Updated FTC regulations mean financial institutions must implement & maintain an information security program with administrative & physical defenses.