Gramm-Leach-Bliley Act

The FTC amended the GLBA in 2021 to make sure the Rule keeps pace with current technology. The revised rule provides more concrete guidance for businesses. The following section describes the specifics of the elements of a reasonable security program, and how Scan123 implements each of these components in our own compliance program.

What does a reasonable information security program look like?

The FTC has released guidance on the amended Rule. You can find the details of that guidance here.

GLBA Guidance from FTC	Scan123 Compliance – Verifiable by our SOC 2 annual audit.
a. *Designate a Qualified Individual to implement and supervise your company’s information security program*	We have an information security policy, and we have delegated responsibility for Security Planning and Maintenance.
b. *Conduct a risk assessment*	We conduct risk assessments throughout the year.
c. *Design and implement safeguards to control the risks identified through your risk assessment*	Please see individual items below.
1. Implement and periodically review access controls	We review access controls at least annual.
2. Know what you have and where you have it	We conduct an annual Business Continuity Plan (BCP) test, which includes verifying the integrity and security of all data.
3. Encrypt customer information on your system and when it’s in transit	We implement a Content Security Policy to enforce encryption in transit. Additionally, data is encrypted at rest both in the cloud and on the ground backups.
4. Assess your apps	We conduct an in-depth annual vendor audit. Additionally, we internally scan our network and application for known vulnerabilities.
5. Implement multi-factor authentication for anyone accessing customer information on your system	Multi-factor authentication is enforced internally for our employees. Additionally, customers employees with administrative access require multi-factor authentication, and less privileged accounts can also be configured to require multi-factor authentication.
6. Dispose of customer information securely	Cancelled customers data is removed from production and backup locations as required.
7. Anticipate and evaluate changes to your information system or network	Change controls are in place. New systems and networks are evaluated to ensure compliance with security protocols.
8. Maintain a log of authorized users’ activity and keep an eye out for unauthorized access	Internal employee access is logged, as well as customer login sessions with geo location data.
d. *Regularly monitor and test the effectiveness of your safeguards*	We conduct semi-annual penetration testing of all of our systems. Additionally we monitor performance and activity levels, and are alerted when outlying or unexpected events occurs.
e. *Train your staff*	Users are trained immediately upon hire, and are continually trained on an ongoing basis. We conduct internal phishing tests to see how well our training is working.
f. *Monitor your service providers*	We conduct annual vendor audits for any vendor we use that may affect security, privacy, or availability. We gave built in monitors and alerts when required services have potential issues.
g. *Keep your information security program current*	Our Information Security Policy is often being enhanced as we grow and add new services and features.
h. *Create a written incident response plan*	We have an incident response plan which accounts for all of the components of this item.
i. *Require your Qualified Individual to report to your Board of Directors*	The Security Office reports to the strategy team on a weekly basis, and to the directors twice per year.