FTC Safeguards Rule

Don’t wait to find out that you don’t comply!

The FTC Safeguards Rule was enacted to help protect consumer data for anyone who collects personally identifiable information for the purpose of making a financial transaction. If this data gets lost or stolen due to a breach, the penalties are huge and accumulate every day until you are compliant. Don’t let non-compliance ruin your reputation and your business.

What is the FTC Safeguards Rule?

The FTC Safeguards Rule is part of the Gramm-Leach-Bliley (GLB) Act, which is designed to ensure the security and confidentiality of customer information held by financial institutions listed on the right.

The Safeguards Rule applies to organizations that are considered “financial institutions” under the GLB Act, including those involved in lending, brokering, and servicing loans, as well as providing financial advice or credit reports.

Under the Safeguards Rule, newly defined financial institutions must implement a comprehensive information security program to protect customer information from unauthorized access, alteration, disclosure, or destruction.

This program must be tailored to the organization’s specific size, complexity, and the nature of its activities.

Unlock the Door to Trusted Customer Relationships!

Trust is the foundation of customer relationships. Achieving FTC Safeguards Rule compliance is a step towards building that trust. Act now to protect your customers’ information and your business’s integrity.

Who's Impacted by the Rule?

The Rule applies to businesses based on their activities, not their categorization. Section 314.2(h) of the Rule enumerates examples of entities considered as financial institutions, including:

CMMC, FTC Safeguards Rule, HIPAA

The Hidden Cost of Reactive Compliance

CMMC, FTC Safeguards Rule, HIPAA

Compliance Fatigue Is Real: How to Simplify Without Cutting Corners

FTC Safeguards Rule

What Is The Goal of the FTC Safeguards Rule?

Achieving Compliance with Kyber Security

At Kyber Security, we understand the challenges businesses face when trying to implement a comprehensive information security program in compliance with the FTC Safeguards Rule. Our team of experts can help you navigate the complexities of the rule, assess your organization’s risks, and develop a tailored security program that meets the regulatory requirements.

Our Services

Risk Assessment

We perform a thorough assessment of your organization’s current cybersecurity posture, identifying potential risks and vulnerabilities that could lead to unauthorized access, disclosure, or destruction of customer information.

Security Policy Development

We help you develop and implement security policies that align with the requirements of the FTC Safeguards Rule and other applicable regulations. These policies will serve as the foundation for your information security program.

Incident Response Planning

We help you develop a comprehensive incident response plan that outlines the steps your organization must take in the event of a security breach, ensuring a swift and effective response to minimize potential damage.

Continuous Monitoring & Improvement

Our team of experts provides ongoing support and guidance, ensuring your information security program remains up-to-date and effective in the face of evolving threats

Who Is Subject to the FTC Safeguards Rule

The FTC Safeguards Rule (16 CFR Part 314) applies to any organization that qualifies as a “financial institution” under the Gramm-Leach-Bliley Act (GLBA). The FTC’s definition of financial institution is broader than most businesses expect.

Covered organizations include:

Auto dealerships that arrange or facilitate financing, leasing, or insurance — even if they refer customers to third-party lenders
Mortgage brokers and lenders, including independent brokers and small mortgage companies
Tax preparers and accounting firms that handle consumer financial data as part of tax preparation or financial advisory services
Financial advisors and investment advisors registered with state agencies (not SEC-registered RIAs, which are covered by the SEC’s own Safeguards Rule)
Insurance companies and brokers not subject to state insurance regulators’ information security laws that meet the GLBA standard
Payday lenders and check cashers
Retailers that offer store credit or financing
Real estate settlement service providers that handle non-public personal financial information

If your business collects, stores, or transmits non-public personal financial information about consumers — and you fit within any of the above categories — the FTC Safeguards Rule applies to you. The rule covers both digital and paper records.

