Service Provider Oversight (314.4(f))

The FTC's Safeguarding Customer Information rule obligates covered entities to oversee any service provider that processes or stores customer data. They must conduct due-diligence, require written agreements that enforce the standards, monitor performance, and terminate relationships if the provider fails to maintain required safeguards.