Security and insurance
Does the FTC Safeguards Rule apply to my business?
The short answer
If your business handles customers' financial information, it may. The FTC defines "financial institution" broadly, well beyond banks, and the rule requires a written information security program built on a risk assessment, with controls like multi-factor authentication, encryption and access controls. Smaller firms are exempt from some provisions. If you are not sure whether it applies, it is worth checking.
Who does it cover?
Businesses the FTC treats as “financial institutions” because of what they do with customer financial data. That reaches well past banks and lenders. Our Safeguards Rule guide covers the categories in more detail.
What does it require?
A real information security program, not a binder. The rule as amended in 2021, with most requirements in force since June 2023, spells out a written risk assessment, encryption, MFA and access controls, either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months, a written incident response plan, and a qualified person who reports in writing at least annually to the board or equivalent governing body. Institutions that hold information on fewer than 5,000 consumers are exempt from four of those: the written risk assessment, the continuous-monitoring-or-penetration-testing requirement, the written incident response plan, and the annual written report. They still need the rest of the program, including regular checks that their safeguards work. The FTC’s own guide has the full list.
What do we usually find missing?
MFA that covers email but not everything else, no written risk assessment, no record of who has access to what, and an incident plan that lives in someone’s head. Each of those is fixable.
How do we find out where we stand?
Start with an assessment that maps your current controls to the rule. Our compliance services start from the CIS Critical Security Controls and layer on the rules that apply to you.