312.8 — Written information security program for children's data

Requirement

The operator maintains a written information security program appropriate to its size and the sensitivity of the data, with one or more designated coordinators, an annual risk assessment, safeguards to control identified risks, regular testing and monitoring of safeguards, and at least annual evaluation and modification; it takes reasonable steps to release children's information only to recipients capable of protecting it, with written assurances.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.