Chris Wiser breaks down the FTC's safeguard rule and what counts as reasonable measures to prevent data breaches. The guidelines cover the specific steps companies need to take to stay compliant and avoid getting hit with enforcement action.
FTC has specified is what are the reasonable measures that your company should follow in order to try? Try is the keyword there. Ensure that there is not a data breach. And again, in true government fashion, the law is not entirely clear what reasonable measures are. But thankfully, thankfully, the FTC has put up guidelines on its website that give you some ideas of what a good incident response plan would be. The FTC is clear that it would change. It is variable, depending on the type of business that you have, depending on the type of security risk that you face, depending on the type of data you have. But the nice thing is, is that you can, I think if you have a good attorney, you can put in place reasonable measures. What the FTC would see as reasonable measures that protects you from being separately liable under the new safeguard rule.