Would your firm’s FTC Safeguards setup hold up?

Check the ones you have in place

Be honest: “not sure” counts as a no. Nothing is sent anywhere until you choose to email yourself the results.

• A WISP that’s actively maintained and updated, not a static template you bought to check a box An unmaintained $99 template provides little real safe harbor in an FTC audit.
• A designated Qualified Individual (QI) accountable for the security program
• A documented risk assessment of where client NPI lives
• Encryption of client NPI in transit and at rest (laptops + backups)
• Multi-factor authentication (MFA) for everyone who touches customer data
• Least-privilege access controls, no shared logins
• Written oversight of vendors that handle client data (IT, cloud, software, backup)
• Continuous monitoring (or an annual pen-test + biannual vulnerability scans)
• Workforce security-awareness training
• A written incident-response plan
• You know whether you’ve crossed the 5,000-consumer threshold Counts cumulatively across your whole book/history. Crossing it triggers the heavier requirements.