314.4(j) — Notify the FTC of notification events affecting 500 or more consumers

Requirement

When the institution discovers a notification event — unauthorised acquisition of unencrypted customer information — involving the information of at least 500 consumers, it notifies the FTC through its online form as soon as possible and no later than 30 days after discovery, including the types of information involved, the date or range of the event, the number of consumers affected and a general description.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.