Since May 13, 2024, firms covered by the FTC Safeguards Rule must notify the FTC after certain events, and here is what triggers it and what to prepare.
You find out on an ordinary morning that a laptop is missing, or that an email account was open to someone it should not have been. Your first questions are practical, but behind them sits another: does a regulator need to hear from you, and how long do you have?
What the FTC requires
Since May 13, 2024, financial institutions covered by the FTC Safeguards Rule must notify the FTC as soon as possible, and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers. The notice is made through an online form on the FTC website. The 30 days is an outer limit and not a target, so I would not plan around using all of it. The rule lists 13 types of covered businesses, including mortgage lenders, payday lenders, check cashers and tax preparation firms, and the FTC says the list is not exhaustive. If you work in financial services and are not sure the rule reaches you, I would not assume it does not, and that is a question for your attorney that is easier to answer calmly now.
What counts as a notification event
A notification event is the unauthorized acquisition of unencrypted customer information. Information counts as unencrypted if an unauthorized person accessed the encryption key, so encryption helps only while the key stays protected, and a firm that says everything was encrypted needs to be sure where the keys were and who could reach them. Unauthorized access to unencrypted information is presumed to be unauthorized acquisition unless there is reliable evidence showing otherwise.
In practice, "we think nothing was taken" is not enough on its own. Reliable evidence usually comes from records that already existed when the event happened, such as access logs. This is an auditor's reading and not legal advice, and other laws may carry their own notice duties.
What I would do first
First, I would inventory the customer information you hold: where it lives, whether it is encrypted, where the keys are kept and who can reach them. Second, I would make sure access logs are switched on, kept long enough, and that someone knows how to read them, because tools only help when a person has set them up and reviews them. Third, I would name the person who files, with a backup, and bookmark the FTC's online form. Finally, I would build one habit around the clock: when something happens, write down the date and time you first learned of it, who told you and what you knew, since the 30 days runs from discovery. I cannot promise that preparation prevents an incident, but it gives you clear answers when someone asks what happened and when you knew.
If you would like help working through that inventory, you are welcome to book a call with AssureRidge Cyber.