Financial Services Compliance Matrix for Orange County Firms

Designated Qualified Individual for Security Program

Appoint a single qualified individual responsible for overseeing, implementing, and enforcing the information security program. The amended FTC Safeguards Rule names this role explicitly, and GLBA expects accountable program ownership.

Written Information Security Program (WISP)

Maintain a documented information security program covering administrative, technical, and physical safeguards appropriate to the size and complexity of the firm and the sensitivity of customer information held.

Annual Written Risk Assessment

Conduct and document a periodic risk assessment that identifies reasonably foreseeable internal and external threats to customer information and evaluates the sufficiency of existing safeguards. The FTC Safeguards Rule requires this assessment in writing.

Multi-Factor Authentication (MFA)

Enforce multi-factor authentication for any individual accessing systems that hold customer information, and for all remote and administrative access. The FTC Safeguards Rule mandates MFA unless the Qualified Individual approves an equivalent control in writing.

Least-Privilege Access Controls

Limit access to customer information and financial systems to the personnel and applications that require it for a legitimate business function. Review access rights periodically and remove access promptly on role change or termination.

Encryption of Customer Information at Rest

Encrypt customer information stored on servers, databases, endpoints, and backup media using current standards such as AES-256. Where encryption at rest is infeasible, the Qualified Individual must approve a documented compensating control.

Encryption of Customer Information in Transit

Encrypt customer information transmitted across internal and external networks using TLS 1.2 or higher. This applies to client portals, email gateways, file transfers, and connections to custodians and clearing firms.

Continuous Monitoring or Annual Penetration Testing

Implement continuous monitoring of systems holding customer information, or conduct annual penetration testing plus biannual vulnerability assessments. The FTC Safeguards Rule treats these as alternatives, and PCI-DSS requires both scanning and testing on a defined cadence.

Audit Logging and Log Retention

Capture and retain logs of system access, configuration changes, and security events. SOX environments require logging that supports the integrity of financial reporting controls, and PCI-DSS requires at least one year of retention with three months immediately available.

Change Management and Segregation of Duties

Document and control changes to systems that affect financial reporting, and separate duties so that no single person can both initiate and approve material transactions or production changes. This is central to SOX IT general controls.

Written Incident Response Plan

Maintain a written incident response plan covering detection, containment, eradication, recovery, internal escalation, external communications, and post-incident review. The plan must be tested and updated as the environment changes.

Breach Notification to Regulators

Notify the FTC of a security event involving the unencrypted information of 500 or more consumers as soon as possible and no later than 30 days after discovery. California's breach statute also requires prompt notice to affected residents and, at volume, to the Attorney General.

Service Provider Oversight and Contracts

Select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess provider performance. The FTC Safeguards Rule and PCI-DSS both require documented oversight of providers that touch covered data.

Security Awareness and Role-Based Training

Provide security awareness training to all personnel and specialized training to security staff. Training should cover phishing, wire fraud and business email compromise, safe handling of nonpublic personal information, and incident reporting.

Secure Disposal of Customer Information

Securely dispose of customer information no later than two years after the last date it is used for a legitimate business purpose, unless retention is otherwise required. Disposal procedures must cover paper, electronic media, and decommissioned hardware.

Network Segmentation for Cardholder and Financial Data

Isolate systems that store, process, or transmit payment card data or sensitive financial records from general-purpose networks. Segmentation reduces audit scope and limits the spread of a compromise.