FTC Safeguards Rule compliance for non-bank financial businesses
Auto dealerships, mortgage brokers, consumer lenders, tax preparers, and many other businesses that handle customer financial information are covered by the FTC Safeguards Rule. It requires a written information security program with specific controls — and, since May 2024, reporting certain breaches to the FTC within 30 days.
What the rule requires
Key elements of the Safeguards Rule information security program:
- A designated Qualified Individual to oversee the program
- A written risk assessment
- Access controls and a data and systems inventory
- Encryption of customer information in transit and at rest
- Multi-factor authentication for anyone accessing customer information
- Continuous monitoring or annual penetration testing with vulnerability assessments every six months
- Security awareness training and service provider oversight
- A written incident response plan
- An annual written report to the board or senior leadership
- FTC notification within 30 days for breaches affecting 500+ consumers
A program sized for your business
We build the program with you, not just the paperwork: the risk assessment, technical controls, penetration testing, and the annual report. For businesses without a security leader, our vCISO service can serve as your Qualified Individual support.
A note on independence: we prepare you for compliance and strengthen the controls behind it. We are not a law firm, CPA firm, QSA, or C3PAO, and we don’t issue certifications or attestation reports — we’re glad to work alongside the counsel and assessors who do.
Does the FTC Safeguards Rule apply to my business?
It applies to non-bank “financial institutions” under the Gramm-Leach-Bliley Act, a broad category that includes auto dealers that offer financing, mortgage brokers, payday lenders, finance companies, tax preparers, and certain other businesses significantly engaged in financial activities. Your counsel can confirm applicability.
When do we have to notify the FTC of a breach?
Covered businesses must notify the FTC as soon as possible and no later than 30 days after discovering a “notification event” involving unencrypted information of at least 500 consumers.
Are there exemptions for small businesses?
Businesses that maintain customer information on fewer than 5,000 consumers are exempt from certain requirements, such as the written risk assessment, penetration testing, and the annual board report, but not from the rule as a whole.
Find your gaps before someone else does.
Talk directly with a senior security practitioner about where you’re exposed and what to fix first — no sales script, no obligation.