,” as defined in 12 CFR 225.86(d)(1). The proposed revision to paragraph (f) would add an example of a financial institution acting as a finder by “bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate.” This example uses the language set forth in 12 CFR 225.86(d)(1), which defines finding as an activity that is incidental to a financial activity under the Bank Holding Company Act.

Proposed paragraph (g) is the existing Rule's paragraph (c) and would not alter the definition of “information security program.”

Proposed paragraph (h) would define “information system” as “a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.” [73] The term “information system” is used throughout the proposed amendments to designate the systems that must be covered by the information security program. This definition is designed to cover the systems, including hardware, software, and networks that financial institutions use to maintain, process, access and store customer information. It is meant to be a broad definition that covers any system that, if compromised, could result in unauthorized access to customer information.

Proposed paragraph (i) would define “multi-factor authentication” as “authentication through verification of at least two of the following types of authentication factors: 1. Knowledge factors, such as a password; 2. possession factors, such as a token; or 3. inherence factors, such as biometric characteristics.” This term is used in proposed section 314.4(c)(6), which requires financial institutions to implement multi-factor authentication for individuals accessing internal networks that contain customer information. This definition comes from the Cybersecurity Regulations [74] and is designed to conform to current understanding of what constitutes multi-factor authentication while still allowing financial institutions considerable flexibility in designing systems to protect their networks.[75] Under this definition, a system of multi-factor authentication would need to verify at least two of the three types of factors, but has considerable flexibility in how to implement each factor. For example, under the knowledge factor, financial institutions are not limited to requiring passwords for access to systems, but might also use biographical information, or other knowledge that should be limited to the authorized user. The possession factor, could Start Printed Page 13165include verifying that a recognized device is accessing the system, or the transmission of a one-time code to a device on file with the financial institution. For the inherence factors, fingerprints, retina scans, or voice prints can be used. The Commission seeks comment on whether this definition is sufficiently flexible, while still requiring the elements of meaningful multi-factor authentication.

Proposed paragraph (j) would define “penetration testing” as a “test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems.” [76] This term is used in proposed section 314.4(d)(2), which requires financial institutions to continually monitor the effectiveness of their safeguards or to engage in annual penetration testing. The primary example of penetration testing is where a security expert uses common techniques in an attempt to breach the security of a financial institution's information system. As set forth in the proposed definition, this includes attempts where the penetration tester is acting as an outsider who must penetrate the system without any initial access to the system, and attempts where the tester acts as someone with limited access to the system—such as a contractor or employee—and tries to access information that such an insider is not authorized to access. The Commission believes that there is currently a commonly understood definition of these services and that this definition provides sufficient guidance to understand the requirements of the proposed amendments.

Proposed paragraph (k) is the existing Rule's paragraph (d) and would not alter the definition of “service provider.”

Proposed Amendment to Section 314.3: Standards for Safeguarding Customer Information

Current section 314.3 requires financial institutions to develop an information security program (subsection (a)) and sets forth the objectives of the Rule (subsection (b)). Proposed section 314.3 retains the current requirements of section 314.3 under subsection (a) and the existing statement of objectives under subsection (b). It would, however, change the requirement that “safeguards” be based on the elements set forth in section 314.4, by replacing “safeguards” with “information security program.” This change is proposed to clarify that the elements set forth in section 314.4 are parts of the information security plan.

Proposed Amendments to Section 314.4: Elements

The proposed amendments to section 314.4 would alter existing required elements of an information security program and adds several new elements. Although the Commission believes the proposed approach is sufficiently flexible, it seeks comment on whether it creates unintended consequences for businesses, may be more stringent than necessary to achieve the objective, and/or unnecessarily modifies the current rule without creating a material benefit to security.

Proposed Paragraph (a)

Amended paragraph (a) would expand the current requirement of designating an “employee or employees to coordinate your information security program” by requiring the designation of a single qualified individual responsible for overseeing and implementing the financial institution's security program and enforcing its information security program.[77] This individual is referenced in the Rule as a Chief Information Security Officer or “CISO.” This title is for clarity in the proposed Rule; financial institutions would not be required to actually grant that title to the designated individual. The proposed amendment would no longer allow financial institutions to designate more than one employee to coordinate the information security program. The Commission is interested in hearing about the potential costs and benefits of this proposal. In particular, the Commission is interested in any data, research or case studies that the Commission could use to analyze whether this is the best approach. This proposed change is intended to ensure that a single individual is accountable for overseeing the entire information security program and to lessen the possibility that there will be gaps in responsibility between individuals. The Commission believes that requiring a single responsible individual will increase accountability for the security of financial institutions' information systems.

Under the proposed amendment, the CISO need not be an employee of the financial institution, but can be an employee of an affiliate or a service provider. This proposed change is meant to accommodate financial institutions that may prefer to retain an outside expert, lack the resources to employ their own information security staff qualified to oversee a program, or decide to pool resources with affiliates to share staff to manage information security. To the extent a financial institution meets this requirement by using a service provider or affiliate, however, the proposed amendment would require that the financial institution still: 1. Retain responsibility for compliance with the Rule; 2. designate a senior member of its personnel to be responsible for direction and oversight of the CISO; and 3. require the service provider or affiliate to maintain an information security program that protects the financial institution in accordance with the Rule. These proposed amendments are designed to ensure that, even when the financial institution outsources the CISO function, the financial institution retains responsibility for its own information security.

Proposed Paragraph (b)

The proposed amendments to paragraph (b) clarify that a financial institution must base its information security program on the findings of its risk assessment by changing the first sentence of existing paragraph (b) to read that financial institutions' “information security program shall be based on a risk assessment. . . .” [78] This is intended to emphasize this requirement, which is already required under the existing Rule.[79] In addition, the proposed amendment removes existing section 314.4(b)'s requirement that the risk assessment must include consideration of specific risks [80] because these specific risks are set forth elsewhere in the proposed amendments.[81]

Proposed section 314.4(b)(1) would require that the risk assessments be written and based on criteria for evaluating the risks the institutions face based on their particular information systems and the customer information they hold.[82] In addition, revised paragraph (b)(1) would require that the risk assessment describe how the financial institution will mitigate or Start Printed Page 13166accept any identified risks and how the financial institution's information security program will address those risks.[83] The Commission is proposing these requirements in order to encourage financial institutions to perform thorough and complete risk assessments. The proposed amendment would allow financial institutions to develop their own criteria suited to their needs, but generally the criteria should address the sensitivity and value of customer information collected, maintained or transmitted by the financial institution and possible vectors through which the security, confidentiality, and integrity of that information could be threatened.

