What is reasonable security?
- Term
- Reasonable security
- Meaning
- Reasonable security is a US legal standard of safeguards that fit your size, data and risks. Some state rules spell it out for logins and access.
Reasonable security is the standard that the FTC and several state data security laws use in place of a fixed checklist. A business has to protect personal information with safeguards that fit its size, the data it holds and the risks it faces. Federal law sets the standard loosely, through Federal Trade Commission (FTC) cases. Some states write it out, and Massachusetts names user IDs and passwords directly.
Where does the standard come from?
Section 5 of the FTC Act (15 U.S.C. 45(a)) declares unfair or deceptive acts or practices in commerce unlawful. It doesn’t mention data security. In a 2020 report to the Senate, the FTC said it had brought more than 70 cases alleging that companies failed to use reasonable data security safeguards.
Under 15 U.S.C. 45(n), a practice is unfair only if it causes, or is likely to cause, substantial injury to consumers. Consumers must also be unable to reasonably avoid that injury, and it must not be outweighed by benefits. The same report notes that the FTC generally can’t seek civil penalties for a first violation of the Act. It can when a company breaks an FTC order.
What do state laws spell out?
| Law | Who it covers | What it says about accounts and access |
|---|---|---|
| New York General Business Law 899-bb(2) | Anyone who owns or licenses computerized private information of a New York resident | “Reasonable safeguards,” with a program that trains staff, holds service providers to safeguards by contract, and tests key controls |
| Massachusetts 201 CMR 17.03 and 17.04 | Anyone who owns or licenses personal information about a Massachusetts resident | Control of user IDs, access only for active users, a unique ID and password per person, access limited to those who need it, and no access for terminated employees |
| California Civil Code 1798.150 | Businesses covered by the California Consumer Privacy Act | Consumers may sue if certain data is stolen or disclosed because the business broke its duty to keep reasonable security |
The New York and Massachusetts rules both scale to the business. New York lets a small business meet it with safeguards that fit its size and complexity (899-bb(2)(c)), and Massachusetts weighs size, resources and the amount of data stored (17.03(1)).
New York enforces its rule through the attorney general. California requires 30 days’ written notice before a consumer sues for statutory damages. Adding reasonable security after a breach doesn’t count as curing that breach.
What does it ask of accounts and access?
Read together, these texts and the FTC’s Start with Security guide point to five practices:
- Give each person their own login (201 CMR 17.04(2)(b)).
- Limit access to what each job needs, and limit administrator access (17.04(2)(a); FTC lesson 2).
- Close access when people leave or stop being active users (17.03(2)(e), 17.04(1)(d)).
- Require strong passwords and, where you can, multi-factor authentication (MFA): a second check beyond the password (FTC lesson 3).
- Hold vendors to the same standard in writing (899-bb(2); FTC lesson 8).
The FTC guide gives an example of the third practice going wrong. In one case it describes, the FTC alleged that a company let employees and outside contractors share one root login to its cloud services. The company didn’t change that login when a contractor left. The former contractor later used it to take personal data.
Frequently asked questions
Is there one federal law that defines reasonable security?
No. The FTC Act bans unfair or deceptive practices, and the FTC has brought more than 70 cases alleging companies failed to use reasonable data security. The statute itself has no checklist.
Does reasonable security ban shared accounts?
None of these texts bans shared accounts. Massachusetts asks for a unique ID and password for each person with computer access, and the FTC guide describes a case where a shared root login wasn't changed after a contractor left.
Do small businesses get a lighter standard?
New York says a small business meets the rule if its safeguards fit its size and complexity. Massachusetts scales safeguards to size, resources and the amount of data held.
Can customers sue over weak security?
In California, yes, under Civil Code 1798.150, if certain personal information is stolen or disclosed because the business didn't keep reasonable security. New York's 899-bb creates no private right of action.
How Junify handles this
- Doing this by hand
- You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.
- With Junify
- For logins that stay shared, Junify ties each use to a person and ends their access through Junify when they leave. People verify on their own phone before opening an account, so Junify records who used which account and when, person by person. Change the password at setup so only Junify holds it, and people sign in without seeing it. Remove someone's access and they can't open the account through Junify again.
Sources
- 15 U.S.C. 45, Unfair methods of competition unlawful (Cornell LII)
- FTC: FTC's Use of Its Authorities to Protect Consumer Privacy and Security (2020)
- FTC: Start with Security, A Guide for Business
- New York General Business Law 899-bb, Data security protections (NY Senate)
- 201 CMR 17.01, Purpose and scope (Cornell LII)
- 201 CMR 17.03, Duty to protect and standards for protecting personal information (Cornell LII)
- 201 CMR 17.04, Computer system security requirements (Cornell LII)
- California Privacy Protection Agency: California Consumer Privacy Act of 2018 (statute text, January 2025), Civil Code 1798.150
-
What access logs need to show when you decide whether to report a breach
Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
-
Password sharing and the federal anti-hacking law (CFAA)
The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
-
What CIS Controls 5 and 6 (v8.1) ask of your accounts
Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.