New Data Breach Reporting Requirements Take Effect

The Federal Trade Commission (FTC) is the latest federal agency to issue broad regulations regarding cybersecurity breaches. The FTC approved an amendment to the Safeguards Rule expanding coverage to include non-banking financial institutions.

This includes entities such as financial technology companies, mortgage brokers, credit counselors, financial planners, and tax preparers. Under the new notification obligation, these non-bank financial institutions covered by the FTC's Safeguards Rule must report specific notification events to the Commission.

These events (defined as access to unencrypted customer information without the permission of the customer) must be reported if they affect 500 or more consumers no later than 30 days after discovery. The Rule went into effect on May 13, 2024.

The Rule is in response to ever-increasing cybersecurity threats facing businesses of all sizes. All businesses should have basic cybersecurity practices and information security policies in place to protect intellectual property, financial data, employee data, and customer data—especially if that customer is the federal government or a regulated industry.

While this rule requires reporting after an event occurs, businesses should focus on adopting best industry practices to prevent breaches from occurring in the first place.

Cybersecurity in Defense Government Contracting

Core cybersecurity best practices should be standard operating procedures for all government contractors. These include using firewalls and antivirus software, enforcing multi-factor authentication, performing regular data backups, and conducting periodic risk assessments.

Furthermore, contractors must modify their information security programs based on those risk assessments and regularly test their system controls.

CMMC 2.0 Standards

The Department of Defense has released for public comment its proposed final rule for mandatory minimum cybersecurity standards under the Cybersecurity Maturity Model Certification (CMMC) 2.0, which lists three levels of cybersecurity.

Enforcement of CMMC 2.0 protects sensitive defense information and national security assets, aligning with widely accepted National Institute of Standards and Technology (NIST) cybersecurity standards.

Contractors must demonstrate compliance with CMMC 2.0 through self-assessments as well as utilization of CMMC Third-Party Assessor Organizations (C3PAOs). Implementation will occur over a period of time to allow contractors to adapt to the new requirements.

While not included at this time, it is likely that contracts issued under the Federal Acquisition Regulation (FAR) will ultimately require the same cybersecurity standards as the Defense Federal Acquisition Regulation Supplement (DFARS). Non-DoD contractors would be well advised to consider CMMC requirements when modifying and upgrading their systems.

Examples of Cyber Attacks

While data acquisition is the most frequent reason for cyber-attacks, the methods used vary widely. While some hacking exploits weaknesses in software, most breaches occur through the acquisition of poorly protected usernames and passwords.

Often, these credentials are obtained through:

• Watering Holes: Cybercriminals gain control of legitimate websites without the owner's knowledge, turning an authorized and trusted website into a malicious one.

• Phishing: Cybercriminals send a legitimate-looking email that tricks the recipient into divulging login information or downloading a malicious link or attachment, which often includes ransomware.

• Man-in-the-Middle: Cybercriminals secretly establish a communication link that effectively allows them to eavesdrop on communications between two parties and make use of any passed information.

  
  

Cybersecurity Basics

Cybercriminals target companies of all sizes and almost 43% of cyber-attacks are primarily targeted at small companies.  Putting basic cybersecurity practices in place will help you protect your business and maintain the trust of your customers.

• Protect Your Files & Devices - Update your software including apps, web browsers, and operating systems and virus protection software.

  
  

• Train users not to open messages from unrecognized senders, especially if they contain attachments, links, or downloads. 

  
  

• Secure your files - Back up important files offline, on an external hard drive, or in the cloud and make sure you store your paper files securely.  Be careful not to overwrite all of your backups since ransomware in particular often has a delayed activation for the express purpose of also covering your backups.

  
  

• Encrypt devices - Encrypt devices and other media that contain sensitive personal information.

  
  

• Use multi-factor authentication - Require multi-factor authentication (like a temporary code) to access areas of your network with sensitive information.

  
  

• Require strong passwords - Use passwords for all laptops/tablets/smartphones and do not leave devices unattended in public places.  A strong password is at least 12 characters that are a mix of numbers/symbols/capital and lowercase letters.  Also do not reuse passwords and don’t share them on the phone, in texts, or by email.

  
  

• Train all staff - Create a culture of security by implementing a regular schedule of employee training.

  
  

• Have a plan - Have a plan for saving data, running the business, and notifying customers if you experience a breach.

Cybersecurity Statistics

Currently, all 50 states have laws requiring covered entities to notify individuals of data breaches. Additionally, several sector-specific breach notification laws exist in the United States.

Regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA) mandate customer notification for breaches of individual data. Increasingly, states are enacting data privacy laws that protect consumer information and provide penalties for mishandling it.

Per the 2022 Internet Crime Report produced by the FBI’s Internet Crime Complaint Center (IC3), the IC3 received 800,944 reported complaints, with losses exceeding $10.3 billion due to cyberattacks on individuals, businesses, and critical infrastructure.

Accenture’s Cybercrime study reveals that 95% of cybersecurity breaches are attributed to human error. Even though 43% of cyber-attacks target small businesses, only 14% are prepared to face such an attack. Small businesses reportedly spend between $826 and $653,587 recovering from cybersecurity incidents.

C2 is a Professional Employer Organization (“PEO”) that provides outsourced HR services to businesses across a variety of service industries with a focus on federal government contractors. 

Utilizing our PEO model allows our clients to transfer the responsibilities and liability of payroll, benefits administration, employee onboarding, and employee relations to C2 and to focus their attention on satisfying their clients and growing their business. 

C2 blog posts are intended for educational and information purposes only.

More information about C2’s PEO and other related HR services is available at www.c2essentials.com.