The 9 Required Elements of an FTC-Compliant Information Security Program

The updated FTC Safeguards Rule (effective June 9, 2023) requires covered financial institutions to implement a written information security program containing nine specific elements:

Qualified Individual (QI). Designate a single individual responsible for overseeing your information security program. The QI must report to the board or senior management at least annually. For small businesses, the QI can be an outside service provider — such as a vCISO — as long as the designation is documented.
Risk Assessment. Conduct a written risk assessment that identifies reasonably foreseeable threats to customer information, assesses the likelihood and impact of those threats, and describes current safeguards and their adequacy. The assessment must be reviewed and updated when material changes occur.
Safeguards implementation. Design and implement safeguards to control the risks identified in your assessment. Required safeguards include: access controls (limiting who can access customer information), data inventory (knowing where customer information is stored and how it flows through your organization), encryption of customer information at rest and in transit, multi-factor authentication for any system containing customer information, and secure development practices for in-house applications.
Regular monitoring and testing. Continuously monitor safeguards for effectiveness. Conduct annual penetration testing and bi-annual vulnerability scanning by qualified professionals. Review results and remediate findings.
Staff training. Train employees on the information security program and their role in protecting customer data. Training must be updated to reflect new threats and be documented.
Service provider oversight. Select and retain service providers that maintain appropriate safeguards. Require contractual security standards from all vendors that access customer information. Periodically review service provider security practices.
Program updates. Keep the information security program current. Evaluate and update it in response to material changes in business operations, new threats identified through monitoring, or findings from testing and audits.
Incident response plan. Create a written incident response plan covering: the goals of the plan, internal processes for responding to a security event, roles and responsibilities, external and internal communications, remediation steps, documentation and reporting requirements, and post-incident review procedures.
Board reporting. Report to the board of directors (or senior officer if no formal board) at least annually. The report must cover the overall status of the information security program, material matters, risk assessment results, testing results, significant service provider arrangements, and any cybersecurity events in the past year.

Breach notification requirement (added in 2023): If a security breach affects 500 or more consumers, you must notify the FTC within 30 days of discovering the breach. Notification must include the name and contact information of the institution, a description of the types of information involved, the date range of the breach, and the number of customers affected.

Common FTC Safeguards Compliance Failures

FTC enforcement actions and pre-audit assessments reveal the same failures repeatedly across covered institutions in Connecticut and Rhode Island:

No Qualified Individual on record. Many small businesses lack a documented QI designation. Without one, the entire information security program is ungoverned — and unverifiable in an FTC examination.
Missing written risk assessment. A verbal understanding of your risks is not a risk assessment. The Safeguards Rule requires a documented, written assessment. Without it, there is no defensible basis for your safeguard choices.
No multi-factor authentication. MFA is now required for all systems that access or store customer financial information. Single-factor authentication — even strong passwords — does not satisfy the rule.
Customer data stored on personal devices. Employees using personal laptops or phones for work-related access to customer data creates uncontrolled exposure. Mobile device management and clear BYOD policies are required safeguards under the data inventory and access control elements.
No penetration testing or vulnerability scanning schedule. Annual pen testing and semi-annual vulnerability scans are required, not optional. Many covered institutions have never conducted either.
No incident response plan. A policy document that says “we will respond to incidents” is not an incident response plan. The FTC requires a written plan with specific procedures, communication protocols, and assigned roles.
Service providers not vetted. If your CPA software, payroll system, or cloud storage vendor can access customer financial data, you are required to assess their security practices and include data protection obligations in your contracts.
No annual board report. The QI must formally report to the board at least annually. A casual conversation or email does not constitute a compliant board report — the report and the board’s receipt of it must be documented.

How Kyber Security Delivers FTC Safeguards Compliance

Kyber Security works with auto dealerships, tax preparers, financial advisors, mortgage brokers, and other covered institutions across Connecticut and Rhode Island to build and maintain FTC Safeguards-compliant programs.

Qualified Individual (vCISO) Services
We serve as your designated Qualified Individual — the individual responsible for overseeing your information security program. Kyber provides the QI designation documentation, annual board reporting, and ongoing program oversight. You get executive-level cybersecurity leadership without a full-time hire.

Written Risk Assessment
We conduct a comprehensive risk assessment against the FTC Safeguards Rule requirements: identifying threats to your customer information, assessing likelihood and impact, evaluating your current safeguards, and producing a written report you can present to the FTC if examined. The assessment covers both technical and operational risks.

Information Security Program Development
We build your written information security program — the governing document the FTC expects to see. The program documents all nine required elements, assigns ownership, and sets review cadences. It is written to withstand regulatory scrutiny, not just satisfy an internal checklist.

Technical Safeguard Implementation
We implement the technical controls required by the rule: multi-factor authentication, access controls, endpoint encryption, network segmentation, and audit logging. We also deploy and manage monitoring tools to satisfy the continuous monitoring requirement.

