The FTC has published enough information publicly for companies to know what it considers reasonable security practices for protecting sensitive data, an FTC official said.