FCRA / FACTA

Fair Credit Reporting Act - accuracy, disposal rule, red flags, identity theft prevention.


Short name	FCRA
Region	Americas
Country or scope	United States
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers FCRA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for FCRA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for FCRA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`FCRA-1681EB` Maximum Possible Accuracy	Consumer reporting agencies must follow reasonable procedures to assure maximum possible accuracy of consumer report information; applied to the systems producing those reports, every software component record must itself be complete with name and version (15 U.S.C. 1681e(b))	Scan
`FCRA-1681EA` Permissible Purpose Controls	Agencies must maintain reasonable procedures to furnish consumer reports only for permissible purposes and to verify prospective users, which requires knowing the identity and supplier of the systems and parties in the data flow (15 U.S.C. 1681e(a))	Scan
`FACTA-682` Disposal Rule Readiness	Any person maintaining consumer report information must take reasonable measures to properly dispose of it; disposing of data reliably requires knowing which systems and software components hold it, i.e. an enumerated inventory (FACTA Disposal Rule, 16 CFR Part 682)	Scan
`FACTA-681.1` Red Flags Identity Theft Prevention	Financial institutions and creditors with covered accounts must run a written identity theft prevention program that detects and responds to red flags, which requires the account-handling systems and their components to be individually identifiable (Red Flags Rule, 16 CFR 681.1)	Scan
`FACTA-681.1-DOC` Written, Board-Approved Program	The identity theft prevention program must be written, approved, and periodically updated to reflect changing risks, which is supported by formally identified, timestamped documentation of the systems in scope (16 CFR 681.1(d)-(e))	Scan
`FCRA-INTEG` Integrity of Report-Producing Systems	Accuracy and integrity duties for furnishers and agencies presuppose that the software producing and transmitting consumer report data has not been tampered with, implying integrity verification of deployed components (FCRA accuracy and integrity obligations, incl. 15 U.S.C. 1681s-2 furnisher duties)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`1681b`	Permissible Purpose Controls
`1681c`	Prohibited Information Controls
`1681e`	Procedures for Accuracy
`1681i`	Consumer Dispute Resolution
`1681m`	Adverse Action Notices
`1681m-redflags`	Red Flags Identity Theft Prevention Program
`1681w`	Disposal of Consumer Information
`FACTA-216`	Summary of Consumer Rights
`1681s2b`	Furnisher Accuracy & Investigation Duties

Policy templates

Written for FCRA:

FCRA Red Flags Identity Theft Prevention Program

And 22 from the standard set, adapted to FCRA.