Reading Time: 5 minutes

Many companies keep sensitive personal information about customers or employees in their files or on their network. Having a sound security plan in place to collect only what you need, keep it safe, and dispose of it securely can help you meet your legal obligations to protect that sensitive data. The FTC has free resources for businesses of any size.

FEATURED

Stick with Security: A Business Blog Series
The 2017 Stick with Security series on the Bureau of Consumer Protection Business Blog offers additional insights into the ten Start with Security principles, based on the lessons of recent law enforcement actions, closed investigations, and experiences companies have shared about starting with security at their business.

Featured thumbnail (default)
Health Breach Notification Rule
Under the FTC’s Health Breach Notification Rule, companies that have had a security breach must: 1. Notify everyone whose information was breached; 2. In many cases, notify the media; and 3. Notify the FTC.

GUIDANCE
App Developers: Start with Security
App developers: How does your app size up? Have your built security in from the start? The FTC has a dozen tips to help you develop kick-app security for your product.

Buying or selling debts? Steps for keeping data secure
For debt buyers and sellers, keeping sensitive information secure should be business as usual. The FTC has seven tips for members of the industry to help reduce the risk of unauthorized disclosure.

Careful Connections: Building Security in the Internet of Things
Advice for businesses about building security into products connected to the Internet of Things, including proper authentication, reasonable security measures, and carefully considered default settings.

Complying with the FTC’s Health Breach Notification Rule
Guidance for business on complying with the FTC’s Health Breach Notification Rule. Who’s covered by the Rule and what companies must do if they experience a breach of personal health records.

Consumer Reports: What Information Furnishers Need to Know
If you report information about consumers to consumer reporting agencies (CRAs) — like a credit bureau, tenant screening company, or check verification service — you have legal obligations under the Fair Credit Reporting Act’s Furnisher Rule.

Data Breach Response: A Guide for Business
This guide addresses the steps to take once a breach has occurred. For advice on implementing a plan to protect consumers’ personal information, to prevent breaches and unauthorized access, check out the FTC’s Protecting Personal Information: A Guide for Business and Start with Security: A Guide for Business.

Digital Copier Data Security: A Guide for Businesses
Does your company keep sensitive data — Social Security numbers, credit reports, account numbers, health records, or business secrets? If so, then you’ve probably instituted safeguards to protect that information. Your information security plans also should cover the digital copiers your company uses. If the data on your copiers gets into the wrong hands, it could lead to fraud and identity theft.

Disposing of Consumer Report Information? Rule Tells How
Once your business is finished with sensitive information derived from consumer reports, what happens to it then? Under the Disposal Rule, your company must take steps to dispose of it securely.

Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business
Tips for organizations under FTC jurisdiction to determine whether they need to design an identity theft prevention program.

Health Breach Notification Rule
Under the FTC’s Health Breach Notification Rule, companies that have had a security breach must: 1. Notify everyone whose information was breached; 2. In many cases, notify the media; and 3. Notify the FTC.

Medical Identity Theft: FAQs for Health Care Providers and Health Plans
Explains how medical identity theft occurs, and how health care providers and insurers can minimize the risk and help their patients if they’re victimized.

Mobile Health App Developers: FTC Best Practices
When developing a health app, sound privacy and security practices are key to consumer confidence. Here are some best practices to help you build privacy and security into your app. These practices also can help you comply with the FTC Act.

Mobile Health Apps Interactive Tool
You’re developing a health app for mobile devices and you want to know which federal laws apply. Check out this interactive tool.

Peer-to-Peer File Sharing: A Guide for Business
Most businesses collect and store sensitive information about their employees and customers. If you use Peer-to-Peer (P2P) file sharing software in your business, consider the security implications and minimize the risks associated with it.

Protecting Personal Information: A Guide for Business
Practical tips for business on creating and implementing a plan for safeguarding personal information.

Security Check: Reducing Risks to Your Computer Systems
It’s just common sense that any company or organization that collects personal information from customers or employees needs a security plan. Learn more about designing and implementing a plan tailor-made to your business.

Slip Showing? Federal Law Requires All Businesses to Truncate Credit Card Information on Receipts
What’s on the credit and debit card receipts you give your customers? Under federal law, you must delete the card’s expiration date and shorten the account information to include no more than the last five digits of the card number.

Small Business Computer Security Basics
If you’re running a small business with only a few employees, you’ve learned about a lot of things – accounting, marketing, HR, you name it. And you probably depend on technology, even if it’s only a computer and a phone. You can’t afford to get thrown off-track by a hacker or scammer.

Start with Security: A Guide for Business
Ten practical lessons businesses can learn from the FTC’s 50+ data security settlements.

Stick with Security: A Business Blog Series
The 2017 Stick with Security series on the Bureau of Consumer Protection Business Blog offers additional insights into the ten Start with Security principles, based on the lessons of recent law enforcement actions, closed investigations, and experiences companies have shared about starting with security at their business.

VIDEOS

Implement Strong Password Policies

December 7, 2015

Secure Devices and Paper

November 3, 2015

The NIST Cybersecurity Framework and the FTC

March 9, 2017