FTC Data Security Expectations: What Orders Actually Require

From Section 5 unfairness: inadequate security causes or is likely to cause substantial consumer injury (fraud, identity theft, exposure of sensitive data) that consumers cannot avoid, they cannot inspect your network, and that is not outweighed by the cost of fixing basic flaws. The Third Circuit blessed the theory in FTC v. Wyndham (2015), rejecting the argument that companies lacked notice of what security Section 5 requires. Deception supplies the second hook where security claims are overstated. Sectoral rules add penalty-eligible codified versions: the GLBA Safeguards Rule for financial institutions, HBNR for health apps, COPPA's security requirements for children's data. The result is jurisdiction over essentially every US for-profit holding consumer data, with the standard defined by the order library.

The composite program appearing across orders: a written information security program with a designated qualified individual; periodic risk assessment feeding control selection; access controls including least privilege and multi-factor authentication for accounts touching consumer data; encryption of sensitive information in transit and at rest; secure software development with code review and testing; retention limits and secure disposal; service provider selection and contractual security requirements with ongoing oversight; network monitoring, logging, and intrusion detection; a tested incident response plan; workforce training; and annual program evaluation. Add order-specific machinery: biennial independent assessments filed with the FTC, incident reporting to the Commission, and annual executive certifications. Companies not under order should read this list as the FTC's definition of reasonable, because it is.

The complaints recite the same sins across two decades: default or shared credentials (TRENDnet, Drizly); no MFA on remote access and admin accounts; sensitive data stored in plaintext (Uber's GitHub-exposed keys, CafePress's unhashed answers); unpatched known vulnerabilities (Equifax's Apache Struts flaw); no segmentation between corporate and payment networks (BJ's, Wyndham); ignored alerts and absent logging (LabMD); over-retention of data with no business need (Drizly's order mandated deletion schedules); and unvetted vendors with broad access. None are exotic, that is the doctrinal point. Unfairness weighs injury against the burden of prevention, and the FTC picks cases where the fix was cheap, known, and skipped, making the cost-benefit math unarguable.

Recent orders convert security from a corporate abstraction into named-person exposure. Drizly's order followed its CEO personally, binding him to implement security programs at future companies he leads, a first the FTC signaled it would repeat. Standard modern orders require a senior officer's annual certification of compliance, filed with the Commission, false certification risks individual liability. Safeguards Rule programs require a Qualified Individual reporting in writing at least annually to the board or governing body. CISOs and general counsel should read these provisions together: the FTC is constructing a paper trail regime where 'the company knew' is provable through what named executives signed. Internal candor in those reports matters more than polish.

Three artifacts, tested honestly. First, a current risk assessment that inventories consumer data, maps flows, and rates threats, the root document every order mandates and every investigation requests. Second, a controls matrix mapping the consent-order composite (MFA, encryption, logging, vendor oversight, IR plan, training, disposal) to your actual implementation with evidence, not policy citations; NIST CSF or CIS Controls work as the scaffold. Third, a claims audit reconciling every public security statement, website, contracts, marketing, against reality, since deception counts are the cheapest for the FTC to prove. Then exercise the incident response plan, because the post-breach investigation examines pre-breach paper: companies with dated assessments, tracked remediation, and tested response plans settle on dramatically better terms, or not at all.