FTC takes action against CafePress for data breach cover up(ftc.gov)

    1. Technical measures to monitor all of Respondent’s networks and all systems and
    assets within those networks to identify data security events, including unauthorized
    attempts to exfiltrate Personal Information from those networks;

    2. Policies and procedures to ensure that all code for web applications is reviewed for
    the existence of common vulnerabilities;
  
    3. Policies and procedures to minimize data collection, storage, and retention, including
    data deletion or retention policies and procedures;
  
    4. Encryption of all Social Security numbers on Respondent’s computer networks;
  
    5. Data access controls for all databases storing Personal Information, including by, at a
    minimum, (a) restricting inbound connections to approved IP addresses, (b) requiring
    authentication to access them, and (c) limiting employee access to what is needed to
    perform that employee’s job function;
  
    6. Policies and procedures to ensure that all devices on Respondent’s network with
    access to Personal Information are securely installed and inventoried at least once
    every twelve (12) months, including policies and procedures to timely remediate
    critical and high-risk security vulnerabilities and apply up-to-date security patches;
  
    7. Replacing authentication measures based on the use of security questions and answers
    to access accounts with multi-factor authentication methods that use a secure
    authentication protocol, such as cryptographic software or devices, mobile
    authenticator applications, or allowing the use of security keys; and
  
    8. Training of all of Respondent’s employees, at least once every twelve (12) months,
    on how to safeguard Personal Information;