Who's in scope
The rule reaches well beyond banks — auto dealers, accountants, mortgage brokers, and many service providers handling consumer financial data are covered.
What's required
A written information security program, a qualified individual to run it, risk assessments, access controls and MFA, encryption of customer data, monitoring and logging, vendor oversight, and an incident response plan.
Getting ready
Start with a gap assessment against the rule's specific controls. We help financial services firms implement and evidence them ahead of the deadline.