FTC Establishes New Cybersecurity Benchmarks

Last week, the Federal Trade Commission ("FTC") amended its Gramm-Leach-Bliley Act ("GLBA") Safeguards Rule (or "Rule") to, among other things, modify the scope of companies to which the Rule applies and impose new, detailed and enforceable requirements as to the information security programs and practices those companies must adopt. The FTC's Safeguards Rule applies directly to any financial institutions that fall under the FTC's GLBA jurisdiction, and those companies must now evaluate whether their existing security controls and practices comply with the new Rule and implement any necessary new measures. More broadly, however, the amendments (1) reflect the Biden Administration's strategy to push companies to improve their cyber hygiene, and (2) create new benchmarks for data security that the FTC seems likely to incorporate into other data protection enforcement and rule-making activities and that may find their way into judicial interpretations of consumer