The FTC Safeguards Rule (16 CFR Part 314) is the Gramm-Leach-Bliley Act (GLBA) rule that requires non-bank financial institutions to run a written information security program that protects customer information. To comply you need a Qualified Individual in charge, a written risk assessment, specific safeguards including MFA and encryption, regular testing, staff training, vendor oversight, a written incident response plan and an annual written report to your board. Since May 13, 2024, you must also notify the FTC within 30 days of discovering a breach affecting 500 or more consumers.
This checklist is a practical summary, not legal advice. Confirm your obligations with counsel and the current rule text on eCFR.
Who is covered
The rule applies to "financial institutions" under FTC jurisdiction: businesses engaged in financial activities that aren't overseen by a banking or securities regulator for GLBA purposes. The rule (section 314.1) names examples including:
- Mortgage lenders and mortgage brokers
- Payday lenders and finance companies
- Account servicers, check cashers and wire transferors
- Collection agencies, credit counselors and other financial advisers
- Tax preparation firms, including accountants who complete income tax returns
- Investment advisers that aren't required to register with the SEC
- Non-federally insured credit unions and entities acting as finders
The FTC also says the rule covers most automobile dealers who finance or lease vehicles (see its auto dealer FAQ). The rule protects all customer information you hold, in paper or electronic form, including information about other institutions' customers that's been shared with you.
The checklist
Section 314.3 requires a written program with administrative, technical and physical safeguards "appropriate to your size and complexity". Section 314.4 lists the elements it must include:
| Requirement | What you need in place |
|---|---|
| Qualified Individual (314.4(a)) | One named person who oversees, implements and enforces the program. They can be an employee, or work for an affiliate or service provider |
| Written risk assessment (314.4(b)) | Criteria for rating risks, criteria for assessing the confidentiality, integrity and availability of systems and customer information, and how each risk will be mitigated or accepted. Repeat it periodically |
| Access controls (314.4(c)(1)) | Only authorized users get in, and they see only the customer information their job requires. Review access periodically |
| Data and system inventory (314.4(c)(2)) | Identify and manage the data, people, devices, systems and facilities that support the business, by importance |
| Encryption (314.4(c)(3)) | Encrypt customer information at rest and in transit over external networks. If that's infeasible, use compensating controls approved by the Qualified Individual |
| Secure development (314.4(c)(4)) | Secure coding practices for in-house apps, and a process to evaluate the security of third-party apps that handle customer information |
| Multi-factor authentication (314.4(c)(5)) | MFA for any individual accessing any information system, unless the Qualified Individual approves equivalent or stronger controls in writing |
| Secure disposal (314.4(c)(6)) | Dispose of customer information no later than two years after it was last used to serve that customer, unless there's a legal, business or feasibility reason to keep it. Review your retention policy periodically |
| Change management (314.4(c)(7)) | Documented procedures for making changes to systems |
| Monitoring and logging (314.4(c)(8)) | Log authorized users' activity and detect unauthorized access to, use of or tampering with customer information |
| Testing (314.4(d)) | Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months and after material changes |
| Training and staffing (314.4(e)) | Security awareness training for all staff, updated for the risks you've identified; qualified security personnel who keep their knowledge current |
| Service provider oversight (314.4(f)) | Choose capable providers, require safeguards in the contract, and reassess them periodically based on risk |
| Program adjustment (314.4(g)) | Update the program after testing results, risk assessments and material business changes |
| Written incident response plan (314.4(h)) | A plan covering seven required areas (listed below) |
| Annual report to the board (314.4(i)) | The Qualified Individual reports in writing, at least annually, to the board or equivalent, or to a senior officer if there's no board |
| FTC notification (314.4(j)) | Notify the FTC within 30 days of discovering a notification event involving 500 or more consumers |
Using a vCISO as your Qualified Individual
Most small lenders, dealers and tax firms don't employ a full-time security leader. The rule allows the Qualified Individual to work for a service provider such as a vCISO, on three conditions. You must:
- Keep responsibility for compliance with the rule yourself.
- Designate a senior member of your staff to direct and oversee the Qualified Individual.
- Require the provider to maintain an information security program that protects you in line with the rule.
As the FTC's business guide puts it, if you use a service provider, "the buck still stops with you."
Testing: continuous monitoring or pen test plus scans
Section 314.4(d)(2) gives you two routes. If you have effective continuous monitoring, or other systems that detect changes creating vulnerabilities on an ongoing basis, that satisfies the requirement. If not, you need:
- Annual penetration testing of your information systems, scoped each year based on the risks identified in your risk assessment.
- Vulnerability assessments at least every six months, including scans designed to find publicly known vulnerabilities, and again whenever there are material changes to your operations or circumstances that could materially affect your program.
