FACT Sections 114 and 315 - Identity Theft Red Flag Regulations

FACT Sections 114 and 315 - Identity Theft Red Flag Regulations - The Federal Trade Commission and the federal financial institution regulatory agencies set the rules on identity theft "red flags" and address discrepancies. The rules CIOs need to implement sections 114 and 315 of the Fair and Accurate Credit Transactions Act (FACT) for identity theft protection are clearly defined.

The rules require each enterprise that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program for combating identity theft in connection with new and existing accounts. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft and enable a financial institution or creditor to:

Identify relevant patterns, practices, and specific forms of activity that are "red flags" signaling possible identity theft and incorporate those red flags into the Program;
Detect red flags that have been incorporated into the Program;
Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
Ensure the Program is updated periodically to reflect changes in risks from identity theft.

Other government agencies have issued guidelines to assist CIOs and companies in developing and implementing a Program, including a supplement that provides examples of red flags.

Growth and Detection of Identity Theft
How Information Is Illegally Obtained and Used
Assisting Victims of Identity Theft
Basics of Prevention
Information Security Requirements
Customer Identification Program Requirements
Consumer Privacy and the Fair Credit Reporting Act
Related Policies and Procedures
Corporate Originators of ACH Transactions
Credit Card Fraud
Fraud Involving ATM and Debit Cards

The regulation also requires credit and debit card issuers to develop policies and procedures to assess the validity of a request for a change of address that is followed closely by a request for an additional or replacement card. In addition, the final rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency.

That along Special Publication 800-60 (Volume 1, Volume 2), Guide for Mapping Types of Information and Information Systems to Security Categories, assists Federal agencies in identifying information types and information systems and assigning impact levels for confidentiality, integrity, and availability. Impact levels are based on the security categorization definitions in FIPS 199. Special Publication 800-60 contains two volumes. Volume I provides guidelines for identifying impact levels by information type and suggests impact levels for administrative and support information common to multiple agencies. Volume II includes rationale for information type and impact level recommendations and examples of recommendations for agency-specific, mission-related information.

Janco's Security Manual Template meets the compliance requirements of FIPS 199 and even provides an electronic form that can be utilized in the assessment process.

The Security Manual Template can be acquired separately or as part of the Business Continuity and Security Bundle.

Order the FIPS 199 Compliant Security Manual or the Business Continuity / Security Bundle

We have just the download you need to create a world class plan and assure you leave no stone unturned. With these Templates we walk you through the entire process, providing all the tools you need along the way. As an added benefit you can purchase an update service which keeps these templates abreast of the latest legislated and mandated requirements. All of our documents have been updated to comply with PCI-DSS, Sarbanes-Oxley, HIPAA, the ISO 27000 (formerly ISO 17799) series - 27001 & 27002, and PCI-DSS.

Both of these FIPS 199 compliant products come with a detail security audit program.

FACT Identity Theft Compliant Security Manual Template
FACT Identity Theft Compliant BC/Security Bundle Standard

Security Manual Template - Standard Edition

Business and IT Impact Questionnaire
Threat and Vulnerability Assessment Toolkit
Security Management Checklist
Full Detail Policies for
- Blog and Personal Website Policy
- Internet, Email, Social Networking, Mobile Device, and Electronic Communication Policy
- Mobile Device Policy
- Physical and Virtual File Server Policy
- Sensitive Information Policy
- Travel and Off-Site Meeting Policy
Job Descriptions for the Chief Compliance Officer, Chief Security Officer, Data Protection Officer, Manager Security and Workstations, Manager WFH Support, Security Architect, and Systems Administrator.
Work From Home (WFH) operational rules
HIPAA Audit Program
AI Security Management
GDPR Compliance Checklist to meet EU Requirements
CCPA - California Consumer Privacy Act requirements definition
Consumer Bill of Rights
Sarbanes Oxley Section 404 Checklist
HIPAA Audit Proram
Security Audit Program- fully editable -- Comes in MS EXCEL and PDF formats -- Meets GDPR, ISO 28000, 27001, 27002, Sarbanes-Oxley, PCI-DSS, HIPAA FIPS 199, and NIS SP 800-53 requirements -- Over 400 unique tasks divided into 11 areas of audit focus which are the divided into 38 separate task groupings
Electronic forms that can be Emailed, completed via a computer or tablet, and stored electronically including: Blog Policy Compliance, BYOD Access and Use, Company Asset Employee Control Log, Email - Employee Acknowledgment, Employee Termination Checklist, FIPS 199 Assessment Electronic Form, Internet Access Request, Internet Use Approval, Internet & Electronic Communication - Employee Acknowledgment, Mobile Device Access and Use Agreement, Employee Security Acknowledgment Release, Preliminary Security Audit Checklist, Risk Assessment, Security Access Application, Security Audit Report, Security Violation Reporting, Sensitive Information Policy Compliance Agreement, Server Registration, and Threat and Vulnerability Assessment
eReader version of the Security Manual Template
BONUS - ISO 28000 Supply Chain Security Audit Program in MS EXCEL and PDF formats.