Guide
Who can be your Qualified Individual?
Every covered business needs one named person in charge of its information security program. It can be you, an employee, or someone at your IT provider. Here's what the rule says and what the job involves.
By Tyler Milam, founder of Golden Rock · Updated
The rule
“Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program”
Who it can be
The rule allows someone you employ, someone at an affiliate, or someone at a service provider such as your managed IT company. Small offices often name the owner; others name their IT provider's security lead.
If your Qualified Individual works for someone else
Using an outside Qualified Individual is allowed, with three conditions:
- You keep responsibility for complying with the rule (314.4(a)(1)).
- A senior member of your own staff directs and oversees them (314.4(a)(2)).
- The provider or affiliate must keep an information security program that protects you (314.4(a)(3)).
What the job involves
- Running the risk assessment and choosing safeguards for what it finds.
- Making sure testing, training and vendor oversight actually happen on schedule.
- Approving, in writing, any equivalent control used instead of multi-factor authentication (314.4(c)(5)).
- With 5,000 or more consumers, reporting in writing at least once a year to your board or owner (314.4(i)).
Quotes are from the eCFR text of 16 CFR Part 314. Plain-language guidance, not legal advice. More guides