FTC Safeguards Rule

Many Connecticut small businesses discovered FTC Safeguards obligations through their accountant, lender, or industry association — not through a formal audit notice. We help you build the written program, complete the risk assessment, and document the controls the rule expects.

Key requirements we help address

• Qualified Individual — designated person responsible for the information security program
• Written information security program — documented policies appropriate to your organization's size and complexity
• Risk assessment — identification of reasonably foreseeable internal and external risks
• Multi-factor authentication — MFA for systems accessing customer information
• Encryption — data encryption in transit and at rest where appropriate
• Access controls — limiting access to customer information based on role
• Vendor oversight — due diligence and contractual requirements for service providers
• Incident response — procedures for detecting, responding to, and recovering from security events
• Testing and monitoring — continuous evaluation of safeguard effectiveness
• Leadership reporting — periodic reports to senior management or board

Root Command IT provides gap assessments, program development, and remediation consulting aligned to FTC Safeguards Rule requirements.