Have you designated a Qualified Individual responsible for your information security program?

One named person (internal or an outside provider) accountable for security.

16 CFR 314.4(a)