FTC Consent Decrees

As a comprehensive solution for companies bound by FTC consent decrees / enforcement actions, our FTC Privacy & Security Program Assessment Service can help you demonstrate that you adhere to those mandated security and privacy measures, controls, and protocols necessary to protect consumers.

Importance of FTC Consent Decree Compliance

FTC consent decrees often necessitate the strengthening of data security and privacy practices through the implementation of robust processes and procedures to align with the detailed requirements set forth in these orders. As stringent as FTC enforcement actions can be, non-compliance with these decrees poses significant risks with both regulatory and reputational implications, making FTC compliance essential.

Why Schellman as Your Trusted Partner?

To assist you in navigating the complex challenges often posed by FTC consent decrees, you’ll need a trusted and independent assessor to verify your implementation of necessary adjustments that’ll ensure ongoing consumer protection—with our comprehensive and efficient services, Schellman may be the right choice for you for your FTC Privacy & Security Program Third-Party Assessment. Why? Because when you work with us, you can expect:

Independence A main tenant of these enforcement actions is an FTC-approved third-party assessment—as we do not offer consulting or advisory services, Schellman can guarantee independence while also satisfying the FTC’s reputation and qualification requirements.
Experienced Assessors When assessing your business processes against consent decree mandates, our team of experts will leverage their wealth of knowledge in regulatory frameworks, data privacy, and consumer protection.
Holistic, Tailored Solutions Because we recognize that each organization and FTC enforcement action is unique, our thorough evaluation of your data collection and retention processes, access controls, transparency practices, breach response plans—and more—will be tailored to your specific industry, business model, and consent decree obligations.
Detailed Reporting Following the assessment, we’ll provide meticulous documentation containing any findings or potential areas of concern in a report that meets the required and specified guidelines for the FTC.
Long-Term Partnership and Value Add We don’t just aim to assist you in complying with the near-term requirements set forth by the FTC—we’ll also look to build a long-term partnership that sees us help you navigate the ever-evolving security and privacy landscape, all while maintaining compliance with ease.

Our FTC Consent Decree Process

Selecting Schellman as your independent third-party assessor for your organization’s mandatory FTC Privacy & Security Program Assessment will give your organization comprehensive third-party validation of your commitment to regulatory obligations, consumer protection, and ethical business practices.

Analyze the Order

We begin by conducting a detailed analysis of the FTC order—not only will we examine the broader intent of the order and the context in which the controls are framed, but we’ll also pay close attention to the language used and any specific elements mentioned so that we gain a comprehensive understanding of the control requirements and the flexibility allowed.

Conduct Risk Assessments

We’ll then perform in-depth risk assessments to identify potential areas of non-compliance or vulnerabilities, which involves examining the control in question, evaluating the associated risks, and assessing the impact on privacy, security, or other relevant factors.

Develop Testing Methodologies

Based on our analysis and risk assessments, we’ll combine industry best practices, regulatory requirements, and customized procedures to develop testing methodologies tailored to the specific control and its intended outcomes, ensuring that we address the requirements, control attributes, and any ambiguities in the FTC order.

Test and Document Compliance

We’ll then attempt to validate the effectiveness of the control in addressing the broader requirements outlined in the order while documenting the testing process, results, and any identified gaps or areas that require further attention, as applicable.

Connect with a Schellman specialist.

Kristen Wilbur is a Principal at Schellman, currently leading the New York City practice where she specializes in SOC 1, SOC 2, ISO 27001, and HIPAA reporting. In her portfolio she also oversees large scale engagements that include assessments around FedRAMP, HITRUST, and Privacy.

Meet Kristen Contact Us