FTC May 13th Update – New Incident Reporting Requirement Reminder

In October of 2023, the FTC announced additional language to the Safeguard rules that requires the reporting of “unauthorized access to data of 500 or more customers…”

The rule revision requires organizations to report as soon as possible but no later than 30 days after an event or potential event has been discovered. A reportable event is described as the unauthorized access of unencrypted personal information of 500 or more customers. You can see the announcement and gain access to the revised rule here.

A reportable incident can occur in several ways. Most of us are familiar with hacking as a common way data is stolen, but we cannot forget that the loss or theft of computers or servers, cell phones or tablets is also a potential reportable incident. Social engineering, phishing and business email compromise provide the means for unauthorized access to the private data you maintain. Your people are part of your incident identification process. Keeping your people aware with training, policy review and incident response exercises will help you reduce the likelihood of a reportable incident and mitigate any negative effects should an incident occur. The support staff at A2C can help you update your policies and implement an incident response exercise. Let us know how we can help.