Risk Management & Mitigation Flashcards

Under the FTC's amended GLBA Safeguards Rule, when must a covered financial institution notify the FTC of a security event?

Answer: Within 30 days of discovery when unencrypted data of at least 500 consumers is involved

The amended Safeguards Rule requires notifying the FTC within 30 days after discovering a breach affecting 500 or more consumers' unencrypted information.

Which control best lowers data security risk for client Social Security numbers and bank details?

Answer: Encrypting data in transit and at rest, using multi-factor authentication, and limiting access to staff who need it

The Safeguards Rule calls for encryption, MFA, and access controls to protect sensitive customer information.

A debt relief company hires a lead-generation vendor that uses misleading ads. How does this affect the company's risk?

Answer: The company may still be liable and should do due diligence, monitor the vendor, and require compliance in contracts

Regulators often hold companies responsible for third-party marketers, so vendor oversight is a core risk control.

Under the TCPA, what is generally required before making autodialed or prerecorded telemarketing calls to a consumer's cell phone?

Answer: Prior express written consent

Autodialed or prerecorded telemarketing calls to wireless numbers require the consumer's prior express written consent under the TCPA.

How often must telemarketers update their call lists against the National Do Not Call Registry?

Answer: Every 31 days

Telemarketers must scrub their lists against the National DNC Registry at least every 31 days.

Which calling-hour rule applies to telemarketing calls to consumers under the TSR?

Answer: Only between 8 a.m. and 9 p.m. in the consumer's local time

The TSR bars telemarketing calls before 8 a.m. or after 9 p.m. in the called person's local time.

Many states require debt relief providers to be licensed or registered. What is the best way to reduce state licensing risk?

Answer: Check each state's rules where clients live and get the required licenses, registrations, or bonds before enrolling residents

State debt adjusting and settlement laws apply based on where the consumer lives, so licensing must be confirmed state by state.