A Single Partner for Everything You Need Optiv works with more than 450 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner. However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Privacy Concerns Are Not Just for Goliath Anymore Breadcrumb Home Insights Blog Privacy Concerns Are Not Just for Goliath Anymore May 10, 2023 Twenty years ago, the Federal Trade Commission (FTC) developed a set of five loose guidelines for securing personal data—specifically aimed at large financial institutions. With increased scrutiny for protecting personal data, the FTC modified the guidelines and published a more detailed list of privacy practices, titled, Standards for Safeguarding Customer Information (16 CFR Part 314) in December 2021. Along with more detailed requirements for securing personal data, the definition of “financial institution” was expanded to include many non-traditional businesses that now qualify as financial institutions. The changed rules now impact a different set of organizations than the original rules targeted, including medium-sized businesses that are not traditionally considered financial institutions. There is an exclusion for small businesses that maintain fewer than five thousand customer records. One effect of the rule change is the imposition of privacy regulations on organizations that do not qualify for state-specific or international privacy rules. Because the FTC moved the start of enforcement out to June 2023, the scope of organizations that qualify for compliance continues to be refined. Who Is Impacted by Safeguards? The new rules target organizations that have not been perceived as financial institutions, yet they handle and store personal data collected during financial transactions. Under the new rules, the following types of organizations are expected to comply: Community banks Real Estate and Property Appraisers Check Printers Travel Agencies Colleges and Universities Automobile Dealers Mortgage Lenders Payday Lenders Finance Companies Mortgage Brokers Account Servicers Check Cashers Wire Transferors Collection Agencies Credit Counselors and other Financial Advisors Tax Preparation Firms Non-federally Insured Credit Unions Investment Advisors (not required to register with the SEC) Some traditional financial institutions are exempt from these regulations: Banks and Savings and Loans Associations, which are subject to the data security and privacy standards set out by the Gramm-Leach-Bliley Act (GLBA) Stockbrokers, Dealers, and Investment Advisors registered with the Security and Exchange Commission (SEC) Insurance Companies, which must follow the relevant state insurance laws Federal Credit Unions, which are regulated by the National Credit Union Administration (NCUA) Organizations regulated by the Farm Credit Administration (FCA) or Commodity Futures Trading Commission (CFTC) What Are the Primary Rules Enforced Through the Safeguards? Safeguards Rule Expanded Description Review access controls Set a formal cadence for periodically reviewing existing access controls, actively plan remediation steps, and document new requirements Compile a data inventory Understanding where personal data is stored across the enterprise is a critical step in developing a plan to protect it Encrypt customer data After identifying where personal data is collected, processed, and stored, apply encryption to those storage locations where personal data is found Assess security of applications Inventory applications and determine which systems access personal data. Assess access to these applications, ensuring that only the right people have access to this data Implement multi-factor authentication Secure access to network, applications, and data through the implementation of multi-factor authentication Dispose of stale customer data Remove stale data that contains personal information based on the organization’s retention policy Evaluate all system or network changes Develop a process to evaluate all system and network changes to ensure that personal data is not exposed with the change Monitor access to customer data Implement a process that proactively monitors users that access personal data that is protected under the Safeguards Rule Assess Safeguards Regularly review, monitor, and assess the success of the Safeguards program--identifying issues and determining remediation activities How Do Impacted Organizations Work Toward Compliance? Privacy regulations are constantly changing and impacting the way organizations secure their personal data. Remember: data privacy compliance is a journey, not a destination. For organizations that are new to privacy compliance, building a roadmap should be the first step in beginning the journey. First Steps: Delegate a qualified individual to oversee the Information Security program. Discover, locate and classify all personal data. Perform a risk assessment. Steps to Maturity: Limit and monitor who can access sensitive customer information. Choose an encryption tool based on actual need (results from discovery). Implement multi-factor authentication. Tool To Consider for Compliance Kickoff It is common for organizations that qualify for compliance with the Safeguards Rule to collect, process, and store personal data for years and become unaware of where personal data is kept. Understanding where the regulatory data is located should be one of the first steps toward compliance. Many data discovery tools are built to support large organizations, like banks and insurance companies, and come with a price tag that is beyond reach for smaller firms. Data discovery tools have evolved over the past decade to pinpoint business need and scale. These tools can provide visibility across enterprise data storage--increasing the organization’s security posture and remaining within a reachable budget for medium-sized organizations. If you have questions about the Safeguards requirements and how they might affect your organization, click here to learn more about our offerings or drop us a line. By: Howard Bayerle SENIOR CONSULTANT DATA GOVERNANCE, PRIVACY AND PROTECTION | OPTIV Howard Bayerle has over 20 years’ experience in both consulting and enterprise data management. His experience ranges from working with medium sized businesses to Fortune 500 corporations. Howard has a passion for helping organizations establish good governance that returns quality data and identifies security needs. Share: Optiv data privacy Data consumer data protection privacy legislation FTC Safeguards Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.