FTC Safeguards Rule Now Applies to You

There is a federal information security regulation that has applied to accountants, mortgage brokers, financial advisors and several adjacent professions since June 2023. In my experience most owners in those fields have never read it, and a good number have never heard of it. It sits under the Gramm-Leach-Bliley Act, the FTC enforces it, and it is called the Safeguards Rule.

Who the rule covers

The reason it catches people out is the definition. The rule applies to businesses engaged in activities that are financial in nature, which is a much wider category than the word “bank” suggests. The FTC’s own list of covered examples includes accountants, tax preparation firms, mortgage brokers and lenders, collection agencies, credit counselors and other financial advisors, investment advisors not required to register with the SEC, account servicers, and auto dealers that arrange financing. An owner who has never once described his firm as a financial institution can still be squarely inside the scope.

What it requires

The core requirement is a written information security program appropriate to the size and complexity of the business. Underneath that sit the specific obligations that became enforceable on June 9, 2023:

• A designated Qualified Individual accountable for the security program.
• A written risk assessment identifying where customer information lives and what threatens it.
• Multi-factor authentication for anyone accessing customer information.
• Encryption of customer information in transit and at rest.
• A written incident response plan.
• Staff training and oversight of service providers that handle your data.

The rule defines those safeguards broadly, covering the administrative, technical, and physical measures a business uses to access, collect, process, store, transmit, or dispose of customer information, under Section 314.2(i). In practice that shows up as specific, checkable line items. Security Awareness Training for staff falls directly under Section 314.4(e)(1). Bringing in a service provider to help manage information security risk falls under Section 314.4(e)(2). Staying current on how threats and countermeasures are changing falls under Section 314.4(e)(4). None of those are optional extras. They are the same regulation the rest of this list comes from.

In May 2024 a further requirement took effect. If a security event involves unencrypted information of 500 or more consumers, the business must notify the FTC within 30 days of discovery through a form on the FTC’s website. That filing becomes part of the public record.

The small-firm exemption

There is a small-firm exemption at Section 314.6, and it is frequently overstated. A business maintaining customer information on fewer than 5,000 consumers is relieved of 4 specific obligations: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report to the board. Everything else still applies, including the Qualified Individual, multi-factor authentication, encryption and the security program itself. The exemption counts consumer records, not clients, so a firm that processes payroll or handles files containing a client’s own customers can reach 5,000 faster than the headcount suggests.

What it costs

Penalties under the FTC Act reach $53,088 per violation. More common than a penalty, in the businesses I deal with, is the commercial cost: a cyber insurance renewal that requires attestation the firm cannot honestly give, or a larger client’s vendor questionnaire that stops a contract at procurement. That is usually how owners discover the rule exists, several years after it started applying to them.

If your firm handles client financial information, the practical step is to sit down with whoever runs your technology and go through the items above one at a time, establishing what is in place, what is documented, and what is neither.