The proposed amendment to section 314.4(b) would also add a requirement that financial institutions “periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks.” [84] The Commission believes that in order to be effective, a risk assessment must be subject to periodic reevaluation to adapt to changes in both financial institutions' information systems and changes in threats to the security of those systems. The proposed amendment would not set forth a prescriptive schedule for the periodic risk assessment, but would require financial institutions to set their own schedule based on the needs and resources of their institution.

Proposed Paragraph (c)

Proposed paragraph (c) retains the existing Rule's requirement for financial institutions to design and implement safeguards to control the risks identified in the risk assessment. It also adds more detailed requirements for what these safeguards must include. The Commission believes that most financial institutions already implement such measures as part of their comprehensive information security programs under the existing Rule. The proposed amendment simply makes these requirements explicit in order to clarify the Rule and ensure that financial institutions understand their obligations under the Rule.

Amended paragraph (c)(1) would require financial institutions to place access controls on information systems, designed to authenticate users and permit access only to authorized individuals in order to protect customer information from unauthorized acquisition.[85] The Commission views this as a fundamental requirement of all information security programs,[86] which certainly would have been a part of any program that met the requirements of the existing Rule.

Proposed paragraph (c)(2) would require financial institutions to “[i]dentify and manage the data, personnel, devices, systems, and facilities that enable [the financial institution] to achieve business purposes in accordance with their relative importance to business objectives and [the financial institution's] risk strategy.” [87] This requirement is designed to ensure that the financial institution inventories the data in its possession, inventories the systems on which that data is collected, stored or transmitted, and has a full understanding of the relevant portions of its information systems and their relative importance.[88] For example, it would require a company to understand which devices and networks contain customer information, who has access to them, and how those systems are connected to each other and to external networks.

Proposed paragraph (c)(3) would require that financial institutions restrict access to physical locations containing customer information only to authorized individuals.[89] This element would require financial institutions to protect physical locations, as opposed to networks, that contain customer information and is designed to address the threat to physical copies of records.[90] This would require financial institutions to protect paper files and control access to areas in which such files are stored. This may include restricting access to work areas where personnel are using hard copies of customer information or requiring physical locks on filing cabinets containing customer information and similar protections. It would also include policies for securing physical devices that contain personal information, such as laptops, tablets, phones, and thumb drives.

Proposed paragraph (c)(4) would generally require financial institutions to encrypt all customer information, both in transit and at rest.[91] The Commission believes that in most circumstances encryption is an appropriate and important way to protect customer information from unauthorized use and access.[92] Recognizing that companies may need flexibility in certain unforeseen circumstances, the proposed amendment does, however, permit financial institutions to use alternative means to protect customer information, subject to review and approval by the CISO. This is similar to the approach taken by the Health Insurance Portability and Accountability Act Security Rule, which permits a covered entity to use an alternative to encryption if it determines that encryption is not reasonable and documents an equivalent alternative measure.[93] The Commission seeks comment on this approach.

Proposed paragraph (c)(5) would establish a requirement that financial institutions “[a]dopt secure development practices for in-house developed applications utilized” for “transmitting, accessing, or storing customer information.” [94] This proposed amendment is designed to ensure that financial institutions address the security of software they develop to handle customer information, as distinct from the security of their networks that contain Start Printed Page 13167customer information.[95] Financial institutions would be required to adopt practices designed to develop applications that do not subject customer information to unacceptable risk of unauthorized access. In addition, this amendment would require financial institutions to develop “procedures for evaluating, assessing, or testing the security of externally developed applications [they] utilize to transmit, access, or store customer information.” This proposed provision is designed to ensure that financial institutions take steps to verify that applications they use to handle customer information are secure.[96] Under this amendment, financial institutions would be required to take reasonable steps to assure themselves that applications they use to handle customer information are secure and will not expose customer information.

Amended paragraph (c)(6) would require financial institutions to “implement multi-factor authentication for any individual accessing customer information” or “internal networks that contain customer information.” [97] The Commission views multi-factor authentication as a minimum standard to allowing access to customer information for most financial institutions.[98] As discussed above, the Commission believes that the definition of multi-factor authentication is sufficiently flexible to allow most financial institutions to develop a system that is suited to their needs. Currently used forms of multifactor authentication, such as requiring both a password and the receipt of a one-time passcode on a registered device, would meet this proposed requirement. To the extent that a financial institution finds that a method other than multi-factor authentication offers reasonably equivalent or more secure access controls, the institution may adopt that method with the written permission of its CISO. The Commission seeks comment on this approach.

Amended paragraph (c)(7) would require information systems under the Rule to include audit trails designed to detect and respond to security events.[99] Audit trails are chronological logs that show who has accessed an information system and what activities the user engaged in during a given period.[100] The proposed Rule does not require any specific type of audit trail, nor does it require that every transaction be recorded in its entirety. However, the audit trail must be designed to allow the financial institution to detect when the system has been compromised or when an attempt to compromise has been made. It must also provide sufficient information for the financial institution to reasonably respond to the event. The proposed amendment does not require that the audit trails be retained for any particular period, but the Commission believes that in order to allow the financial institution to detect and respond to security events, the audit trails will usually have to be maintained for some reasonable length of time. Financial institutions would need to determine the appropriate retention period for their operations. The Commission seeks comment on whether this requirement needs to be modified or eliminated for smaller firms, or narrowed to avoid undue burden.

Amended paragraph (c)(8) would require financial institutions to develop procedures for the secure disposal of customer information in any format that is no longer necessary for their business operations or other legitimate business purposes.[101] The proposed amendment allows the retention of information when retaining the information is required by law or where targeted disposal is not feasible due to the manner in which the information is maintained, such as when the information is on paper records that cannot be destroyed without also destroying other information which is still necessary for business operations. The disposal of records, both physical and digital, can result in exposure of customer information if not performed properly.[102] Similarly, if records are retained when they are no longer necessary, there is a risk that those records will be subject to unauthorized access. This amendment would require financial institutions to reduce both of those risks by designing procedures to dispose of records that are no longer necessary and to do so securely and in a timely manner. The proposed amendment does not define “legitimate business purposes,” as the Commission feels that the wide array of business models of financial institutions under its jurisdiction defies any such attempt.

The Commission seeks comment on whether the Rule should define legitimate business purposes to exclude certain uses of customer information, require the destruction of certain types of data after a fixed period, or require financial institutions to affirmatively demonstrate a current need for customer information that is retained. The Commission also seeks comment on whether the proposed amendment should include a requirement to develop procedures to limit the collection of customer information that is not necessary for business operation or other legitimate business purposes.

