The Federal Trade Commission on Tuesday announced it would provide a six-month extension to covered institutions, such as RV dealers, to comply with new aspects of its Safeguards Rule.
The Safeguards Rule was scheduled to be enforced beginning Dec. 9. The FTC delayed implementation of certain parts of the rule to June 9, 2023.
Among the areas affected by the delay are requirements to:
- Designate a qualified individual to oversee their information security program.
- Develop a written risk assessment.
- Limit and monitor who can access sensitive customer information.
- Encrypt all sensitive information.
- Train security personnel.
- Develop an incident response plan.
- Periodically assess the security practices of service providers.
- Implement multi-factor authentication or another method with equivalent protection for any individual accessing customer information.
The FTC said it was offering the extension based on reports, including a letter from the Small Business Administration’s Office of Advocacy, there is a shortage of qualified personnel to implement information security programs. Additionally, supply-chain issues may lead to delays in obtaining equipment needed to upgrade security systems.
“These issues may make it difficult for financial institutions,” the FTC said, “especially small ones, to come into compliance by the deadline.”
