[Code of Federal Regulations]
[Title 16, Volume 1]
[Revised as of January 1, 2003]
From the U.S. Government Printing Office via GPO Access
[CITE: 16CFR314.4]

[Page 408]
 
                     TITLE 16--COMMERCIAL PRACTICES
 
                   CHAPTER I--FEDERAL TRADE COMMISSION
 
PART 314--STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION (EFF. 5-23-03)--Table of Contents
 
Sec. 314.4  Elements.

    In order to develop, implement, and maintain your information 
security program, you shall:
    (a) Designate an employee or employees to coordinate your 
information security program.
    (b) Identify reasonably foreseeable internal and external risks to 
the security, confidentiality, and integrity of customer information 
that could result in the unauthorized disclosure, misuse, alteration, 
destruction or other compromise of such information, and assess the 
sufficiency of any safeguards in place to control these risks. At a 
minimum, such a risk assessment should include consideration of risks in 
each relevant area of your operations, including:
    (1) Employee training and management;
    (2) Information systems, including network and software design, as 
well as information processing, storage, transmission and disposal; and
    (3) Detecting, preventing and responding to attacks, intrusions, or 
other systems failures.
    (c) Design and implement information safeguards to control the risks 
you identify through risk assessment, and regularly test or otherwise 
monitor the effectiveness of the safeguards' key controls, systems, and 
procedures.
    (d) Oversee service providers, by:
    (1) Taking reasonable steps to select and retain service providers 
that are capable of maintaining appropriate safeguards for the customer 
information at issue; and
    (2) Requiring your service providers by contract to implement and 
maintain such safeguards.
    (e) Evaluate and adjust your information security program in light 
of the results of the testing and monitoring required by paragraph (c) 
of this section; any material changes to your operations or business 
arrangements; or any other circumstances that you know or have reason to 
know may have a material impact on your information security program.