Proposed paragraph (c)(9) would require financial institutions to adopt procedures for change management.[103] Change management procedures govern the addition, removal, or modification of elements of an information system.[104] Under the proposed amendment, financial institutions would need to develop procedures to assess the security of devices, networks, and other items to be added to their information system or the effect of removing such items or otherwise modifying the information system. For example, a financial institution that acquired a new subsidiary and wished to combine the new subsidiary's network with its own would be required to assess the security of the new network and the effect of adding it to the existing network. Although the Commission believes the proposed approach is sufficiently balanced, it seeks comment on whether the proposal may be more stringent than Start Printed Page 13168necessary to achieve the objective, or unnecessarily modifies the current rule without creating a material benefit to security.

Proposed paragraph (c)(10) would require financial institutions to implement policies and procedures designed “to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users.” [105] In addition to threats posed by outside actors, authorized users such as employees and contractors can pose a substantial risk to the security of customer information.[106] This amendment would require financial institutions to take steps to monitor those users and their activities related to customer information in a manner adapted to the financial institution's particular operations and needs. The monitoring should allow financial institutions to identify inappropriate use of customer information by authorized users, such as transferring large amounts of data or accessing information for which the user has no legitimate use. This requirement is separate from the requirement to maintain “audit trails,” which would require logging of unusual events.

Proposed Paragraph (d)

Proposed paragraph (d)(1) would retain the current Rule's requirement that financial institutions “[r]egularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems.” [107] The Commission views testing and monitoring as an integral part of any information security program.[108] Proposed paragraph (d)(2) provides further guidance noting that the monitoring should take the form of either “continuous monitoring” or “periodic penetration testing and vulnerability assessments.” Continuous monitoring is any system that allows real-time, ongoing monitoring of an information system's security, including monitoring for security threats, misconfigured systems, and other vulnerabilities.[109] The Commission seeks comment on whether these required enhancements are appropriate, as well as information about the potential costs or unintended consequences of this proposal.

If a financial institution does not adopt effective continuous monitoring, under the proposed amendments it would be required to engage in periodic penetration testing and vulnerability assessment consisting of no less than annual penetration testing based on the financial institution's risk assessment and biannual vulnerability assessments designed to detect publicly known vulnerabilities.[110] These tests may be performed directly by the financial institution or by third-party assessors, as long as they are designed to assess the systems that contain or can be used to access customer information and are performed effectively. The schedule of this required testing aligns with the requirements of the Cybersecurity Regulations. The Commission seeks comment on whether this schedule of penetration testing and vulnerability assessment is appropriate or whether the Rule should require these tasks to be performed more or less frequently. In particular, the Commission is interested in any data, research or case studies that the Commission could use to analyze what commenters advocate.

Proposed Paragraph (e)

Proposed paragraph (e) would require financial institutions to implement policies and procedures “to ensure that personnel are able to enact [the financial institution's] information security program” through various forms of training and education.[111] Training of employees is a critical part of information security, as employees will be the ones enforcing and implementing any information security program.[112] First, financial institutions would be required to provide their personnel with “security awareness training that is updated to reflect risks identified by the risk assessment.” [113] This requirement would apply to all personnel that have the ability to handle, access, or dispose of customer information. The training would be designed to inform personnel of the risks to customer information and the financial institution's policies and procedures to minimize those risks.[114]

Second, financial institutions would be required to “[u]tiliz[e] qualified information security personnel,” employed either by them or by affiliates or service providers, “to manage [their] information security risks and to perform or oversee the information security program.” [115] This amendment is designed to ensure that information security personnel used by financial institutions are qualified for their positions and that sufficient personnel are used.

Third, financial institutions would be required to “[p]rovid[e] information security personnel with security updates and training sufficient to address relevant security risks.” [116] Maintaining awareness of emerging threats and vulnerabilities is a critical aspect of information security that the Commission believes was already a part of any information security program that complies with the existing Safeguards Rule. This amendment formalizes the requirement that financial institutions provide information security personnel with ongoing training to stay abreast of such developments. It is separate from the requirement to train all personnel generally, reflected in paragraph (e)(1).

Fourth, financial institutions would be required to “[v]erify[ ] that key information security personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures.” [117] For example, a financial institution could offer incentives or funds for key personnel to undertake continuing education that addresses recent developments, include a requirement to stay abreast of security Start Printed Page 13169research as part of their performance metrics, or conduct an annual assessment of key personnel's knowledge of threats related to their information system. This requirement would be in addition to the proposed requirement that data security personnel be provided ongoing training. The proposed amendment does not define “key personnel” as the Commission believes that which personnel are “key” will vary considerably from entity to entity and that each financial institution will need to determine which employees must maintain this knowledge based on their structure and risk assessments. In most cases, though, the Commission believes that at a minimum the CISO and senior cybersecurity personnel would be covered by this amendment. Although the Commission believes the proposed approach is sufficiently flexible, it seeks comment on whether these proposals create unintended consequences for businesses, may be more stringent than necessary to achieve the objective, and/or unnecessarily modifies the current rule without creating a material benefit to security. In particular, the Commission is interested in any data, research or case studies that the Commission could use to analyze what commenters advocate.

Proposed Paragraph (f)

Proposed paragraph (f) would retain the current Rule's requirement in existing paragraph (d) regarding the oversight of service providers, and add a requirement that financial institutions periodically assess service providers “based on the risk they present and the continued adequacy of their safeguards.” [118] The current Rule requires an assessment of service providers' safeguards only at the onboarding stage; the proposed addition is designed to require financial institutions to monitor their service providers on an ongoing basis to ensure that they are maintaining adequate safeguards to protect customer information that they possess or access.[119] This ongoing oversight could include investigating red flags raised by service providers' practices or conducting periodic assessments of service provider practices, depending on the circumstances.

Proposed Paragraph (g)

Proposed paragraph (g) would retain the language of existing paragraph (e) in the current Rule, which would continue to require financial institutions to evaluate and adjust their information security programs in light of the result of testing required by this section, material changes to their operations or business arrangements, or any other circumstances that they know or have reason to know may have a material impact on their information security program.[120] While proposed paragraph (d) would amplify the testing required under the current Rule, the requirement to evaluate and adjust the program in light of such testing remains the same.

