The QI's responsibilities
The Qualified Individual (QI) owns your information security program. In practice, that means:
- Running the program: the risk assessment, safeguards, testing, training and vendor oversight
- Making judgment calls the rule assigns to the QI, such as approving alternatives when encryption isn't feasible, or equivalent controls in place of MFA
- Keeping it current as your business, systems and threats change
- Reporting in writing, at least once a year, to your board or a senior officer on the state of the program, material risks, test results, security events and recommended changes (not required for businesses under 5,000)
Who can be your QI?
The rule doesn't require a certification. The QI needs the knowledge and experience to run the program. They can be:
- an employee,
- someone from an affiliated company, or
- an outside service provider, such as DesignatedQI.
How an outsourced QI works
If your business uses an outside QI, the rule adds three conditions. Your business must:
- Keep responsibility for complying with the rule.
- Designate a senior member of its staff to direct and oversee the QI.
- Require the provider to maintain a security program that protects the business, as the rule requires.
We build all three into our engagement: a written designation, a named senior manager to oversee us and a contract covering our own security obligations.
Why not have your IT provider do it?
You can, and many businesses do. But then the company running your systems is also the one checking them. An independent QI gives you, and the FTC if it ever asks, an objective view. We don't sell IT services, so we have no reason to overlook a problem.
Ready to designate a QI? Get in touch → or see Managed QI pricing →