FTC Safeguards Rule: Small Business IT Requirements

The FTC Safeguards Rule (16 CFR Part 314) requires non-bank “financial institutions”, a group that includes tax preparers, mortgage brokers, finance companies, and auto dealers that arrange financing, to keep a written information security program. The program must include a named person in charge, a risk assessment, multi-factor authentication, encryption, staff training, vendor oversight, and secure disposal of old records. Firms holding information on fewer than 5,000 consumers are excused from four documentation and testing items, and from nothing else.

This is general information, not legal advice; an attorney or compliance adviser should confirm how the rule applies to your firm.

Does the Safeguards Rule Apply to Your Business?

The rule comes from the Gramm-Leach-Bliley Act (GLBA). It applies to financial institutions under the Federal Trade Commission’s jurisdiction, meaning companies engaged in financial activities that are not supervised by another GLBA regulator. The FTC stresses that what matters is the activity your business performs, not how you label it.

Businesses the FTC Names

The rule’s scope and definitions and the FTC’s guidance list these examples:

• Tax preparation firms, including an accountant in the business of completing income tax returns
• Mortgage lenders and mortgage brokers
• Payday lenders and finance companies
• Auto dealers that finance, help arrange financing, or lease vehicles for longer than 90 days (the FTC publishes a dealer FAQ)
• Collection agencies, check cashers, and wire transfer businesses
• Credit counselors and other financial advisors
• Investment advisors that are not required to register with the SEC
• Real estate settlement service providers and personal property or real estate appraisers
• Retailers that issue their own credit cards directly to consumers
• “Finders” that bring together buyers and sellers of a financial product
• Credit unions that are not federally insured

Businesses That Usually Fall Under a Different Rule

The FTC’s rule covers only institutions that are not subject to another regulator under GLBA section 505. Banks answer to banking regulators, SEC-registered investment advisers and broker-dealers answer to the SEC, and insurance companies and agents answer to state insurance regulators. Those regulators have their own safeguards requirements, so being outside the FTC’s rule does not mean having no rule.

Businesses That Are Not Financial Institutions

The regulation also gives counterexamples. A retailer that only accepts credit cards issued by others, lets a customer run a tab, or occasionally allows layaway is not a financial institution because of those activities.

A Quick Self-Test

1. Do you provide a financial product or service to consumers, such as tax preparation, lending, loan brokering, financing, or financial advice?
2. In doing so, do you receive nonpublic personal information, such as Social Security numbers, income, account numbers, or credit history?
3. Are you outside the supervision of a banking regulator, the SEC, or a state insurance regulator for that activity?

Three yes answers mean you should treat the rule as applying and confirm with counsel. Tax professionals get a second reminder from the IRS, which states that federal law requires them to maintain a written information security plan.

What Does the Rule Require?

The amended rule took full effect on June 9, 2023. Section 314.4 sets out nine elements of the security program:

1. Designate a Qualified Individual to run the program. This can be an employee or an outside provider. The FTC says no particular degree or title is required. If you use an outside provider, someone senior inside the firm must still oversee them, and the firm stays responsible.
2. Conduct a risk assessment that identifies foreseeable internal and external risks to customer information and evaluates your safeguards against them.
3. Implement safeguards to control those risks. The rule lists eight specific ones, covered below.
4. Test and monitor. Either continuous monitoring of your systems, or annual penetration testing plus vulnerability assessments at least every six months.
5. Train staff in security awareness, and keep the training current.
6. Oversee service providers. Choose vendors capable of protecting the data, put security expectations in the contract, and reassess them periodically.
7. Keep the program current as your business, systems, and threats change.
8. Write an incident response plan covering goals, roles, internal processes, communications, remediation, documentation, and post-incident review.
9. Report to the board or, if there is no board, a senior officer, in writing at least once per year.

The Eight Required Safeguards

Safeguard	What the rule says	What it looks like in a small office
Access controls	Limit access to authorized users and only to what they need; review periodically	Individual accounts, role-based folder and software permissions, a quarterly access review
Data inventory	Know what data, devices, systems, and people you have	A maintained list of computers, cloud services, and where customer files live
Encryption	Encrypt customer information at rest and in transit over external networks	BitLocker or FileVault on every computer, encrypted backups, encrypted email or a secure portal for documents
Application security	Assess the security of apps you build or buy	Review the security documentation of your tax, loan, or dealer management software
Multi-factor authentication	Required for any individual accessing any information system	MFA on email, tax or loan software, remote access, cloud storage, and administrator accounts
Secure disposal	Dispose of customer information no later than two years after last use, unless retention is required or necessary	A written retention schedule and certified wiping of old drives
Change management	Evaluate security when systems change	A short checklist before adding software, vendors, or network equipment
Logging and monitoring	Log authorized user activity and detect unauthorized access	Audit logging turned on in Microsoft 365 or Google Workspace and in line-of-business software, with alerts reviewed

For encryption and MFA, the rule allows the Qualified Individual to approve an effective alternative control in writing when the standard control is not feasible. The rule defines MFA as at least two of: something you know (a password), something you have (a token or phone app), and something you are (a fingerprint or face).