Proposed Paragraph (h)

Proposed paragraph (h) would require financial institutions to establish incident response plans.[121] The written response plans would be required to be “designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information” in the financial institution's possession. The amendment would require the incident response plans to address the following areas: 1. The goals of the incident response plan; 2. the internal processes for responding to a security event; 3. the definition of clear roles, responsibilities and levels of decision-making authority; 4. external and internal communications and information sharing; 5. identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; 6. documentation and reporting regarding security events and related incident response activities; and 7. the evaluation and revision as necessary of the incident response plan following a security event. The proposed incident response plan requirement focuses on preparing financial institutions to respond promptly and appropriately to security events and to mitigate any weaknesses in their information systems accordingly. It is not intended to create any independent reporting or notification requirements, nor to conflict with any such requirements to which financial institutions are already subject. The proposed requirement regarding “documentation and reporting regarding security events and related incident response activities” would require incident response plans to document any notification or reporting requirements imposed by other federal or state laws, but does not in itself impose any such requirement.

The Commission seeks comment on whether the proposed amendment should require that financial institutions report security events to the Commission. The Cybersecurity Regulations require covered entities to report security events to the superintendent of the Department of Financial Services, but the proposed rule does not have a similar provision. The Commission seeks comment on whether such a provision should be added and, if so, what the elements of such a provision should be. Specifically, the Commission seeks comment on 1. the appropriate deadline for reporting security events after discovery; 2. whether all security events should require notification or whether notification should be required only under certain circumstances, such as a determination of a likelihood of harm to customers or that the event affects a certain number of customers; 3. whether such reports should be made public; 4. whether the events involving encrypted information should be included in the requirement; and 5. whether the requirement should allow law enforcement agencies to prevent or delay notification if notification would affect law-enforcement investigations.

In addition to seeking comment on the content of the plan, the Commission seeks comment on whether the proposed amendment would conflict with breach notification or reporting laws already in existence. Some states have enacted breach notification laws that exempt companies that maintain breach response procedures that are compliant with certain federal regulations from having to meet the requirements of the state's breach notification law. For example, Delaware's breach notification law states:

A person that is regulated by state or federal law, including . . . the Gramm Leach Bliley Act . . . and that maintains procedures for a breach of security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this chapter if the person notifies affected Delaware residents in accordance with the Start Printed Page 13170maintained procedures when a breach of security occurs.[122]

The Commission seeks comment on whether the introduction of the proposed requirement for an incident response plan would cause financial institutions to be exempt from this, or similar, state breach notification laws, and if so, how this should affect the Commission's decision about whether to require an incident response plan in the Rule.[123]

Proposed Paragraph (i)

Proposed paragraph (i) would require a financial institution's CISO to “report in writing, at least annually, to [the financial institution's] board of directors or equivalent governing body” regarding the following information: 1. The overall status of the information security program and financial institution's compliance with the Safeguards Rule; and 2. material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses thereto, and recommendations for changes in the information security program.[124] For financial institutions that do not have a board of directors or equivalent, the CISO must make the report to a senior officer responsible for the financial institution's information security program. This amendment is designed to ensure that the governing body of the financial institution is engaged with and informed about the state of the financial institution's information security program. Likewise, an annual written report may create accountability for the CISO by requiring the CISO to set forth the status of information security program for the governing body. The Commission requests comment on whether the burden of a required annual report would outweigh the benefits, whether the report should have other required components, or whether particular components are unnecessary.

In addition, the Commission requests comments on whether the proposed rule should also require the Board or equivalent governing body to certify compliance with the Rule. The Commission seeks comment on whether such a requirement would appropriately increase the engagement of the governing body of the financial institution in the information security program or whether it would create too much burden on financial institutions to independently assess the program.

The Commission also requests comment on how such a requirement would impact corporate governance; what precedents exist for federally-mandated board reporting on specific management issues, and analyses of their efficacy; and what effect requiring reporting to the board or certification by it would have.

Proposed Amendments to Section 314.5: Effective Date

This proposed amendment replaces the existing effective date of the Rule. In its place, this amendment provides that certain elements of the information security program would not be required until six months after the publication of a final rule rather than immediately upon publication. The paragraphs that would have a delayed effective date are: 314.4(a), related to the appointment of a CISO; 314.4(b)(1), relating to conducting a written risk assessment; 314.4(c)(1)-(10), setting forth the new elements of the information security program; 314.4(d)(2), requiring continuous monitoring or annual penetration testing and biannual vulnerability assessment; 314.4(e), requiring training for personnel; 314.4(f)(3), requiring periodic assessment of service providers; 314.4(h), requiring a written incident response plan; and 314.4(i), requiring annual written reports from the CISO. The effective date of these elements would be delayed because financial institutions may need to take steps to bring their information security programs into compliance with these new requirements. All other requirements under the Safeguards Rule would remain in effect during this six-month period. The elements that would be required immediately upon publication are ones that are already required under the current Rule, such as the requirement to have a written security program (314.3(a)); to conduct a risk assessment (314.4(b)); to design and implement safeguards to control the risks identified in the risk assessment (314.4(c)); to regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures (314.4(d)(1)); to oversee service providers at the onboarding stage (314.4(f)); and to evaluate and adjust the security program in light of the results of testing and monitoring (314.4(g)). These remaining requirements largely mirror the requirements of the existing Rule. The Commission requests comment on this approach.

Proposed Section 314.6: Exceptions

Proposed section 314.6 is a new section that would exempt financial institutions that maintain relatively small amounts of customer information from certain requirements of the amended Safeguards Rule. The exceptions would apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.[125] Such financial institutions would not be required to comply with the following subsections: 314.4(b)(1), requiring a written risk assessment; 314.4(d)(2), requiring continuous monitoring or annual penetration testing and biannual vulnerability assessment; 314.4(h), requiring a written incident response plan; and 314.4(i), requiring an annual written report by the CISO. This proposed section is intended to reduce the burden on smaller financial institutions. The Commission believes that the paragraphs subject to this exemption are the ones that are most likely to cause undue burden on smaller financial institutions. For example, requiring continuous monitoring or a set schedule of testing might be too expensive, depending on the circumstances.

The remaining sections of the amended Safeguards Rule would apply to these smaller financial institutions in the same way as other financial institutions. Exempted financial institutions would still need to conduct risk assessments (314.4(b)), design and implement a written information security program with the required elements (314.3 and 314.4(c)), utilize qualified information security personnel and train employees (314.4(e)), monitor activity of authorized users (314.4(c)(10)), oversee service providers (314.4(f)), and evaluate and adjust their information security program (314.4(g)). The Commission seeks comment on whether such exceptions are appropriate or whether all financial institutions should be required to comply with all of the proposed amendments. The Commission also Start Printed Page 13171seeks comment on whether the exempted paragraphs are appropriate. Finally, the Commission seeks comment on whether the use of the number of customers concerning whom the financial institution retains customer information is the most effective way to determine which financial institutions should be exempted and if so, whether five thousand is an appropriate number.

