Colorado AG Issues Guidance On Data Security Best Practices

The Colorado AG recently issued guidance on practices companies should consider to safeguard consumer data. This guidance was issued in response to companies asking what "reasonable" security means. While noting that the standard is a flexible one and calls for case-by-case determinations, the AG highlighted activities it will weigh when making a decision on whether companies are acting reasonably to safeguard information.

Specifically, the AG noted a few practices as critical when determining whether a company is acting reasonably to safeguard information. These include identifying and managing data (including proper retention practices). The AG also noted having and implementing a written information security policy and incident response plan. The CO AG also placed importance on ensuring that vendors have proper security measures in place.