Not sure which you need? See vulnerability scan vs penetration test.
What the incident response plan must cover
Section 314.4(h) requires a written plan addressing:
- The goals of the plan
- Internal processes for responding to a security event
- Clear roles, responsibilities and levels of decision-making authority
- External and internal communications and information sharing
- Requirements to fix identified weaknesses in systems and controls
- Documentation and reporting of security events and response activities
- Evaluating and revising the plan after a security event
An incident response retainer helps with items 3 and 4: you know in advance who you'll call and how fast they'll respond.
The FTC breach notification requirement
The FTC added breach reporting in an October 2023 amendment, effective May 13, 2024 (section 314.5). The essentials:
- What triggers it: a "notification event", meaning unauthorized acquisition of unencrypted customer information. Information counts as unencrypted if the encryption key was also accessed. Unauthorized access is presumed to mean acquisition unless you have reliable evidence it didn't happen.
- Threshold: at least 500 consumers.
- Deadline: as soon as possible and no later than 30 days after discovery. Discovery is the first day any employee, officer or other agent (other than the person committing the breach) knows about it.
- How: the online form on ftc.gov, giving your name and contact details, the types of information involved, the date or date range if known, the number of consumers affected, a general description, and whether law enforcement has asked for a delay in public notice.
The FTC's guide warns that your report may be made public. The threshold doesn't replace state breach-notification laws, which can apply separately.
The small-business exemption
Section 314.6 exempts financial institutions that maintain customer information on fewer than 5,000 consumers from four requirements:
- The written risk assessment (314.4(b)(1))
- Continuous monitoring or annual pen testing and six-monthly vulnerability assessments (314.4(d)(2))
- The written incident response plan (314.4(h))
- The Qualified Individual's annual written report to the board (314.4(i))
Everything else still applies, including the Qualified Individual, risk-based safeguards, MFA, encryption, training, vendor oversight and FTC breach notification. Count consumers, not just current customers: the threshold is based on the customer information you maintain.
Where smaller institutions usually fall short
- A program that exists only as a template. The FTC expects the written program to reflect your actual risks, systems and data.
- MFA gaps on dealer management systems, loan origination platforms, tax software, remote access and shared accounts. "Any individual accessing any information system" is broad.
- Keeping data forever. Old loan files, scanned IDs and tax returns create breach exposure and conflict with the two-year disposal rule.
- Unmanaged vendors. Software providers, IT support and document storage firms need contractual safeguards and periodic review. See our guide to vendor risk management.
- No evidence. If you can't show the risk assessment, test reports, training records and board report, it's hard to demonstrate compliance.
Evidence to keep
- The written information security program and the Qualified Individual's designation (plus the senior overseer, if outsourced)
- The current risk assessment and evidence it was revisited
- Penetration test and vulnerability scan reports, with remediation tracking (or monitoring evidence)
- MFA coverage, access review and encryption records
- Data retention and disposal records
- Training completion records
- Vendor contracts and assessments
- The incident response plan and the annual written board report
If you're also licensed in New York, you may be subject to NYDFS rules too. Compare with our NYDFS Part 500 checklist.
Frequently Asked Questions
Who has to comply with the FTC Safeguards Rule?
Non-bank financial institutions under FTC jurisdiction, such as mortgage lenders and brokers, payday lenders, finance companies, tax preparers, check cashers, collection agencies, non-SEC-registered investment advisers and most auto dealers that finance or lease vehicles.
Can a vCISO be the Qualified Individual under the Safeguards Rule?
Yes. The Qualified Individual can work for a service provider, but you keep responsibility for compliance, must name a senior staff member to direct and oversee them, and must require the provider to maintain a compliant security program.
Does the Safeguards Rule require penetration testing?
Unless you have effective continuous monitoring, yes: annual penetration testing plus vulnerability assessments at least every six months and after material changes. Firms with fewer than 5,000 consumers are exempt from this specific requirement.
When must a breach be reported to the FTC?
If unencrypted customer information of at least 500 consumers is acquired without authorization, notify the FTC through its online form as soon as possible and no later than 30 days after discovery. This has applied since May 13, 2024.
What does the small-business exemption cover?
Institutions with customer information on fewer than 5,000 consumers are exempt from the written risk assessment, continuous monitoring or pen testing, the written incident response plan and the annual board report. Every other element still applies.
Is MFA required under the FTC Safeguards Rule?
Yes. MFA is required for any individual accessing any information system, unless your Qualified Individual approves reasonably equivalent or more secure access controls in writing.
Need to meet the Safeguards Rule without hiring a full-time CISO? Defensible can act as your Qualified Individual, run the risk assessment and testing, and prepare the annual board report. Talk to our financial services team.