IV. Request for Comment

You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before June 3, 2019. Write “Safeguards Rule, 16 CFR part 314, Project No. 145407” on the comment. Your comment, including your name and your state, will be placed on the public record of this proceeding, including the https://www.regulations.gov website.

Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comment online. To make sure that the Commission considers your online comment, you must file it at https://www.regulations.gov by following the instructions on the web-based form.

If you file your comment on paper, write “Safeguards Rule, 16 CFR part 314, Project No. P145407” on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex B), Washington, DC 20580; or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex B), Washington, DC 20024. If possible, please submit your paper comment to the Commission by courier or overnight service.

Because your comment will be placed on the publicly accessible website, https://www.regulations.gov,, you are solely responsible for making sure that your comment does not include any sensitive or confidential information. In particular, your comment should not include any sensitive personal information, such as your or anyone else's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “trade secret or any commercial or financial information which . . . is privileged or confidential,” as provided by section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2), including in particular, competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled “Confidential,” and must comply with FTC Rule 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comments to be withheld from the public record.[126] Your comment will be kept confidential only if the FTC General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted on the www.regulations.gov website, we cannot redact or remove your comment from the FTC website, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule 4.9(c), and the General Counsel grants that request.

Visit the Commission website at https://www.ftc.gov to read this document and the news release describing it. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before June 3, 2019. For information on the Commission's privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/​site-information/​privacy-policy.

IV. Communications by Outside Parties to the Commissioners or Their Advisors

Written communications and summaries or transcripts of oral communications respecting the merits of this proceeding, from any outside party to any Commissioner or Commissioner's advisor, will be placed on the public record.[127]

V. Paperwork Reduction Act

The Paperwork Reduction Act (“PRA”), 44 U.S.C. chapter 35, requires federal agencies to seek and obtain OMB approval before undertaking a collection of information directed to ten or more persons.[128] A “collection of information” occurs when ten or more persons are asked to report, provide, disclose, or record information in response to “identical questions.” [129] Applying these standards, neither the Safeguards Rule nor the proposed amendments constitute a “collection of information.” [130] The Rule calls upon affected financial institutions to develop or strengthen their information security programs in order to provide reasonable safeguards. Under the Rule, each financial institution's safeguards will vary according to its size and complexity, the nature and scope of its activities, and the sensitivity of the information involved. For example, a financial institution with numerous employees would develop and implement employee training and management procedures beyond those that would be appropriate or reasonable for a sole proprietorship, such as an individual tax preparer or mortgage broker. Similarly, a financial institution that shares customer information with numerous service providers would need to take steps to ensure that such information remains protected, while a financial institution with no service providers would not need to address this issue. Thus, although each financial institution must summarize its compliance efforts in one or more written documents, the discretionary balancing of factors and circumstances that the Rule allows—including the myriad operational differences among businesses that it contemplated—does not require entities to answer “identical questions” and therefore does not trigger the PRA's requirements.

The proposed amendments would not change this analysis because they would retain the existing Rule's process-based approach, allowing financial institutions to tailor their programs to reflect the financial institutions' size, complexity, and operations, and to the sensitivity and amount of customer information they collect. For example, the proposed amendment to section 314.4(b) would require a written risk assessment, but each risk assessment will reflect the particular structure and operation of the financial institution and, though each assessment must include certain criteria, these are only general guidelines and do not consist of “identical questions.” Similarly, the proposed amendment to section 314.4(h), which would require a written Start Printed Page 13172incident response plan, is only an extension of the preexisting requirement of a written information security plan and would necessarily vary significantly based on factors such as the financial institution's internal procedures, which officials within the financial institution have decision-making authority, how the financial institution communicates internally and externally, and the structure of the financial institution's information systems. Likewise, the proposed requirement for CISOs to produce annual reports under proposed section 314.4(i) does not consist of answers to identical questions, as the content of these reports would vary considerably between financial institutions and CISOs are given flexibility in deciding what to include in the reports.

Finally, the proposed amendments that would modify the definition of “financial institution” to include “activities incidental to financial activities” and therefore bring finders under the scope of the Rule do not constitute a “collection of information,” and therefore would not trigger the PRA's requirements.

VI. Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA), as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, requires an agency to either provide an Initial Regulatory Flexibility Analysis with a proposed rule, or certify that the proposed rule will not have a significant impact on a substantial number of small entities.[131] The Commission does not expect that this Rule, if adopted, would have the threshold impact on small entities. First, most of the burdens flow from the mandates of the Act, not from the specific provisions of the proposed Rule. Second, the proposed Rule imposes requirements that are scalable according to the size and complexity of each institution, the nature and scope of its activities, and the sensitivity of its information. Thus, the burden is likely to be less on small institutions, to the extent that their operations are smaller or less complex. In addition, smaller entities are exempted from many requirements of the proposed amendments. Nonetheless, the Commission has determined that it is appropriate to publish an Initial Regulatory Flexibility Analysis in order to inquire into the impact of the proposed Rule on small entities. The Commission invites comment on the burden on any small entities that would now be covered, but previously were not covered, if the definition of “financial institution” is modified as proposed, and the burden on small entities created by the other proposed amendments. The Commission has prepared the following analysis.

1. Reasons for the Proposed Rule

The Commission proposes to make the rule clearer by including a definition of “financial institution” and related examples in the Safeguards Rule rather than cross-referencing them from the Privacy Rule. The Commission also proposes expanding the definition of “financial institution” in the Rule to include entities that are engaged in activities that are incidental to financial activities. This change would bring “finders” within the scope of the Rule. This change would harmonize the Rule with other agencies' rules and would require finders that collect consumers' sensitive financial information to comply with the Safeguards Rule's process-based approach to protect that data.

In addition, the Commission proposes to modify the Safeguards Rule to include more detailed requirements for the information security program required by the Rule. The Rule would continue to be process-based and flexible based on the financial institution's size and complexity. The Commission does propose to exempt smaller institutions from certain requirements that require additional written product and might pose a greater burden on smaller entities.

2. Statement of Objectives and Legal Basis

The objectives of the proposed Rule are discussed above. The legal basis for the proposed rule is section 501(b) of the GLBA.

3. Description of Small Entities to Which the Rule Will Apply

Determining a precise estimate of the number of small entities [132] —including newly covered entities under the modified definition of financial institution—is not readily feasible. Financial institutions already covered by the existing Rule include lenders, financial advisors, loan brokers and servicers, collection agencies, financial advisors, tax preparers, and real estate settlement services, to the extent that they have “customer information” within the meaning of the Rule. If the proposed Rule is finalized, finders will also be covered. However, it is not known whether any finders are small entities, and if so, how many there are. The Commission requests comment and information on the number of “finders” that would be covered by the Rule's modified definition of “financial institution,” and how many of those finders, if any, are small entities.

