AegisAI Perspectives · 053
Yes: 16 CFR 314.4(h) requires a written incident response plan for security events, and a phish that leads to unauthorized mailbox access is one of them.
Yes. 16 CFR 314.4(h) requires a written incident response plan for any security event that materially affects customer information, and the plan must address seven areas12. The rule never names phishing. It is written around the security event: unauthorized access to, or disruption or misuse of, an information system7. AegisAI investigates each inbound email for what it is trying to do and removes the ones that fail from every mailbox they reached23.
Institutions that hold customer information on fewer than five thousand consumers are exempt from paragraph (h)10. This page states what the rule text and the FTC's 2021 final rule notice say. It is not legal advice. The wider rules for the sector are in email security for financial services: controls and rules.
Eight steps take a reported phish from the first ticket to a revised plan, each tied to a clause of Part 314.
Log the report time and the reporter, and attach the message. Documentation and reporting of security events is area (6) of the plan.
Name the decision owner. Area (3) asks for roles and responsibilities with clear levels of decision-making authority, and area (4) for internal and external communications. Write down who declares a security event and who tells whom.
Remove every delivered copy. In Microsoft Defender for Office 365 Plan 2 that is a remediation such as soft delete, approved by a holder of the Search and Purge role17. In Google Workspace it is the security investigation tool21.
Check for access. Pull sign-in and mailbox activity for every recipient who clicked. Section 314.4(c)(8) already requires controls that monitor and log the activity of authorized users5.
Contain any mailbox an attacker reached. Disable the account and revoke its sessions19, then check for the forwarding rules Microsoft lists as symptoms20.
Classify the event. Test it against the security event definition in 314.2(q), then against the notification event definition in 314.2(m)9. The FTC filing steps are in when a financial firm must tell the FTC about an email breach.
Fix the weakness the phish used. Area (5) requires the plan to identify requirements for remediating weaknesses in information systems and controls. Section 314.4(c)(5) requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves equivalent controls in writing6, covered in what the Safeguards Rule requires for MFA on email.
Close the record and revise the plan. Area (7) is evaluation and revision of the plan after a security event. The Qualified Individual's written report to the board, made at least annually, covers material matters including security events4.
AegisAI agents investigate every inbound email for what it is trying to do, and remove the ones that fail from every mailbox they reached, forwards included, as described on the inbound email security page. They read mail through the Microsoft 365 or Google Workspace API after delivery and start read-only, in monitoring mode24. Removal needs write access that the admin grants and can revoke. Each verdict carries its reason in plain language, and each alert carries a summary, the warning signs found and a recommended next step25.
Each duty turns on what the phish achieved: access, acquisition or a consumer count3. The table maps common outcomes to the rule text.
| Phishing outcome | What the rule text says | Clause |
|---|---|---|
| Blocked or removed before anyone opened it | It is a security event only if access, disruption or misuse resulted. The FTC declined to limit security events to those with consumer harm14. | 314.2(q) |
| Delivered and reported, no click | The same definition applies. Record whether any access, disruption or misuse resulted, since documentation is a plan area. | 314.2(q), 314.4(h)(6) |
| Password entered, attacker signs in to the mailbox | Unauthorized access to an information system that holds customer information or connects to one8. The plan covers events materially affecting customer information. | 314.2(j) and (q), 314.4(h) |
| Attacker reached unencrypted customer information | Access is presumed to be acquisition unless reliable evidence shows otherwise, and acquisition is a notification event. | 314.2(m) |
| Notification event involving 500 or more consumers | FTC notice as soon as possible, no later than 30 days after discovery. | 314.4(j)(1) |
| Customer information on fewer than five thousand consumers | Paragraph (h) does not apply. | 314.6 |
Illustrative example, figures are fictional. Larkspur Tax Partners is a fictional tax preparation firm that holds customer information on 8,200 consumers, so paragraph (h) applies.
At 09:12 on a Monday a preparer reports a "shared document" email. She typed her password into the linked page at 09:05. The decision owner named in the plan, the IT lead, opens a ticket at 09:15.
