Regulatory Security Explanation (FTC v. Drizly 2022)¶

Use this to explain your organization’s security posture and controls to a regulator (e.g., FTC); demonstrates program effectiveness and responsiveness to a consent order.

Hallucinated writing examples¶

Scenario. In November 2022, following the FTC consent order (time), an external regulator or auditor (FTC staff) (audience) requests a written explanation of the company’s information security program and compliance with the order. The Chief Information Security Officer (role) submits a regulatory security explanation (type) that addresses governance, the written program, access control and credential management, monitoring, data minimization, and evidence of operation.

REGULATORY SECURITY EXPLANATION

To: Federal Trade Commission (Staff)
From: [Company] — Chief Information Security Officer
Date: [Date]
Re: Response to FTC Request — Information Security Program and Consent Order Compliance (FTC Docket No. 2023185)

Introduction. This submission describes the Company’s information security program and compliance with the Decision and Order accepted by the Federal Trade Commission on October 24, 2022. The scope includes designation of a program coordinator, risk assessment, safeguards (access control, credential management, secure development, monitoring, data minimization), training, testing, service provider oversight, and evidence supporting each element. All assertions are supportable by the attached evidence index.

Governance. [Designated executive] has been designated to coordinate the information security program. The program is documented in writing and approved by [board/executive]. Reporting on program effectiveness and consent order progress is provided to [board/audit committee] on a [cadence] basis.

Risk assessment and safeguards. Material risks to the security of personal information have been identified and documented. Safeguards implemented include: (1) Access control and credential management — Multifactor authentication for all accounts with access to source code or production credentials; no storage of credentials in source repositories; role-based access and timely offboarding. (2) Secure development — Repository scanning for secrets; change approval for high-risk systems. (3) Monitoring — Logging and monitoring for anomalous access and exfiltration; regular assessments. (4) Data minimization — Published data retention schedule; process to delete or de-identify personal information when no longer necessary. Evidence: program document, access reviews, retention schedule, assessment reports.

Consent order compliance. The Company is implementing the comprehensive information security program, data retention schedule, and biennial independent assessment required by the order. This response is submitted for staff review and is supported by the attached evidence index.

Primary sources¶

FTC Complaint: In the Matter of Drizly, LLC, and James Cory Rellas, FTC Docket No. 2023185 (Oct. 24, 2022).
FTC Decision and Order: Decision and Order, FTC Docket No. 2023185 (Oct. 24, 2022).