4. Projected Reporting, Recordkeeping, and Other Compliance Requirements

The proposed Rule does not impose any reporting or any specific recordkeeping requirements within the meaning of the PRA, as discussed herein.

With regard to other compliance requirements, the proposed addition of definitions and examples from the Privacy Rule is not expected to have an impact on covered financial institutions, including those that may be small entities, if any. (The preceding section of this analysis discusses classes of covered financial institutions that may qualify as small entities.) The proposed addition of “finders” to the definition of financial institutions will impose the obligations of the Rule on entities that engage in “finding” activity and also collect customer information. The proposed addition of more detailed requirements may require some financial institutions to perform additional risk assessments, monitoring, or to create additional safeguards as set forth in the proposed Rule. These obligations will require employees or third-party service providers with skills in information security, but the Commission believes that most financial institutions will have already complied with many parts of the proposed rule as part of their information security programs already required under the existing Rule. There may be additional related compliance costs (e.g., legal, new equipment or systems, modifications to policies or procedures), but in the absence of supporting data, Start Printed Page 13173the Commission is unable to provide a complete or specific cost estimate. The Commission invites comment on the costs of the amended Rule for small entities to comply and to newly covered financial institutions (finders) of establishing and operating an information security program for such entities, to the extent, if any, they are small entities.

5. Identification of Duplicative, Overlapping, or Conflicting Federal Rules

As mentioned above, the Commission is proposing to incorporate the definition of “financial institution” and the accompanying examples from the Privacy Rule to the Safeguards Rule. This modification will have no substantive effect on the scope of the Rule or its enforcement. The change is designed only to increase the clarity of the Rule. The Commission believes that incorporating this definition will not cause any additional burden on covered entities. Separately, as also noted above, the Commission proposes to revise the definition of “financial institution” to cover finders. The Commission is requesting comment on the extent to which other federal standards involving privacy or security or information may duplicate and/or satisfy or possibly conflict with the Rule's requirements for newly covered financial institutions.

The Commission is also proposing amending the Rule to include more detailed requirements for the written information security plan required by the Rule. The Commission does not believe that the proposed amendments would conflict with any existing data security regulations, such as the Health Insurance Portability and Accountability Act Security Rule.[133] The Commission is requesting comment on the extent to which other federal standards involving privacy or security or information may duplicate and/or satisfy or possibly conflict with the proposed amendments to the Rule.

6. Discussion of Significant Alternatives

The standards in the proposed Rule allow a small financial institution to develop an information security program that is appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of any customer information at issue. The Commission is proposing to include certain design standards (e.g., a company must implement encryption, authentication, incident response) in the Rule, in addition to the performance standards (reasonable security) that the Rule currently uses. As discussed, while these design standards may introduce some additional burden, the Commission believes that the additional burden will be minimal, as most information security programs under the Rule already meet most of these requirements. In addition, the proposed requirements are still designed to allow financial institutions flexibility in how and whether they should be implemented. For example, the requirement that encryption be used to protect customer information in transit and at rest may be met with effective alternative compensating controls if they are infeasible for a given financial institution.

In addition, the Proposed Rule exempts financial institutions that maintain relatively small amounts of customer information from certain requirements of the amended Safeguards Rule. The exceptions would apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. The Commission believes that exempted financial institutions will generally be small entities. Such financial institutions would not be required to perform a written risk assessment, conduct continuous monitoring or annual penetration testing and biannual vulnerability assessment, prepare a written incident response plan, or prepare an annual written report by the CISO. These proposed exemptions are intended to reduce the burden on smaller financial institutions. The Commission believes that the obligations subject to this exemption are the ones that are most likely to cause undue burden on smaller financial institutions.

Exempted financial institutions will still need to conduct risk assessments, design and implement a written information security program with the required elements, utilize qualified information security personnel and train employee, monitor activity of authorized users, oversee service providers, and evaluate and adjust their information security program. These are core obligations under the Rule that any financial institution that collects customer information must meet, regardless of size.

The Commission welcomes comment on any significant alternative consistent with the GLBA that would minimize the impact on small entities of these proposed amendments, including institutions that would be newly covered under the amended definition of “financial institution.”

List of Subjects in 16 CFR Part 314

For the reasons stated above, the Federal Trade Commission proposes to amend 16 CFR part 314 as follows:

PART 314—STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION

1. The authority citation for part 314 continues to read as follows:

15 U.S.C. 6801(b), 6805(b)(2).

2. Revise § 314.1(b) to read as follows:

Purpose and scope.

* * * * *

(b) Scope. This part applies to the handling of customer information by all financial institutions over which the Federal Trade Commission (“FTC” or “Commission”) has jurisdiction. Namely, this part applies to those “financial institutions” over which the Commission has rulemaking authority pursuant to section 501(b) of the Gramm-Leach-Bliley Act. An entity is a “financial institution” if its business is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k), which cross-references activities enumerated by the Federal Reserve Board in 12 CFR 225.28 and 12 CFR 225.86. The “financial institutions” subject to the Commission's enforcement authority are those that are not otherwise subject to the enforcement authority of another regulator under Section 505 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6805. More specifically, those entities include, but are not limited to, mortgage lenders, “pay day” lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders. They are referred to in this part as “You.” This part applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you.

3. Revise § 314.2 to read as follows:

Start Printed Page 13174

Definitions.

(a) In general. Except as modified by this part or unless the context otherwise requires, the terms used in this part have the same meaning as set forth in the Commission's rule governing the Privacy of Consumer Financial Information, 16 CFR part 313.

(b) Authorized user means any employee, contractor, agent, or other person that participates in your business operations and is authorized to access and use any of your information systems and data.

(c) Security event means an event resulting in unauthorized access to, or disruption or misuse of, an information system or information stored on such information system.

(d) Customer information means any record containing nonpublic personal information, as defined in 16 CFR 313.3(n), about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates.

(e) Encryption means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

(f)(1) Financial institution means any institution the business of which is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k). An institution that is significantly engaged in financial activities, or significantly engaged in activities incidental to such financial activities, is a financial institution.

(2) Examples of financial institutions. (i) A retailer that extends credit by issuing its own credit card directly to consumers is a financial institution because extending credit is a financial activity listed in 12 CFR 225.28(b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F), and issuing that extension of credit through a proprietary credit card demonstrates that a retailer is significantly engaged in extending credit.