What Does the Under-5,000-Consumer Exemption Cover?

Section 314.6 says four provisions do not apply to a financial institution that maintains customer information concerning fewer than 5,000 consumers:

Exempt for small firms	Still required for small firms
Putting the risk assessment in writing, 314.4(b)(1)	Conducting a risk assessment
Continuous monitoring, or annual penetration testing with six-month vulnerability assessments, 314.4(d)(2)	Regularly testing or monitoring that safeguards work
A written incident response plan, 314.4(h)	A Qualified Individual and a written security program
The annual written report to the board, 314.4(i)	MFA, encryption, access controls, inventory, disposal, change management, and logging
	Staff training and service provider oversight

Two practical notes. The count is of consumers whose information you maintain, which includes former customers still in your files, so a firm that has kept many seasons of tax returns may hold more than it thinks. And several of the exempt items are inexpensive and useful regardless: a written risk assessment and a short incident response plan are what an insurer, a regulator, or a business partner will ask to see first.

When Must a Breach Be Reported to the FTC?

Since May 13, 2024, a covered institution must notify the FTC as soon as possible, and no later than 30 days after discovery, of a “notification event”: unauthorized acquisition of unencrypted customer information involving at least 500 consumers. Encrypted data counts as unencrypted if the encryption key was also accessed. The report is made through an online form on the FTC’s website and may be made public.

This report is in addition to state law. California’s breach notification statute has its own 30-day deadline for notifying affected residents. Our guide on what to do after a data breach walks through the response steps.

IT Controls Checklist

Use this to see where a small firm stands. Each line maps to a requirement above.

• A named Qualified Individual, and a named internal overseer if that person is an outside provider
• A risk assessment listing where customer information lives: email, tax or loan software, cloud storage, laptops, scanners and copiers, backups, paper
• MFA enforced on every account that can reach customer information (see how MFA works and how to roll it out)
• Full-disk encryption verified on every laptop and desktop
• An encrypted method for exchanging documents with customers, such as a portal or encrypted email
• Individual logins everywhere, no shared accounts, and permissions matched to job roles
• Departing staff removed from all systems on their last day
• Automatic security updates on all devices and a routine for firewalls and network gear (patch management guide)
• Audit logging enabled and retained
• Encrypted, tested backups (backup guide)
• A retention schedule that applies the two-year disposal rule, with legal retention periods noted
• Security awareness training on a schedule, with attendance recorded (training guide)
• A list of service providers that touch customer information, with contract security terms on file
• An incident response plan that includes the FTC’s 30-day report and state notification deadlines

Common Mistakes

• Reading the exemption as a full pass. It removes four items. MFA, encryption, training, and vendor oversight remain.
• Appointing a Qualified Individual in name only. The role carries real duties: running the program and, for larger firms, reporting annually in writing.
• Treating the vendor’s security as your own. Cloud tax or loan software protects its own servers. Your logins, laptops, email, and exported files are your responsibility.
• Keeping everything forever. The rule sets an outer limit of two years after last use unless you have a documented reason to keep the information longer.
• Counting only active customers toward the 5,000 figure.

Common Questions

Does the Safeguards Rule apply to a one-office tax preparer?

Yes, if the firm is in the business of completing income tax returns. The regulation names that activity as an example of a financial institution, and the IRS reminds tax professionals that federal law requires a written information security plan. A firm with information on fewer than 5,000 consumers is excused from four specific provisions and remains subject to the rest.

Are insurance agents covered by the FTC rule?

Usually not by the FTC’s version. GLBA assigns insurance companies and agents to state insurance regulators, and the FTC rule covers only institutions not subject to another GLBA regulator. State insurance rules impose their own information security requirements, so an agency should check with its regulator or counsel about which standard applies.

Is MFA required even for very small firms?

Yes. The exemption for firms under 5,000 consumers does not include the MFA requirement. The rule requires MFA for any individual accessing any information system, unless the Qualified Individual approves a reasonably equivalent or more secure control in writing.

Who can serve as the Qualified Individual?

An employee, an affiliate, or an outside service provider. The FTC says the person needs practical knowledge suited to your circumstances, not a specific credential. When the role is outsourced, the firm must designate a senior person to direct and oversee the provider, and the firm keeps responsibility for compliance.

How Coastal Growth Co. Can Help

We set up and document the technical safeguards in the rule: MFA, device and backup encryption, access reviews, logging, patching, secure document exchange, and device disposal. We can also prepare the system inventory that a risk assessment starts from. Your attorney or compliance adviser decides what the rule requires of your firm. See IT support for legal and accounting offices or our managed IT services, and contact us to describe what you need.