The FTC Safeguards Rule Applies to More Businesses Than Think It Does

The FTC's Safeguards Rule requires covered businesses to maintain a written information security programme. Most of the businesses it covers do not think of themselves as financial institutions, and a good number do not know the rule applies to them at all.

This is an overview of who is covered and what the rule actually requires. It is not legal advice — scope questions in particular are worth asking a lawyer about.

Who is covered

The rule applies to "financial institutions" under a definition far broader than banks. It reaches businesses significantly engaged in activities financial in nature, which has been interpreted to include:

• Automobile dealers that arrange financing or leasing
• Tax preparers and accountants providing certain services
• Mortgage brokers and lenders
• Payday lenders and check cashers
• Debt collectors
• Investment advisers not registered with the SEC
• Real estate appraisers
• Businesses offering instalment plans or arranging credit for customers
• Career counsellors serving people in financial fields
• Wire transfer services and courier services for financial documents

If your business touches consumer financial information in the course of extending credit, arranging it, or servicing it, do not assume you are out of scope.

There is a partial exemption for businesses holding information on fewer than 5,000 consumers — they are relieved of some requirements, notably the written risk assessment, the incident response plan and the annual report to the board. The core obligations still apply.

The nine required elements

1. Designate a Qualified Individual

One named person responsible for the security programme. They do not have to be an employee — the role can be filled by a service provider — but if it is outsourced, you must designate a senior employee to oversee them, and accountability stays with you.

2. Conduct a written risk assessment

Documented, periodic, identifying reasonably foreseeable internal and external risks to customer information. It must assess the sufficiency of your existing safeguards and state criteria for evaluating risks.

The written part matters: an informal understanding of your risks is not a risk assessment.

3. Implement safeguards to control the identified risks

Specifically named in the rule:

• Access controls — who can reach customer information, reviewed periodically
• Inventory of data, personnel, devices, systems and facilities
• Encryption of customer information at rest and in transit. Where encryption is infeasible, compensating controls approved in writing by the Qualified Individual
• Secure development practices for applications you build
• Multi-factor authentication for anyone accessing any information system — this is explicit and broad
• Secure disposal of customer information no longer needed, generally within two years of last use
• Change management procedures
• Monitoring and logging of authorised user activity, to detect unauthorised access

4. Test and monitor effectiveness

Either continuous monitoring, or annual penetration testing plus biannual vulnerability assessments. If you do not have continuous monitoring, the testing cadence is specified, not suggested.

5. Train your people

Security awareness training for staff, and ensuring security personnel maintain current knowledge.

6. Oversee service providers

Select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them. This is the element most often missed — the obligation to assess is ongoing, not a one-time selection.

7. Keep the programme current

Update it as your business, your risks and your technology change.

8. Have a written incident response plan

Covering goals, internal processes, roles and responsibilities, communications, remediation, documentation, and post-incident revision.

9. Report to the board annually

A written report from the Qualified Individual on the programme's status, risk assessment results, service provider arrangements, testing results, security events and recommended changes. Where there is no board, it goes to a senior officer.

The breach notification requirement

Separately from the programme requirements, covered businesses must notify the FTC of a security event involving the unencrypted customer information of 500 or more consumers, as soon as possible and no later than 30 days after discovery.

Thirty days is short. It is not enough time to work out who to tell and how if the first conversation about it happens after the incident.

Where businesses actually fall short

In our experience the gaps cluster:

• MFA is partial. Deployed for email but not for the line-of-business system holding the actual customer data.
• Encryption at rest is assumed. Full-disk encryption on laptops does not cover a database on a server, a backup drive, or a file share.
• Service provider oversight has never happened. Providers were selected; nobody assessed them after.
• Disposal is not implemented. Customer records from a decade ago are still in the system because nobody built a deletion process.
• The risk assessment is a template with the business name changed.
• No written incident response plan, or one that has never been tested.

A sensible starting sequence

1. Determine whether you are covered, and whether the under-5,000 exemption applies. Ask a lawyer if it is not obvious.
2. Designate the Qualified Individual, in writing.
3. Inventory where customer information actually lives — including spreadsheets, email and third-party systems.
4. Deploy MFA everywhere it is missing, starting with whatever holds the customer data.
5. Write the risk assessment against that inventory.
6. Close the gaps it identifies, in risk order.
7. Write the incident response plan and run a tabletop exercise against it.
8. Build the service provider list, check contracts for security terms, and schedule assessments.
9. Set the testing cadence and book it.
10. Write the annual report.

Most of this is work you would want to do anyway. The rule's contribution is making it specific, written, and someone's named responsibility — which is usually what was missing.