(ii) An automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days is a financial institution with respect to its leasing business because leasing personal property on a nonoperating basis where the initial term of the lease is at least 90 days is a financial activity listed in 12 CFR 225.28(b)(3) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(iii) A personal property or real estate appraiser is a financial institution because real and personal property appraisal is a financial activity listed in 12 CFR 225.28(b)(2)(i) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(iv) A career counselor that specializes in providing career counseling services to individuals currently employed by or recently displaced from a financial organization, individuals who are seeking employment with a financial organization, or individuals who are currently employed by or seeking placement with the finance, accounting or audit departments of any company is a financial institution because such career counseling activities are financial activities listed in 12 CFR 225.28(b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(v) A business that prints and sells checks for consumers, either as its sole business or as one of its product lines, is a financial institution because printing and selling checks is a financial activity that is listed in 12 CFR 225.28(b)(10)(ii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(vi) A business that regularly wires money to and from consumers is a financial institution because transferring money is a financial activity referenced in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(A), and regularly providing that service demonstrates that the business is significantly engaged in that activity.

(vii) A check cashing business is a financial institution because cashing a check is exchanging money, which is a financial activity listed in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(A).

(viii) An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).

(ix) A business that operates a travel agency in connection with financial services is a financial institution because operating a travel agency in connection with financial services is a financial activity listed in 12 CFR 225.86(b)(2) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).

(x) An entity that provides real estate settlement services is a financial institution because providing real estate settlement services is a financial activity listed in 12 CFR 225.28(b)(2)(viii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(xi) A mortgage broker is a financial institution because brokering loans is a financial activity listed in 12 CFR 225.28(b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(xii) An investment advisory company and a credit counseling service are each financial institutions because providing financial and investment advisory services are financial activities referenced in section 4(k)(4)(C) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(C).

(xiii) A company acting as a finder in bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate is a financial institution because acting as a finder is an activity that is financial in nature or incidental to a financial activity listed in 12 CFR 225.86(d)(1).

(3) Financial institution does not include:

(i) Any person or entity with respect to any financial activity that is subject to the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act (7 U.S.C. 1 et seq.);

(ii) The Federal Agricultural Mortgage Corporation or any entity chartered and operating under the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.);

(iii) Institutions chartered by Congress specifically to engage in securitizations, secondary market sales (including sales of servicing rights) or similar transactions related to a transaction of a consumer, as long as such institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party other than as permitted by sections 313.14 and 313.15; or

(iv) Entities that engage in financial activities but that are not significantly engaged in those financial activities, and entities that engage in activities incidental to financial activities but that are not significantly engaged in activities incidental to financial activities.

(4) Examples of entities that are not significantly engaged in financial activities.

(i) A retailer is not a financial institution if its only means of extending credit are occasional “lay away” and deferred payment plans or accepting payment by means of credit cards issued by others.Start Printed Page 13175

(ii) A retailer is not a financial institution merely because it accepts payment in the form of cash, checks, or credit cards that it did not issue.

(iii) A merchant is not a financial institution merely because it allows an individual to “run a tab.”

(iv) A grocery store is not a financial institution merely because it allows individuals to whom it sells groceries to cash a check, or write a check for a higher amount than the grocery purchase and obtain cash in return.

(g) Information security program means the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.

(h) Information system means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental controls systems.

(i) Multi-factor authentication means authentication through verification of at least two of the following types of authentication factors:

(1) Knowledge factors, such as a password;

(2) Possession factors, such as a token; or

(3) Inherence factors, such as biometric characteristics.

(j) Penetration testing means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems.

(k) Service provider means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this part.

4. Revise § 314.3(a) as follows:

Standards for safeguarding customer information.

(a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in section 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section.

* * * * *

5. Revise § 314.4 as follows:

Elements.

In order to develop, implement, and maintain your information security program, you shall:

(a) Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program (for purposes of this part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by you, an affiliate, or a service provider. To the extent this requirement is met using a service provider or an affiliate, you shall:

(1) Retain responsibility for compliance with this part;

(2) Designate a senior member of your personnel responsible for direction and oversight of the CISO; and

(3) Require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this Part.

(b) Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks.

(1) The risk assessment shall be written and shall include:

(i) Criteria for the evaluation and categorization of identified security risks or threats you face;

(ii) Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and

(iii) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks.

(2) You shall periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks.

(c) Design and implement safeguards to control the risks you identity through risk assessment, including:

(1) Place access controls on information systems, including controls to authenticate and permit access only to authorized individuals to protect against the unauthorized acquisition of customer information and to periodically review such access controls;

(2) Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy;

(3) Restrict access at physical locations containing customer information only to authorized individuals;

(4) Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. To the extent you determine that encryption of customer information, either in transit over external networks or at rest, is infeasible, you may instead secure such customer information using effective alternative compensating controls reviewed and approved by your CISO;

(5) Adopt secure development practices for in-house developed applications utilized by you for transmitting, accessing, or storing customer information and procedures for evaluating, assessing, or testing the security of externally developed applications you utilize to transmit, access, or store customer information;

(6) Implement multi-factor authentication for any individual accessing customer information. Multi-factor authentication shall be utilized for any individual accessing your internal networks that contain customer information, unless your CISO has approved in writing the use of reasonably equivalent or more secure access controls;

(7) Include audit trails within the information security program designed to detect and respond to security events;

(8) Develop, implement, and maintain procedures for the secure disposal of customer information in any format that is no longer necessary for business operations or for other legitimate business purposes, except where such information is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably Start Printed Page 13176feasible due to the manner in which the information is maintained;

(9) Adopt procedures for change management; and

(10) Implement policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users.

(d)(1) Regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems.

(2) The monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, you shall conduct:

(i) Annual penetration testing of your information systems determined each given year based on relevant identified risks in accordance with the risk assessment; and

(ii) Biannual vulnerability assessments, including any systemic scans or reviews of information systems reasonably designed to identify publicly known security vulnerabilities in your information systems based on the risk assessment.

(e) Implement policies and procedures to ensure that personnel are able to enact your information security program by:

(1) Providing your personnel with security awareness training that is updated to reflect risks identified by the risk assessment;

(2) Utilizing qualified information security personnel employed by you or an affiliate or service provider sufficient to manage your information security risks and to perform or oversee the information security program;

(3) Providing information security personnel with security updates and training sufficient to address relevant security risks; and

(4) Verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures.

(f) Oversee service providers, by:

(1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue;

(2) Requiring your service providers by contract to implement and maintain such safeguards; and

(3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.