Penetration Testing and Vulnerability Scanning
We conduct the annual penetration test and semi-annual vulnerability scans required by the updated rule. Findings are documented, prioritized by risk, and remediated — producing the records needed to demonstrate an active, tested security program.

Incident Response Plan
We develop your written incident response plan with defined roles, communication procedures, containment steps, and the 30-day FTC notification workflow required for breaches affecting 500 or more consumers.

Service Provider Security Reviews
We assess your key vendors’ security practices, identify gaps, and help you incorporate appropriate data protection language into vendor contracts — satisfying the Safeguards Rule’s third-party oversight requirement.

Frequently Asked Questions

What is the FTC Safeguards Rule and when did it take effect?

The FTC Safeguards Rule (16 CFR Part 314) is a regulation under the Gramm-Leach-Bliley Act (GLBA) that requires covered financial institutions to develop, implement, and maintain a written information security program to protect customer financial information. The original rule took effect in 2003. The FTC issued a significantly updated rule in 2021, with most provisions taking effect June 9, 2023. Key additions in the 2023 update include multi-factor authentication requirements, mandatory penetration testing and vulnerability scanning, a Qualified Individual designation, incident response plan requirements, and a 30-day FTC breach notification obligation for breaches affecting 500 or more consumers.

Does the FTC Safeguards Rule apply to my auto dealership?

Yes, in most cases. Auto dealerships that arrange or facilitate financing — including those that refer customers to third-party lenders, offer leasing, or facilitate credit applications — qualify as financial institutions under GLBA and are subject to the FTC Safeguards Rule. The FTC has specifically identified auto dealers as a primary enforcement focus. Dealerships must have a designated Qualified Individual, a written risk assessment, multi-factor authentication on any system containing customer financial data, a written incident response plan, and documented annual board reporting.

What are the penalties for violating the FTC Safeguards Rule?

The FTC can seek civil penalties of up to $51,744 per violation per day under Section 5 of the FTC Act (this amount is adjusted annually for inflation). Beyond financial penalties, FTC enforcement actions typically include mandatory injunctions requiring covered institutions to implement a comprehensive information security program under FTC oversight for 20 years, with biennial third-party assessments. Enforcement actions are public record and can severely damage a business’s reputation with customers and counterparties.

What is a Qualified Individual under the FTC Safeguards Rule?

A Qualified Individual (QI) is the person your organization designates as responsible for overseeing and implementing your information security program. The QI must have the knowledge and experience to manage an information security program — or must retain outside experts to fill that capability. The QI must report to your board of directors or a senior officer at least annually on the status of the program. Kyber Security provides outsourced QI services through our vCISO offering, allowing you to satisfy the designation requirement without a full-time internal hire.

Is multi-factor authentication required under the FTC Safeguards Rule?

Yes. Multi-factor authentication is explicitly required for any individual accessing any information system containing customer financial information, unless you have documented compensating controls in your risk assessment that provide equivalent protection. The rule does not accept password-only authentication as adequate for these systems. MFA must be implemented on email, remote access, cloud storage, financial software, and any other platform where customer data is accessible.

What does annual penetration testing mean for a small business?

The FTC Safeguards Rule requires covered institutions to conduct penetration testing at least annually and vulnerability assessments at least every six months. Penetration testing must be performed by a qualified professional — in-house staff or a qualified third party — who actively attempts to exploit vulnerabilities in your systems to identify weaknesses before attackers do. Vulnerability scanning uses automated tools to identify known weaknesses. Both the testing and remediation of findings must be documented. Kyber Security conducts both services for covered institutions in Connecticut and Rhode Island.

What happens if I have a data breach? Do I need to notify the FTC?

If a security breach affects 500 or more consumers, the FTC Safeguards Rule (as amended in 2023) requires you to notify the FTC within 30 days of discovering the breach. Notification is submitted through the FTC’s online reporting portal. The notification must include your institution’s name and contact information, a description of the types of information involved, the approximate date range of the breach, the number of customers affected (or an approximation), a general description of the event, and whether law enforcement has requested a delay in notification. Separately, state breach notification laws in Connecticut and Rhode Island have their own requirements — Kyber’s incident response planning covers both federal and state obligations.