Resources · FTC Safeguards Rule
A practical walk-through of who the Rule covers, the elements of a compliant information security program, the breach-reporting requirement, and where small firms get a lighter load.
Updated October 10, 2026 · About a 7-minute read
Who this guide is for
Owners and managers of mortgage brokers, finance and lending companies, tax preparation and accounting practices, collection agencies, investment advisers that are not registered with the SEC, and similar firms.
The Rule covers businesses that are significantly engaged in financial activities and fall under the FTC’s authority. The Rule’s own examples include mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors, tax preparers, non-federally insured credit unions, and investment advisers that aren’t registered with the SEC.
Businesses supervised by another regulator under the Gramm-Leach-Bliley Act (GLBA) — banks, SEC-registered firms, and insurance companies and agencies, whose GLBA obligations are enforced by state insurance regulators — follow their own regulator’s rules instead. Many of those rules ask for the same building blocks, so the program below is still a useful benchmark.
| Requirement | What it means in practice |
|---|---|
| Qualified Individual | One person responsible for the program. It can be an employee or an outside provider such as a virtual CISO; if outsourced, you stay responsible and a senior staff member oversees the provider. |
| Written risk assessment | Identify reasonably foreseeable internal and external risks to customer information and judge whether your safeguards are enough. Revisit it periodically. |
| Safeguards | Access controls, an inventory of data and systems, encryption in transit and at rest, secure development practices, multi-factor authentication for anyone accessing your systems, secure disposal, change management, and activity monitoring and logging. |
| Testing and monitoring | Continuous monitoring, or else annual penetration testing and vulnerability assessments at least every six months. |
| People | Security awareness training and qualified staff (or providers) to run the program. |
| Service providers | Choose capable vendors, require safeguards in your contracts, and check on them periodically. |
| Keep it current | Update the program as your business, technology, and risks change. |
| Incident response plan | A written plan covering goals, roles, communications, remediation, and lessons learned. |
| Annual report | The Qualified Individual reports in writing at least annually to your board or senior officer. |
| FTC notification | Report qualifying security events to the FTC (see below). |
A “notification event” is the acquisition of unencrypted customer information without the customer’s authorization. If it involves at least 500 consumers, you must notify the FTC through its online form as soon as possible and no later than 30 days after discovery. Information counts as unencrypted if the encryption key was also compromised.
Plan before you need it
Your incident response plan should name who decides whether an event is reportable and who files with the FTC, so the 30-day clock doesn’t start a scramble.
If you hold customer information on fewer than 5,000 consumers, the Rule exempts you from four requirements: the written risk assessment, continuous monitoring or annual penetration testing and six-month vulnerability scans, the written incident response plan, and the annual written report. Everything else — including the Qualified Individual, safeguards like MFA and encryption, training, vendor oversight, and FTC notification — still applies.
Yes. The Rule allows a service provider or affiliate to fill the role, but your business stays responsible for compliance and must assign a senior staff member to oversee it.
If you hold information on fewer than 5,000 consumers, the testing requirement in 314.4(d)(2) doesn’t apply to you. You still need to monitor and test your key controls in a way that fits your size.
No regulator issues a Safeguards Rule certification. We build and document the program, test it, and keep it current so you can show the FTC, your customers, or your insurer that it’s in place.
Readiness and program-build work is quoted as a fixed fee after a free scoping call; ongoing oversight can be included in Beacon or Lighthouse.
We can act as your Qualified Individual through our virtual CISO service, run the risk assessment, put the required safeguards in place, write the program and incident response plan, and keep everything current year to year — with the same specialist from scoping to close.
This guide is general information to help you plan, not legal advice. Confirm how a requirement applies to your business with your counsel, your contracting officer, or your regulator.