(g) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (d) of this section; any material changes to your operations or business arrangements; the results of risk assessments performed under paragraph (b)(2) of this section; or any other circumstances that you know or have reason to know may have a material impact on your information security program;

(h) Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your possession. Such incident response plan shall address the following areas:

(1) The goals of the incident response plan;

(2) The internal processes for responding to a security event;

(3) The definition of clear roles, responsibilities and levels of decision-making authority;

(4) External and internal communications and information sharing;

(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;

(6) Documentation and reporting regarding security events and related incident response activities; and

(7) The evaluation and revision as necessary of the incident response plan following a security event.

(i) Require your CISO to report in writing, at least annually, to your board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a senior officer responsible for your information security program. The report shall include the following information:

(1) The overall status of the information security program and your compliance with this Rule; and

(2) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses thereto, and recommendations for changes in the information security program.

6. Revise § 314.5 to read as follows:

Effective date.

Sections 314.4(a), 314.4(b)(1), 314.4(c)(1)-(10), 314.4(d)(2), 314.4(e), 314.4(f)(3), 314.4(h), and 314.4(i) are effective as of [six months after publication of the final rule].

7. Add § 314.6, to read as follows:

Exceptions.

Sections 314.4(b)(1), 314.4(d)(2), 314.4(h), and 314.4(i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.

By direction of the Commission, Commissioner Phillips and Commissioner Wilson dissenting.

April J. Tabor,

Acting Secretary.

[Note: The following Dissenting Statement of Commissioner Noah Joshua Phillips and Commissioner Christine S. Wilson will not appear in the Code of Federal Regulations.]

Dissenting Statement of Commissioner Noah Joshua Phillips and Commissioner Christine S. Wilson

March 5, 2019

Today the Commission seeks public comment on a notice of proposed rulemaking (“NPRM”) to change the Standards for Safeguarding Customer Information (“Safeguards Rule” or “Rule”) under the Gramm-Leach-Bliley Act (“GLBA”). Recent high-profile data breaches underscore the importance of effective data security, which is why we strongly support the Commission's renewed calls for federal data security legislation.[1] We also share this Administration's goal of reducing regulation and controlling compliance costs. Any new regulation, even regarding a critical issue like data security, must be handled with care to avoid stifling innovation or entrenching incumbents.

Congress mandated data security and privacy for financial institutions in the GLBA and, for the past two decades, it has been the Commission's responsibility to set forth the regulations implementing those requirements. The Rule as written provides direction to financial institutions on how to protect data security—importantly, while not being overly prescriptive—in an area where standards continuously evolve. The current proposal, however, trades flexibility for a more prescriptive approach, potentially Start Printed Page 13177handicapping smaller players or newer entrants.[2]

As part of our regular process of regulatory review, the Commission first sought comments on updating the Safeguards Rule in September 2016.[3] When asked about the need for more specific requirements, commenters generally asked to leave the Rule in place, and to avoid more prescriptive regulation. Privacy advocates and an association owned by the largest commercial banks sought more detailed requirements.[4] Based on that record, and the adoption of several new state laws and regulations regarding data security of financial institutions, the Commission today proposes the latter course.

This approach concerns us for several reasons. First, some of the specific proposals track shortcomings the Commission has identified in its data security enforcement cases and investigations. Not all of these shortcomings concern firms covered by the Safeguards Rule and, in any event, they may not represent a broader trend that warrants a regulatory response. Therefore, it may not be appropriate to mandate such prescriptive standards for all market participants. To the extent that the Commission thinks it is appropriate to elucidate the regulation's reasonable care requirements, we have tools at our disposal—including speeches, testimony, analyses to aid public comment, information about the factors the Commission considered when closing investigations, and reports. Commentary like this can help financial institutions weigh whether precautions are reasonable based on the risks associated with how they use, collect, and store data, without imposing a one-size-fits-all approach. The question to be answered here is whether the existing Safeguards Rule, which addresses the protection of financial information, is inadequate to that purpose. Also important is the question of how firms governed by the Rule operate relative to ones in sectors that are not so governed.

Second, the proposed regulations may be premature for two reasons. They are based in substantial part on regulations promulgated two years ago by the New York State Department of Financial Services.[5] We do not have data about the impact and efficacy of those regulations, so whether to adopt a version of them at the federal level and whether that version should be a floor for or should preempt state-level rules seem like questions worthy of more study. Right now, Congress and the Executive Branch, including the leadership of the Senate committee with jurisdiction over financial institutions, are discussing potential privacy and data security legislation. The NPRM seeks comment on issues that are implicated in this debate, as well as issues not addressed in the New York rule, like data minimization/elimination and requiring a legitimate business justification for collecting data in the first instance. These topics in particular take us into a broader debate that belongs—and is being had—in Congress.[5 6]

Third, the Safeguards Rule today is a flexible approach, appropriate to a company's size and complexity. This proposal would move us away from that approach. There are direct costs for enhanced precautions, but this record does not demonstrate that those costs will significantly reduce data security risks or significantly increase consumer benefits. The expansion of the Rule could create traps for the unwary, especially small and innovative businesses. Further, large incumbents can often absorb regulatory compliance costs more effectively than new entrants or smaller players, potentially decreasing competition. The proposed precautions, either individually or in the aggregate, may constitute best practices for certain firms. But the proliferation of procedural, technical, and governance requirements may have the unintended consequence of diluting core data security measures undertaken pursuant to the existing Safeguards Rule.

Finally, the NPRM proposes that the Commission substitute its own judgment for a private firm's governance decisions, including but not limited to the appropriate level of board engagement, hiring and training requirements, and program accountability structures. Data security is important, without doubt. In our enforcement and legislative advocacy, we focus a great deal on it. But take, for example, board engagement on data security. Whether and to what extent it should command the regular attention and personal liability of a company's board is precisely the kind of question firms are in a better position to evaluate than federal regulators. Other matters may be more important, including to the nation at large. A decade ago, our economy was brought low by what many view as improper risk assessment by financial institutions of their assets and liabilities. Maybe we want boards of financial institutions to spend more time assessing those risks. The point isn't that the answer is easy—the point is that we may not be the best qualified to supply it.

This is an NPRM, and the Commission is merely proposing new regulation and soliciting views on its impact. But we are also aware that the momentum behind an NPRM regularly results in the promulgation of new or revised rules. While the Commission is not making a final determination today, we are concerned that the specific suggestions herein will frame the debate so as to take the Commission in a direction that may be unwarranted (particularly given the prospect of legislation), and which may have negative repercussions. A review of the Safeguards Rule, especially in light of new legal developments, is warranted. But we should go where the evidence today leads us. We would strongly encourage those in industry, academia, and civil society with expertise in these areas to comment and provide evidence on this proposal.

For these reasons, we dissent.

[FR Doc. 2019-04981 Filed 4-3-19; 8:45 am]

BILLING CODE 6750-01-P