FTC Safeguards Rule compliance means building, documenting and maintaining a written information security program that protects your customers’ financial information, and reporting certain breaches to the FTC. It applies to far more businesses than banks: mortgage brokers, auto dealers, tax preparers, finance companies and similar firms. This guide explains who is covered, what the rule requires, which small-firm relief exists, and how to work through it in a sensible order.
TL;DR
- The rule (16 CFR Part 314) covers non-bank financial institutions under FTC jurisdiction, defined by what you do, not by what your industry is called.
- You need a written security program with a named Qualified Individual, MFA, encryption, vendor oversight, testing and staff training.
- Since May 13, 2024, you must notify the FTC within 30 days of discovering an event involving unencrypted data of 500 or more consumers.
- Firms holding information on fewer than 5,000 consumers get relief from some written requirements, but not from the rest of the rule.
- Hiring an IT provider helps with the technical work, but legal accountability stays with you.
Table of Contents
- Who the Safeguards Rule covers
- What the rule requires
- A checklist you can work through
- Breach notification: the 500-consumer rule
- Relief for small firms
- Where firms usually fall short
- Our perspective: compliance is a security program with receipts
- How Axio Networks can help
- How the rule evolved
- FAQ
- Sources
Who the Safeguards Rule covers
The rule implements the Gramm-Leach-Bliley Act. It applies to non-bank financial institutions under FTC jurisdiction that are not overseen by another federal financial regulator. Typical examples include mortgage lenders and brokers, motor vehicle dealers, finance companies, payday lenders, tax preparers, and investment advisers not required to register with the SEC.
The definition is intentionally broad and focuses on activity. A car dealership that arranges financing, or an accounting practice that prepares returns, can be covered even if the owner thinks of the business as retail or bookkeeping. If you are unsure, check the activities you perform against the definitions in 16 CFR Part 314 rather than relying on your industry label. For a close call, ask an attorney who handles financial regulation.
The rule protects “customer information,” which means nonpublic personal information about your customers, such as names tied to account numbers, income, credit history, Social Security numbers and tax records, in paper or electronic form.
What the rule requires
The rule asks for a program that fits your size, complexity and the sensitivity of the data you hold. It is scalable by design. A five-person tax practice is not expected to copy a large bank’s security operation, but it is expected to do the reasonable basics and to write them down.
The core elements, as set out in the regulation itself, are:
- A Qualified Individual. One designated person oversees and enforces the program.
- A written risk assessment. You identify reasonably foreseeable internal and external risks to customer information and decide how each will be controlled.
- Access controls and data inventory. You know what data you hold, where it lives, and who can reach it, and you limit access to those who need it.
- Encryption. Customer information is encrypted in transit and at rest, or you use an approved effective alternative.
- Multi-factor authentication. MFA for anyone accessing information systems that hold customer information.
- Secure development and change management. Applies if you build applications, and covers how you manage changes to systems.
- Monitoring and testing. Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
- Training and service provider oversight. Staff are trained, qualified security personnel are in place, and vendors are selected and monitored.
- Incident response and secure disposal. A written incident response plan, and disposal of customer information no later than two years after last use unless there is a business or legal reason to keep it.
The monitoring cadence is spelled out in the rule: annual penetration testing and vulnerability assessments every six months, unless you run effective continuous monitoring.
A checklist you can work through
The order below is the one that tends to save the most rework. Each step produces something you can show an examiner, which matters because a program that exists only in someone’s head is not a program.
1. Confirm you are covered and size your obligations
Write a one-page memo stating which of your activities are financial in nature and why you fall under FTC jurisdiction. Then count the consumers whose information you maintain. That count decides whether the small-firm relief applies (see below), and it also feeds the breach-reporting threshold.
2. Name your Qualified Individual
The Qualified Individual does not need to be a CISO or hold a particular certification. They must be a single, accountable person with the knowledge and authority to run the program. You can use an employee, an affiliate or a service provider for this role, but responsibility for the program stays with your company. If a provider fills the role, a senior person inside your firm must still direct and oversee them.
