If the FTC called your firm today

16 CFR Part 314

These are ten questions an examiner asks about your written information security plan. Under each one is what they are actually listening for. Read all ten and leave — that costs you nothing and there is nothing to sign up for. Or answer them about your own firm and take the sheet with you.

Nothing you type here is sent anywhere unless you ask for the sheet by email at the end. There is no score on this page and there is no grade. Every line you get back is your own answer, put next to the part of the regulation the question comes from.

1§314.4(a)

Who is your qualified individual?

A named person, not a committee and not the firm. The Rule requires one designated individual responsible for the program, and an examiner will ask for that name first.

I could answer that right nowI would have to go and lookNo, or we have not done that

2§314.4(b)

When did you last do a written risk assessment?

A date, and a document. The Rule requires the assessment be written. "We talked about it" is the answer that ends the conversation badly.

I could answer that right nowI would have to go and lookNo, or we have not done that

3§314.4(c)(1)

What customer information do you hold, and where?

An inventory: which systems, which vendors, which drives, which paper. You cannot protect what you have not listed, and this is the question every later answer depends on.

I could answer that right nowI would have to go and lookNo, or we have not done that

4§314.4(c)(3)

Is customer information encrypted at rest?

Yes for every place the inventory names — or a written explanation, approved by the Qualified Individual, of the compensating control used instead. The Rule allows the alternative; it does not allow silence.

I could answer that right nowI would have to go and lookNo, or we have not done that

5§314.4(c)(6)

How long do you keep client records, and how do you destroy them?

A stated period, and a disposal method. The Rule sets a two-year outer limit on customer information no longer needed, unless retention is otherwise required.

I could answer that right nowI would have to go and lookNo, or we have not done that

6§314.4(f)

Who are your service providers, and how do you oversee them?

A list, and contracts requiring them to protect the data. Your software vendors, your storage, your shredding company, your IT contractor. This is the element most firms have never written down at all.

I could answer that right nowI would have to go and lookNo, or we have not done that

7§314.4(e)

Is everyone with data access trained?

Everyone — including the seasonal preparer and the person who only opens the mail. An examiner asks for the roster and the dates, not for the policy that says training happens.

I could answer that right nowI would have to go and lookNo, or we have not done that

8§314.4(h)

Have you had a security incident, and what did you do?

A written response plan, and a log. "None" is only a good answer from a firm that keeps a log — from a firm that does not, "none" describes the record-keeping, not the year.

I could answer that right nowI would have to go and lookNo, or we have not done that

9§314.4(i)

When did you last review this plan?

A date inside the last twelve months, and what changed as a result. A plan written once and never revisited is the single most common finding.

I could answer that right nowI would have to go and lookNo, or we have not done that

1016 CFR 314.3

Can I see the plan?

A document, now, covering every element above. This is the question the other nine are really about.

I could answer that right nowI would have to go and lookNo, or we have not done that

Firm name, if you want it on the sheet (optional)

Unanswered questions are listed as unanswered. A blank is never counted as a yes.