By 09:24 the team has removed 41 copies of the message from 37 mailboxes. The audit log shows a sign-in to the preparer's mailbox from a new device at 09:07, and a new rule that forwards mail containing "1040" to an outside address. The IT lead disables the account and revokes its sessions by 09:28, then deletes the rule by 09:31.
The sign-in is unauthorized access to an information system, so the IT lead records a security event. The mailbox held returns for 212 consumers, unencrypted. The firm has no evidence against acquisition, so it treats this as a notification event. It is under 500 consumers, so no FTC notice is due under 314.4(j).
The firm enforces MFA on the account that lacked it, adds a forwarding rule check to the plan and lists the event in the next board report.
Financial institutions under FTC jurisdiction that are not subject to another regulator's enforcement authority under section 505 of the Gramm-Leach-Bliley Act11. The rule lists examples: mortgage lenders, payday lenders, finance companies, mortgage brokers, check cashers, collection agencies, tax preparation firms, non-federally insured credit unions and investment advisors not required to register with the SEC12.
Size changes the incident response duty. Paragraph (h) does not apply to an institution that maintains customer information on fewer than five thousand consumers. The same exception covers the written risk assessment in (b)(1), the testing in (d)(2) and the board report in (i).
A phish qualifies when it results in unauthorized access to, or disruption or misuse of, an information system or the information stored on it. An information system is a set of electronic resources that holds customer information or connects to a system that does.
The FTC replaced possession with control in paragraph (h), and said customer information an institution opted to store in the cloud is certainly within its control15.
Paragraph (h) covers security events that materially affect customer information. The FTC declined to narrow the definition to events with consumer harm. It said an institution should still run its incident response procedures to find whether an event shows a weakness that could endanger customer information.
Seven areas, listed in 314.4(h)(1) to (h)(7):
The list names no attack type. The FTC said the plan need not include minute details or all possible scenarios. It asks for a system, such as clear lines of responsibility and ways to share information, that works regardless of the nature of the event13.
Paragraph (h) sets the plan's terms in one sentence. The plan is written, designed to promptly respond to and recover from security events, and scoped to customer information in the institution's control.
The Qualified Individual reports to the board in writing at least annually. The report covers material matters, including security events and management's responses. Section 314.4(c)(8) requires controls that monitor and log the activity of authorized users.
The rule text names no framework. NIST SP 800-61 Revision 3, published April 2025, places incident response recommendations inside the NIST Cybersecurity Framework 2.016.
Contain the account first, then scope what the attacker reached. Microsoft's steps for a compromised Microsoft 365 mailbox start by disabling the account and then revoking active sessions and refresh tokens.
Check the mailbox for Inbox rules that forward to unknown addresses and for new external forwarding, both symptoms Microsoft lists. Send the reset password by another channel than email.
Pull the same message from every other mailbox. In Defender, two-step approval has one team member add messages to a remediation and another approve it18. In Google Workspace, admin actions in the investigation tool show in Admin log event data22. Then run the notification event test in 314.2(m).
Track three numbers for every reported phish, from the incident tracker and the mail platform's logs.
Yes, for institutions holding customer information on five thousand or more consumers. Section 314.4(h) requires a written plan for any security event materially affecting customer information. The rule names no attack type, so a phish enters the plan through the security event definition in 314.2(q).
An event resulting in unauthorized access to, or disruption or misuse of, an information system, the information stored on it, or customer information held in physical form.
The definition turns on access, disruption or misuse. The FTC declined to limit security events to those with consumer harm. Record the decision either way, since documentation is a plan area.
Not under paragraph (h) if it maintains customer information on fewer than five thousand consumers. Most of 314.4 still applies, apart from (b)(1), (d)(2) and (i), including MFA under 314.4(c)(5).
No. The FTC notice applies to a notification event, which is acquisition of unencrypted customer information without authorization. It is due when the event involves at least 500 consumers, as soon as possible and no later than 30 days after discovery.
No. The rule text names none, and the FTC said the plan need not cover all possible scenarios. NIST SP 800-61 Revision 3 is one federal reference.
