FTC Safeguards Services For Collection Agencies

FTC Safeguards Services for Collection Agencies Alcala Consulting, Inc. has created this services bundle to greatly minimize IT security risks, comply with the FTC safeguards rule, and get business from larger accounts. Our services bundle comes with industry-exceeding standards.

Our Core Values Do the Right Thing Integrity is paramount in creating a successful business venture. In every decision, we take an honest look at what it means to our clients, employees, and vendors. We hold ourselves to the highest ethical standards and look for these same qualities with whom we do business.

Take Ownership We accept responsibility for all our actions. We demand excellence in ourselves, in everyone we associate with, and in everything we do. Only the highest quality products and services are acceptable for our company and clients.

Be Versatile and Agile We focus on the future, looking for the smartest ways to improve our services, develop new markets, and express flexibility as new ideas and technologies emerge.

Be Respectful We respect every individual we encounter, whether a client, employee, partner, or competitor.

We always treat others as we wish to be treated.

Do What You Say When we make a promise, we keep it. We expect the same from our employees, clients, and partners.

GUARANTEES 3rd Party CISO (Chief Security Information Officer) to Ensure We Remain Secure Service Calls Answered by A Human Meet Service Level Agreement Make Things Right If We Fall Short 30-Day Money Back Guarantee

FTC Safeguards Services Include: Virtual Chief Security Officer (vCSO) Service 2022v2 Compliance Security Stack Third-Party Penetration Testing Vulnerability Scanning Subscription STEP ONE: FTC SAFEGUARDS REQUIREMENT

OUR SOLUTION

1. Assign Qualified Individual

•

vCSO Service

2. Conduct a Risk Assessment

•

vCSO Service

3. Implement Safeguards for Risks Identified in Risk Assessment

•

2022v2 Compliance Security Stack

• • •

2022v2 Compliance Security Stack Third-Party Penetration Testing Vulnerability Scanning

5. Train Your Staff

•

2022v2 Compliance Security Stack

6. Monitor Service Providers

•

vCSO Service

Keep Your Information Security Program Current

•

vCSO Service

8. Create a Written Incident Response Plan.

•

vCSO Service

9. Report to Your Board of Directors or Senior Officer

•

vCSO Service

4. Monitor and Test Safeguards

7.

EP vCSO SERVICE

•

Design and implement your information security program Define security policies and procedures

•

Conduct a risk assessment

•

Review your service providers’ security practices (annually)

•

Create a written incident response plan

•

Report to your board of directors or senior officer responsible for the security program (annually) Prepare and present updates for the Annual Cyber Security Risk Board Update. Before the update, confirm content with the executive team and review discussion topics.

•

IT Security Meetings (Monthly) Meeting to review issue progress, vulnerability test results, security project status, plan for upcoming events, and review/edit deliverables as needed.

•

Simulated Phishing Exercises (Quarterly) - *Requires 2022v2 Compliance Security Stack

•

Data backup review (Monthly) Review backup of all endpoint machines and servers to ensure that they are occurring on a timely basis and are within backup service level agreement.

•

User privilege Review (Quarterly) Review the list of Line of business, M365, or Google Workspace and domain users to ensure no unneeded users; verify tickets were created for user termination requests as well as any Human Resources changes.

•

Executive Leadership Meeting (Quarterly) Meet with the executive team (CEO, COO, CFO, GC, and CAO) to provide updates on current trends in IT security, the latest vulnerability analysis, and the status of IT projects; supplement with further updates as needed.

•

IT Security Training (Annually) Select and initiate IT security training for all users and validate their participation.

•

Vulnerability Scan/Security Analysis (Quarterly) - * Requires vulnerability scanning subscription Provide ongoing security analysis of the network, provide/review report findings with leadership and assist in necessary remediation projects.

•

Physical Inventory Review (annually) Review the list of IT equipment to ensure it is up to date, and all assets are accounted for.

•

Third-party penetration testing review (annually) - * requires third-party penetration testing service Schedule, coordinate, and oversee third-party penetration testing; coordinate remediation with IT of any findings from the testing.

•

Policy Review (Annually) Review policies and make updates based on organizational changes; if changes are made to acceptable use policy, coordinate with legal and in corporate into Employee Handbook as needed; create and implement new policies as needed.

•

Procedure Review (Annually) Review and update procedures

•

Threat Intelligence Emails (As-Needed) Provide threat intelligence emails to organization as relevant.

•

Security Deliverables (As-Needed) Provide other security deliverables and best practices as needed.

STEP ONE: 2022v2 COMPLIANCE SECURITY STACK 2FA/MFA In & Outbound Email Spam Filtering Security Awareness Training Phishing Simulations Anti-phishing Platform Password Vault Application Control All the time, VPN for computers (Encryption in Transit) Web Gateway Security Next-Generation Endpoint Protection and Updates Multi-Engine Proxy Scanning Anti-Ransomware Ring-Fencing Computer Encryption (At Rest) Governance, Risk, and Compliance Center Security Information & Event Management (SIEM) Managed Detection and Response (MDR)/Security Operations Center (SOC) Office 365 or Google Workspace Defense Email Encryption (In Transit) Data Loss Prevention (DLP)

SERVICES P