FTC Safeguards Rule Compliance
Readiness for the FTC Safeguards Rule (16 CFR Part 314) for non-bank financial institutions: support for your Qualified Individual, a written risk assessment, MFA, encryption, monitoring, an incident response plan, the annual report to the board and a plan for the FTC breach notice.
Overview
If the FTC considers you a financial institution, the Safeguards Rule already applies. Most firms find out late.
The Gramm-Leach-Bliley Act's Safeguards Rule applies to financial institutions under the FTC's jurisdiction that are not overseen by another federal financial regulator. That is a wide group: the FTC's own examples include mortgage lenders and brokers, payday lenders and finance companies, tax preparation firms, collection agencies, credit counselors and other financial advisors, investment advisors not required to register with the SEC, check cashers and wire transferors, and auto dealers that offer financing or long-term leases. Many of these organizations do not think of themselves as financial institutions until a client, an insurer or the FTC asks.
The rule requires a written information security program with specific elements. A Qualified Individual oversees it, and a written risk assessment underpins it. The safeguards include access controls reviewed regularly, an inventory of where customer information lives, encryption in transit and at rest, multi-factor authentication for anyone accessing an information system, secure disposal, change management, and logging and monitoring of user activity. Systems must be continuously monitored, or tested through annual penetration testing and vulnerability assessments at least every six months. Staff are trained, service providers overseen, a written incident response plan kept, and the Qualified Individual reports in writing to the board at least once a year.
Since 2024 the rule has also required notifying the FTC within 30 days of discovering that unencrypted customer information about 500 or more consumers was acquired without authorization. We implement the technical controls through managed IT, write the program documents with you and keep the evidence current. Whether the rule applies to your organization, and how, is a legal question for your counsel; our work is readiness, not legal advice.
Capabilities
What's included
- Support for your Qualified IndividualTechnical support, reporting and documentation for the person who oversees your program, whether that is an employee or a service provider you designate.
- Written risk assessmentCustomer information, systems and threats assessed in writing, with criteria for rating risks and a decision recorded against each one, then reviewed periodically.
- Access controls and data inventoryWho can reach customer information, reviewed regularly, and a map of where that information is collected, stored and sent.
- MFA and encryptionMulti-factor authentication for anyone accessing your information systems, and customer information encrypted in transit and at rest, with any exception documented for your Qualified Individual to approve.
- Monitoring, logging and testingUser activity logged and monitored, continuous vulnerability scanning, and penetration testing coordinated with an independent tester where your approach calls for it.
- Incident response plan and FTC notificationA written plan covering roles, communications, remediation and documentation, including who prepares and submits a notification to the FTC.
- Training, vendor oversight and the annual reportStaff training with records, service providers' security reviewed, and the evidence your Qualified Individual needs for the written report to the board.
How It Works
Delivered through managed IT
MFA coverage, encryption status, patch levels, endpoint protection, access changes and backup results are recorded by our management platform and the services that run on it, so most of the evidence a Safeguards Rule program needs is produced by running the systems. The program documents, the risk assessment and the incident response plan are written with you and reviewed whenever your business changes.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
Does the FTC Safeguards Rule apply to our firm?
If the FTC treats you as a financial institution and no other federal financial regulator oversees you, it most likely does. The FTC names tax preparation firms, mortgage lenders and brokers, finance companies, collection agencies, investment advisors not registered with the SEC and auto dealers that offer financing or long-term leases among its examples. Coverage turns on the services you provide, so confirm it with your counsel. If you are covered, we help you meet the requirements.
Who can be the Qualified Individual?
The rule allows the Qualified Individual to be employed by you, an affiliate or a service provider. If you use a service provider or affiliate, your organization keeps responsibility for compliance and must designate a senior member of staff to direct and oversee them. Most organizations name someone internal, such as an operations or compliance lead, and we act as the technical team that runs the controls and produces the reports they need.
We have fewer than 5,000 customers. Are we exempt?
Partly. Institutions that keep customer information on fewer than five thousand consumers are exempt from four provisions: the written risk assessment, the specific continuous-monitoring or penetration-testing requirement, the written incident response plan and the annual written report to the board. Everything else still applies, including MFA, encryption, access controls, training and service provider oversight. Many firms keep the written documents anyway, because insurers and clients ask for them.
What must we report to the FTC after a breach?
If unencrypted customer information about at least 500 consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovering it, using the FTC's online form. The notice includes details such as the types of information involved and the number of consumers affected. Your incident response plan should say who decides, who drafts the notice and who submits it.
Do we need penetration testing?
The rule requires either effective continuous monitoring of your information systems, or annual penetration testing plus vulnerability assessments at least every six months and after material changes. Our managed services provide continuous vulnerability scanning and monitoring; whether that meets the bar for your environment is a judgment your Qualified Individual documents. Where you choose the testing route, we coordinate an independent penetration tester and fix what they find.
Can you confirm that we comply with the rule?
Nobody issues a Safeguards Rule certificate, and we do not sign statements that you comply. What we do is implement the controls, write the program documents with you, collect the evidence and give your Qualified Individual what they need to report to your board. That record is what the FTC, an insurer or a client will want to see if they ask how you protect customer information.
References
Standards referenced
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business, or email contact@atlasbm.net.