Actifile sweeps the machines for card data and personal identifiers, then breaks the findings down by device so you can see where unprotected material is resting.
All of the above, and then encryption applied to files as they move, several compliance profiles running at once, and a say in which applications and routes data may exit by.
Nobody decided to keep it there.
Customer information does not stay where the system of record put it. It is exported to a spreadsheet for a review meeting and never deleted. It is scanned as a driver's licence and left in a downloads folder. It is attached to a mail thread, saved by four people, and carried onto two laptops that have since left the office. None of that was a decision. It is what happens when people do their jobs with the tools in front of them.
The consequence is that the honest answer to where does this firm hold customer information is usually unknown, and unknown is a difficult starting point for a risk assessment that the rule expects to be written down and periodically revisited. You cannot assess a risk whose location you are guessing at.
What the scan actually returns.
Actifile sits on Linux, macOS, and Windows machines hunting for the identifiers this industry gathers up: a name tied to an account number, a social security number, card details, and the kinds of document that carry any of them. What comes back is not a wall of alerts. It is a baseline.
- A breach risk baseline for the firm, stated as a figure, so that exposure can be argued in the same currency the rest of your management meetings already use.
- A breakdown by machine, naming which ones hold unprotected material and how much of it, which turns a general anxiety into a work list.
- Vulnerability scanning, reported as a trend, so you see which way things are moving instead of one photograph taken the week before an assessment.
Most firms find the first report uncomfortable, and that discomfort is the product. It is also, in our experience, the cheapest way to make a written risk assessment concrete.
Sealing that travels with the file, and a say in how it departs.
Everything above, and three additions. Encryption applied and lifted on the fly, keeping material sealed while it rests on the machine and opening it without ceremony for an application that is allowed to see it. More than one compliance profile at a time, so a firm answering to two regimes runs two rule sets rather than adopting the harsher one everywhere and absorbing the friction. And allowlisting of applications and channels for secured material, which settles whether a protected file may depart by mail, by browser upload, or on removable media, and through which programs.
Encryption of customer information at rest and in transit is a named requirement, with a narrow alternative: where encryption is infeasible, a firm may use effective compensating controls, reviewed and approved by the Qualified Individual. This line is aimed squarely at the material that sits outside the systems where encryption was somebody else's default.
The half of the duty nobody budgets for.
The rule requires procedures for the secure disposal of customer information no later than two years after the last date it was used in connection with providing a product or service, unless retention is otherwise required or targeted disposal is not reasonably feasible because of the way the information is maintained. It also requires the firm to periodically review its data retention policy to minimise unnecessary retention.
Both of those obligations are unanswerable without discovery. A firm that does not know where copies live cannot dispose of them, and cannot demonstrate that it reviewed anything. Discovery output is the input to that review, and the review itself, along with the decision about what must be kept, stays with your firm and your counsel.
Findings as input, and the decisions that are not ours
The rule requires the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. Discovery supplies the location and volume findings that assessment is supposed to reason about.
It requires encryption of customer information held on your systems and in transit over external networks, permitting effective alternative compensating controls only where encryption is infeasible and only with the written approval of the Qualified Individual. The enforcement line addresses the copies that sit outside the platforms where encryption was already handled.
And it requires secure disposal within two years of last use, together with a periodic review of the retention policy. We supply the map. The disposal decision, and the judgement about what your firm is separately required to keep, is legal work and stays with you.
| Platform | Actifile, run for your firm by Fortify 24x7 |
|---|---|
| Operating systems | Linux, macOS, and Windows machines |
| What is looked for | Card data and personally identifying material held in local storage |
| Risk output | A firm-level breach risk baseline, broken down machine by machine for material left unprotected |
| Vulnerability scanning | On both lines, reported as a trend rather than a snapshot |
| Encryption | Files sealed and unsealed on the fly, enforcement line only |
| Compliance profiles | Several running at once, enforcement line only |
| Egress control | Allowlisted applications and channels for secured material, enforcement line only |
| Evidence produced | Discovery inventory, risk baseline, per-device reports, and vulnerability trend history |
| Counted by | Each endpoint, monthly |
Where these lines stop
Discovery runs on endpoints. It reads the machines you enrol. It does not index every software as a service platform your firm uses, and a platform that holds customer information outside your endpoints has to be assessed on its own terms.
Classification is probabilistic and needs tuning. The first weeks produce false positives, because a nine digit number in a spreadsheet column is not self-describing. Tuning is part of the service and it is work, not a switch.
Encryption here is not a substitute for platform controls. It protects the copies that ended up on endpoints. Material inside your custody platform, your practice management system, or your mail tenant is protected by the controls those platforms provide.
We do not decide what you may delete. Retention periods in this industry come from statute, from professional obligation, and from contract. Discovery tells you what exists. Your counsel tells you what must survive.
The words we are careful about
An FTC certification does not exist for any product, and no supplier is able to put a firm into compliance with the Safeguards Rule. That rule reaches financial institutions, and its duties settle on the Qualified Individual your own firm appoints. We sell technical services, plus the operating evidence those services leave behind, set out against the elements of 16 CFR Part 314 so that whoever signs the written program has something dated and specific to point to.
None of it promises a compliance verdict, a clean examination, or freedom from a security event, and none of it is legal advice. Which supervisor reaches your firm, what the written program has to contain as a result, and whether an event carries any duty to notify are all matters for your Qualified Individual and your lawyers.
Heads up: card statements show FORTIFY 24X7 - MoneyGuard Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.