FTC Safeguards Rule: What It Requires and Who It Covers

Many business owners assume federal data security rules for "financial institutions" only apply to banks. They don't. The Federal Trade Commission's Safeguards Rule, issued under the Gramm-Leach-Bliley Act (GLBA), covers a wide range of businesses that offer financial products or services, from tax preparers and mortgage brokers to collection agencies and many car dealers.

The rule was significantly updated in recent years. It now spells out specific security controls, such as multi-factor authentication and encryption, and since May 2024 it has required covered businesses to report certain data breaches to the FTC within 30 days.

Who the FTC Safeguards Rule covers

The rule applies to financial institutions under the FTC's jurisdiction that aren't overseen by another federal financial regulator. The FTC uses a broad definition of financial institution, and the rule lists examples that include:

• mortgage lenders and mortgage brokers
• payday lenders and finance companies
• collection agencies
• tax preparation firms
• credit counselors and other financial advisors
• investment advisers that aren't required to register with the SEC

The FTC notes the list is not exhaustive, and it has published separate guidance for automobile dealers. If your business helps customers get credit, financing or other financial services, it is worth checking with your attorney whether the rule applies.

The rule protects customer information: non-public personal information about your customers, such as names tied to Social Security numbers, account numbers, income or credit details.

What the Safeguards Rule requires

The rule requires a written information security program built around nine elements:

1. A Qualified Individual. Designate one person to oversee the program. It can be an employee or someone from a service provider, but the business stays responsible and must have a senior staff member oversee an outside provider.
2. A written risk assessment. Identify reasonably foreseeable internal and external risks to customer information and evaluate the safeguards in place.
3. Safeguards to control those risks. The rule names specific safeguards, listed below.
4. Regular monitoring and testing. Either continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months and after material changes.
5. Staff training. Security awareness training for employees, plus qualified staff to run the program.
6. Service provider oversight. Choose providers that can protect customer information, require safeguards in your contracts, and periodically assess them.
7. Keeping the program current. Update it as your business, technology and risks change.
8. A written incident response plan. Roles, communications, remediation, and how events are documented and reported.
9. Reporting to leadership. The Qualified Individual reports in writing, at least annually, to the board or a senior officer on the program's status.

Safeguards the rule specifically requires

• access controls that limit customer information to people who need it
• an inventory of the data and systems you have and where they are
• encryption of customer information in transit over external networks and at rest (or alternative controls the Qualified Individual approves where encryption isn't feasible)
• multi-factor authentication for anyone accessing your information systems (or equivalent controls the Qualified Individual approves in writing)
• secure development practices for in-house applications, and a way to evaluate outside applications that handle customer information
• secure disposal of customer information no later than two years after it was last used to serve the customer, unless there is a legitimate business or legal need to keep it
• change management, and logging and monitoring of authorized users' activity

The FTC breach notification requirement

Since May 2024, a covered business must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event: unauthorized acquisition of unencrypted customer information involving at least 500 consumers. Encrypted data counts as unencrypted if the encryption key was also taken. Notice is filed through an online form on the FTC's website.

This is in addition to state law. In Texas, a breach of sensitive personal information also triggers notice to affected individuals within 60 days, and to the Texas Attorney General within 30 days when 250 or more Texans are affected. Our Texas data breach response guide covers those steps.

Relief for smaller businesses

A business that maintains customer information on fewer than 5,000 consumers is exempt from four requirements: the written risk assessment, continuous monitoring or annual penetration testing and vulnerability assessments, the written incident response plan, and the annual written report. Everything else, including MFA, encryption, training and service provider oversight, still applies.

Simple steps toward Safeguards Rule compliance

1. Confirm whether you're covered. List the financial products or services you offer, and talk with your attorney if you're unsure.
2. Name your Qualified Individual. If that's an outside IT provider, name the senior person in your business who oversees them.
3. Map your customer information. Know where it lives: line-of-business applications, email, file shares, scanned documents and cloud services.
4. Turn on MFA and encryption everywhere customer information is reachable. Our Microsoft 365 security guide covers MFA and related settings.
5. Write the risk assessment and program. Our cybersecurity assessment guide explains how to find and prioritize gaps.
6. Schedule testing. Put vulnerability scans and an annual penetration test on the calendar, or set up continuous monitoring.
7. Review your vendors. Check the contracts and security practices of every provider that touches customer information, including your IT provider. Our questions for your IT provider are a good start.
8. Write an incident response plan that includes the 30-day FTC notice and Texas deadlines.
9. Clean out old data. Securely dispose of customer information you no longer need.

Where to start

Start with the two items that do the most to prevent a reportable breach: multi-factor authentication on every system that holds customer information, and encryption of that data. Then put the program in writing so you can show what you've done.

HUFF DATA SYSTEMS supports financial services firms and professional services firms across Texas with security controls, documentation and ongoing monitoring. Our Texas cybersecurity compliance guide covers related state requirements. This article is general information, not legal advice; talk with your attorney about your specific obligations. If you would like help meeting the Safeguards Rule, talk with our team.

Sources

• FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission
• Standards for Safeguarding Customer Information (16 CFR Part 314), eCFR
• Safeguards Rule notification requirement now in effect, Federal Trade Commission
• Safeguards Rule Security Event Reporting Form, Federal Trade Commission
• Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions, Federal Trade Commission
• Texas Identity Theft Enforcement and Protection Act (Business & Commerce Code Chapter 521), Texas Legislature

More from The HUFF DATA SYSTEMS Brief →