3. Map your data and systems
List every system, device, application and paper repository that touches customer information: your CRM or loan origination software, tax software, email, file shares, laptops, phones, scanners, cloud storage and backups. Then trace how data flows between them. Most firms discover at least one copy of sensitive files in a place nobody planned for, such as a desktop folder or an old shared drive.
4. Complete the written risk assessment
For each system and data flow, record what could go wrong, how likely and how damaging it would be, and which control addresses it. Keep it dated. Revisit it when your operations change, for example after moving to a new platform or opening a second office.
5. Turn on MFA everywhere customer data is reachable
MFA is the control most small firms can deploy fastest, and it is explicitly required. Start with email, remote access, your line-of-business software and cloud storage. Plan for edge cases such as shared logins and older applications that do not support modern sign-in. We cover the practical side in our guide to MFA for small business and the common MFA mistakes that leave gaps.
6. Encrypt data at rest and in transit
Enable full-disk encryption on laptops and desktops, confirm that email and file transfer use encrypted channels, and check that cloud and backup storage is encrypted. If you cannot encrypt something, the rule allows an effective alternative only when your Qualified Individual has approved it in writing, so document the reasoning.
7. Schedule testing and monitoring
Put the annual penetration test and the twice-yearly vulnerability assessments on the calendar, or set up continuous monitoring and keep evidence that it works. Keep the reports, and record what you fixed and when.
8. Train your people
Phishing and social engineering remain the usual way in. Run security awareness training for everyone with access, repeat it, and keep attendance records. If you need a starting framework, see how to build a cybersecurity awareness program for employees.
9. Review every vendor that touches customer data
Payroll processors, cloud storage, tax software, document-signing tools, your IT provider: each needs to be vetted before you hand it customer information, covered by a contract that requires appropriate safeguards, and reassessed periodically. Hiring a third party does not outsource the compliance risk. This is the gap we see most often at small firms.
10. Write and rehearse the incident response plan
Name who decides what, who calls whom, how you isolate affected systems, how you preserve evidence, and who handles customer, legal and FTC communication. A short tabletop exercise once a year exposes weak points cheaply.
11. Report to your leadership
The Qualified Individual reports in writing to your board of directors or equivalent governing body at least annually. For a small owner-run firm, that can be a short written report to the owners covering the program status, risk assessment results, testing outcomes and recommended changes.
Breach notification: the 500-consumer rule
Since May 13, 2024, covered firms must notify the FTC as soon as possible, and no later than 30 days after discovery, when a security event involves unauthorized acquisition of unencrypted customer information of at least 500 consumers. The FTC reports through an online form, and the report may be made public, unless law enforcement has asked for a delay.
Two details trip people up:
- The count is broad. The 500 figure is measured against every consumer whose information you maintain, not only your current active clients. Count former customers and prospects whose files you still hold.
- Size does not exempt you. The small-firm relief described below does not remove the notification duty.
Encryption matters here too. The trigger concerns unencrypted information, so properly encrypted data that is taken is treated differently, provided the encryption key was not also compromised. Confirm the exact wording of the rule’s definitions with counsel before relying on that in a live incident.
Relief for small firms
If you maintain information on fewer than 5,000 consumers, the exemption in section 314.6 lightens several written obligations: the written risk assessment, continuous monitoring or the testing cadence, the written incident response plan, and the annual written report to the board. The FTC’s own guidance describes the relief in a similar way, though it summarizes the list differently, so read the FTC’s business guidance and the regulation text to confirm which items apply to you.
What the exemption does not do:
- You still need a Qualified Individual, MFA, encryption, access controls, training, vendor oversight and secure disposal.
- You still must notify the FTC of qualifying breaches.
- You can lose the relief by growing past the threshold, so keep a running count.
Even if you qualify, a short written risk assessment and incident plan are cheap insurance. They are also what a lender, insurer or partner will ask to see.
