10/13
  • Pages

Safeguards Rule compliance

How Zurich helps customers address Safeguards Rule compliance

Cyber Services for Auto Dealers

As part of the FTC Safeguards Rule, all dealerships are required to demonstrate compliance with the new rule by June 9, 2023. The expansion requires all dealerships to develop and implement an information security program that helps ensure customer information is well protected through technical controls, physical protections, and program governance. Many of the requirements are highly technical and not easily implemented without sufficient lead time. Many service providers are offering products and services to support compliance.

Through collaboration with technical services provider, SpearTip, the Zurich Compliance Solution takes a three-step approach:

1

Cybersecurity program evaluation and technical testing.

Expert interviews, review of protocols, and tailored technical validation.

2

Provision of key elements, training, and other components to help achieve compliance.

Customized security and awareness training, role guidance for Qualified Individuals and others.

3

Report and presentation of gaps.

A tangible action plan, board and senior management reporting.

Nine core elements of the Safeguards Rule

All dealerships are required to follow a prescribed approach to cybersecurity, including:

1. Designating a Qualified Individual

2. Conducting a risk assessment

3. Designing and implementing cybersecurity controls, including access control, asset inventory, encryption, risk review of apps, multifactor, authentication, disposal of customer data, evaluation of changes to the network, and logging of user activity

4. Monitoring and testing safeguard effectiveness

5. Training staff on cybersecurity

6. Monitoring service providers

7. Keeping information security program current

8. Creating an incident response plan

9. Reporting to the board of directors

1. Designate a Qualified Individual

Safeguards Rule description

Designate a Qualified Individual to implement and supervise your company’s information security program. The Qualified Individual can be an employee of your company or can work for an affiliate or service provider. The person doesn’t need a particular degree or title. What matters is real-world know‑how suited to your circumstances. The Qualified Individual selected by a small business may have a background different from someone running a large corporation’s complex system. If your company brings in a service provider to implement and supervise your program, the buck still stops with you. It’s your company’s responsibility to designate a senior employee to supervise that person. If the Qualified Individual works for an affiliate or service provider, that affiliate or service provider also must maintain an information security program that protects your business

Zurich’s approach

  • Conduct an interview-based evaluation of the organization’s “qualified individual”
  • This will include:
  • ­Assessment of experience, education, and training
  • Technical acumen and capability review
  • Review of the progress and plans laid out by the individual
  • Recommendations may include additional training, 3rd party support options, or other

2. Conduct a Risk Assessment

Safeguards Rule description

Conduct a risk assessment. You can’t formulate an effective information security program until you know what information you have and where it’s stored. After completing that inventory, conduct an assessment to determine foreseeable risks and threats – internal and external – to the security, confidentiality, and integrity of customer information. Among other things, your risk assessment must be written and must include criteria for evaluating those risks and threats. Think through how customer information could be disclosed without authorization, misused, altered, or destroyed. The risks to information constantly morph and mutate, so the Safeguards Rule requires you to conduct periodic reassessments in light of changes to your operations or the emergence of new threats.

Zurich’s approach

  • 23-point cyber security risk assessment, guided by the National Institutes of Standards and Technology (NIST) Cybersecurity Framework
  • Conducted through interview-based question/answer session(s) and review of documents (written policies, procedures, and other evidence)
  • Each of the 23 categories receives a grade and overall benchmarking

3. Design and implement safeguards to control risks

Safeguards Rule description

Design and implement safeguards to control the risks identified through your risk assessment.

  1. Implement and periodically review access controls. Determine who has access to customer information and reconsider on a regular basis whether they still have a legitimate business need for it.
  2. Know what you have and where you have it. A fundamental step to effective security is understanding your company’s information ecosystem. Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. Keep an accurate list of all systems, devices, platforms, and personnel. Design your safeguards to respond with resilience.
  3. Encrypt customer information on your system and when it’s in transit. If it’s not feasible to use encryption, secure it by using effective alternative controls approved by the Qualified Individual who supervises your information security program.
  4. Assess your apps. If your company develops its own apps to store, access, or transmit customer information – or if you use third-party apps for those purposes – implement procedures for evaluating their security.
  5. Implement multi-factor authentication for anyone accessing customer information on your system. For multi-factor authentication, the Rule requires at least two of these authentication factors: a knowledge factor (for example, a password); a possession factor (for example, a token), and an inherence factor (for example, biometric characteristics). The only exception would be if your Qualified Individual has approved in writing the use of another equivalent form of secure access controls.
  6. Dispose of customer information securely. Securely dispose of customer information no later than two years after your most recent use of it to serve the customer. The only exceptions: if you have a legitimate business need or legal requirement to hold on to it or if targeted disposal isn’t feasible because of the way the information is maintained.
  7. Anticipate and evaluate changes to your information system or network. Changes to an information system or network can undermine existing security measures. For example, if your company adds a new server, has that created a new security risk? Because your systems and networks change to accommodate new business processes, your safeguards can’t be static. The Safeguards Rule requires financial institutions to build change management into their information security program.
  8. Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Implement procedures and controls to monitor when authorized users are accessing customer information on your system and to detect unauthorized access.

Zurich’s approach

  1. Review documentation and evidence of users’ access levels, and permissions. Then validate through remotely accessed sampling.
  2. Review the organization’s asset inventory, covering digital and physical assets. When the network is reviewed, a comparison will be made to a sampling from the asset inventory to validate completeness and accuracy.
  3. Review documentation and evidence encryption protocols and practices. Then validate through remotely accessed sampling.
  4. Review inventory of any third-party and/or in-house developed apps. Then verify adherence to safeguards requirements through remote network evaluation.
  5. Review documentation of multifactor authentication applied to systems and applications. Technical validation to support findings.
  6. Review policies and procedures for asset disposal, including digital and physical information stores. A sampling of data will be reviewed for compliance.
  7. As part of the overall information security program review, the organization’s ability to absorb and manage changes will be reviewed. During the technical validation phase, the network will be reviewed for new elements to determine how the changes were managed.
  8. Review previous 30 days of user logs from SIEM or other alerting tool. Any indications of unauthorized entry attempts will be further evaluated.

4. Regularly monitor and test safeguards effectiveness

Safeguards Rule description

Regularly monitor and test the effectiveness of your safeguards. Test your procedures for detecting actual and attempted attacks. For information systems, testing can be accomplished through continuous monitoring of your system. If you don't implement that, you must conduct annual penetration testing, as well as vulnerability assessments, including system-wide scans every six months designed to test for publicly-known security vulnerabilities. In addition, test whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program.

Zurich’s approach

  • Evaluate the past and ongoing self-evaluation of the information security program for consistency with best practices and Safeguards compliance.
  • Conduct an external security assessment (Penetration Test) to confirm no known vulnerabilities are present.

5. Train your staff

Safeguards Rule description

Train your staff. A financial institution’s information security program is only as effective as its least vigilant staff member. That said, employees trained to spot risks can multiply the program’s impact. Provide your people with security awareness training and schedule regular refreshers. Insist on specialized training for employees, affiliates, or service providers with hands-on responsibility for carrying out your information security program and verify that they’re keeping their ear to the ground for the latest word on emerging threats and countermeasures.

Zurich’s approach

  • Review the organization’s employee and end-user training program for effectiveness.
  • As needed, provide SANS Security Awareness Training to up to 100 employees for a period of 60 days to satisfy the minimum annual requirement.

6. Monitor your service providers

Safeguards Rule description

Monitor your service providers. Select service providers with the skills and experience to maintain appropriate safeguards. Your contracts must spell out your security expectations, build in ways to monitor your service provider’s work, and provide for periodic reassessments of their suitability for the job.

Zurich’s approach

  • Conduct a formal review of Third-Party Risk Management (TPRM) practices and procedures.
  • Review inventory of contractual agreements in place with service providers.

7. Keep your information security program current

Safeguards Rule description

Keep your information security program current. The only constant in information security is change – changes to your operations, changes based on what you learn during risk assessments, changes due to emerging threats, changes in personnel, and changes necessitated by other circumstances you know or have reason to know may have a material impact on your information security program. The best programs are flexible enough to accommodate periodic modifications.

Zurich’s approach

  • Review and advise on the IT security roadmap and related projects on the horizon, in relation to previous findings and recommendations.
  • Provide three quarterly “Cyber Tune-Up” webinars to help share emerging risk topics, control best practices, and other trending information.

8. Incident Response Plan

Safeguards Rule description

Create a written incident response plan. Every business needs a “What if?” response and recovery plan in place in case it experiences what the Rule calls a security event – an episode resulting in unauthorized access to or misuse of information stored on your system or maintained in physical form. Section 314.4(h) of the Safeguards Rule specifies what your response plan must cover:

  • The goals of your plan;
  • The internal processes in response to a security event;
  • Clear roles, responsibilities, and levels of authority;
  • Internal & external communications / information sharing
  • A process to fix weaknesses in your systems and controls;
  • Procedures for documenting and reporting security events and your company’s response; and
  • A post mortem and a revision of your incident response plan and IS program based on what you learned.

Zurich’s approach

  • Review the organization’s Incident Response Plan, providing recommendations for updates and improvements.
  • As necessary, a basic Incident Response Plan will be drafted in collaboration with the organization’s subject matter expert.

9. Report to Board of Directors

Safeguards Rule description

Require your Qualified Individual to report to your Board of Directors. Your Qualified Individual must report in writing regularly – and at least annually – to your Board of Directors or governing body. If your company doesn’t have a Board or its equivalent, the report must go to a senior officer responsible for your information security program. What should the report address? First, it must include an overall assessment of your company’s compliance with its information security program. In addition, it must cover specific topics related to the program – for example, risk assessment, risk management and control decisions, service provider arrangements, test results, security events and how management responded, and recommendations for changes in the information security program.

Zurich’s approach

  • Review any past Board of Directors and/or Senior Management reports on the cyber security program.
  • Provide an executive summary report (as part of the overall engagement report) for company leadership, to be presented by the organization’s Qualified Individual.

Engagement timeline and requirements

The Zurich Compliance Solution can typically be completed within 45 days for a dealer group (up to 2 rooftops) and requires an investment of just a few hours from the dealership’s IT/information security team.

Where do you go from here?

To discuss your cyber security program, contact Zurich Resilience Solutions at CyberRE@zurichna.com\

  1.        https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know

_____________

10     DEALER PRINCIPAL