Where firms usually fall short
The same weak spots appear again and again.
| Gap | Why it happens | Fix |
|---|---|---|
| No named Qualified Individual | Everyone assumes the IT provider has it | Designate one person in writing, even if a provider supports them |
| MFA on email only | Rollout stopped at the easy win | Extend to remote access, cloud storage and line-of-business apps |
| Vendors never reviewed | Contracts signed years ago | Keep a vendor list with security review dates |
| Old customer data kept indefinitely | Nobody owns deletion | Set a retention schedule and dispose of data on it |
| Backups not tested | Assumed to work | Run restore tests and keep the results |
| No evidence | Work was done but not recorded | Date and file every assessment, test and training session |
Our perspective: compliance is a security program with receipts
We work with small and mid-sized businesses across the Phoenix metro area, and our view is simple: the Safeguards Rule is less a paperwork exercise than a description of decent security written down and proven. If the controls are real, the paperwork is mostly a matter of recording them.
That is why we design security into every managed service instead of selling it as a bolt-on. MFA, endpoint protection, email filtering, backups and monitoring are things your systems should have whether or not a regulator is watching. Compliance then becomes a matter of documenting what already runs.
Two cautions from our side. First, a provider can do the technical work and support your Qualified Individual, but it cannot take the legal accountability off you, and anyone who promises otherwise is overselling. Second, do not buy a tool in the hope that it “makes you compliant.” No single product does. The rule asks for a program: people, process and technology, with evidence.
If you run a tax practice, dealership or lending shop with no in-house IT staff, a predictable flat monthly fee is often easier to budget than piecemeal hourly work, and it keeps patching, monitoring and backups from slipping when you are busy.
— Jim O’Connell
How Axio Networks can help
If you want the technical controls handled by a team that is local to you, our managed IT services cover day-to-day support, patching and administration under a flat-rate model. Our cybersecurity services include endpoint security and EDR, SOC monitoring and MDR, email security, risk and vulnerability management, and security awareness training. Our backup and disaster recovery service addresses the recovery side of an incident. You can also read how we approach financial services IT compliance, or contact us through our site to talk through where your firm stands.
How the rule evolved
Knowing the timeline helps you read older advice with care. The Gramm-Leach-Bliley Act dates to 1999, and the original Safeguards Rule took effect on May 23, 2003, with no changes for many years afterward. The FTC overhauled it with much more specific technical requirements, and it extended the compliance deadline for several provisions to June 2023. In October 2023 the agency approved the breach notification amendment, which took effect in May 2024. Any guide that still treats the technical safeguards as optional or new is out of date.
FAQ
What is the penalty for not complying with the FTC Safeguards Rule?
The FTC can bring enforcement actions against firms that fail to maintain reasonable safeguards, and it has done so against small businesses in the past, including mortgage companies. Outcomes depend on the facts, so speak with an attorney about your own exposure. Beyond regulators, a breach can bring customer loss, lawsuits and recovery costs.
Can my IT provider be our Qualified Individual?
Yes, the rule allows a service provider to fill the role. But your company stays legally responsible for the program, and you need a senior person internally to oversee the provider. Put the arrangement in a written agreement that spells out duties and reporting.
Do we need to comply if we only keep paper files?
Yes. The rule covers customer information in any form, including paper. Locked storage, access limits and secure shredding all belong in your program, alongside the digital controls.
How often must we test our security?
Unless you use effective continuous monitoring, the rule calls for annual penetration testing and vulnerability assessments at least every six months, plus whenever your operations or systems materially change. Firms under the 5,000-consumer threshold may be relieved of this specific requirement, so check section 314.6.
Does the rule apply to businesses outside the FTC’s jurisdiction?
This rule covers entities under FTC jurisdiction. Banks, credit unions and SEC-registered advisers answer to their own regulators under the same Gramm-Leach-Bliley framework, with their own rules. If you are unsure which regulator applies, confirm with counsel.
Sources
- FTC Safeguards Rule: What Your Business Needs to Know
- 16 CFR Part 314, Standards for Safeguarding Customer Information (eCFR)
- Safeguards Rule notification requirement now in effect (FTC)
- Safeguards Rule Security Event Reporting Form (FTC)
- FTC Safeguards Rule Penetration Testing Requirements (Stingrai)
- FTC Safeguards Rule Checklist (Leading IT)
- FTC workshop slides on the GLB Safeguards Rule, July 13, 2020
- Compliance deadline extended to June 2023 (FTC)
- FTC amends Safeguards Rule to require breach reporting (FTC, 2023)
- FTC enforces Safeguards Rule against mortgage companies (FTC, 2004)