FTC Safeguards Rule, 16 CFR Part 314
FTC Safeguards Rule compliance
We help financial institutions under the FTC's jurisdiction, from auto dealers and mortgage brokers to tax preparers, build the written information security program the Safeguards Rule requires and keep it current.
- Who it applies to
- Non-bank financial institutions under FTC jurisdiction
- Rule
- 16 CFR Part 314, under the Gramm-Leach-Bliley Act
- Enforced by
- Federal Trade Commission
- Breach notice
- To the FTC within 30 days for events involving at least 500 consumers
At a glance
The FTC Safeguards Rule, 16 CFR Part 314, requires non-bank financial institutions under the FTC's jurisdiction, including auto dealers that arrange financing, mortgage brokers and tax preparers, to run a written information security program. CyberAccord performs the written risk assessment, closes gaps in controls such as MFA and encryption, and supports the person who oversees your program.
Applicability
Who it applies to
Non-bank financial institutions under the FTC's jurisdiction, including mortgage lenders and brokers, finance companies, tax preparers and auto dealers that finance or lease vehicles.
Key dates
- In force
Most requirements of the amended rule took effect, after a six-month extension.
- In force
Duty to notify the FTC of notification events involving at least 500 consumers took effect (314.4(j)).
Readiness
The path to FTC Safeguards Rule readiness
- 1
Scope
We identify the customer information you hold, the systems and service providers that touch it, and whether the small-institution exemption applies.
- 2
Assess
We run the written risk assessment and compare your safeguards with each element of the rule.
- 3
Remediate and document
We help put missing controls in place and write the security program and incident response plan.
- 4
Test and report
We run the required testing and help your Qualified Individual prepare the annual report to the board.
Crosswalk
How FTC Safeguards Rule maps to other frameworks
The same control domains appear across frameworks under different clause numbers. Work done for one usually counts toward the others.
| Control domain | FTC Safeguards (this page)16 CFR 314 | SOC 2Trust Services Criteria | ISO 27001ISO/IEC 27001:2022 | PCI DSSv4.0.1 | NIST CSFCSF 2.0 | HIPAA45 CFR 164 Subpart C | NYDFS 50023 NYCRR 500 |
|---|---|---|---|---|---|---|---|
| Access control | 314.4(c)(1), (c)(5) | CC6.1–CC6.3 | A.5.15, A.5.18, A.8.5 | Req. 7, Req. 8 | PR.AA | 164.308(a)(4), 164.312(a)(1), 164.312(d) | 500.7, 500.12 |
| Logging and monitoring | 314.4(c)(8) | CC7.2 | A.8.15, A.8.16 | Req. 10 | DE.CM, DE.AE | 164.308(a)(1)(ii)(D), 164.312(b) | 500.6, 500.14(a)(1) |
| Incident response | 314.4(h), (j) | CC7.3–CC7.5 | A.5.24–A.5.28 | 12.10 | RS.MA, RS.AN, RS.CO, RS.MI, RC.RP | 164.308(a)(6) | 500.16, 500.17 |
| Vendor and third-party risk | 314.4(f) | CC9.2 | A.5.19–A.5.22 | 12.8 | GV.SC | 164.308(b)(1), 164.314(a) | 500.11 |
| Risk assessment | 314.4(b) | CC3.1–CC3.4 | Clauses 6.1.2, 8.2 | 12.3 (targeted risk analysis) | ID.RA | 164.308(a)(1)(ii)(A)–(B) | 500.9 |
| Encryption and data protection | 314.4(c)(3) | CC6.1, CC6.7 | A.8.24 | Req. 3, Req. 4 | PR.DS | 164.312(a)(2)(iv), 164.312(e)(1) | 500.15 |
| Change management | 314.4(c)(7) | CC8.1 | A.8.32 | 6.5 | ID.RA-07, PR.PS-01 | No specific provision | No specific provision |
| Security awareness training | 314.4(e) | CC2.2 | A.6.3 | 12.6 | PR.AT | 164.308(a)(5) | 500.14(a)(3) |
Domain-level mapping for orientation, not a control-by-control equivalence; an auditor or assessor decides whether evidence satisfies a specific requirement. A dash means the framework has no explicit provision for that domain.
Sources: AICPA Trust Services Criteria; NIST mapping of ISO/IEC 27001:2022 to CSF 2.0; PCI SSC document library; NIST CSF 2.0; 45 CFR Part 164 Subpart C; 23 NYCRR Part 500; 16 CFR 314.4.
Evidence
What auditors ask for
Typical requests at assessment time. We help you produce and organize each one before the assessor asks.
- Designation of the Qualified Individual
- Written risk assessment
- Written information security program
- Evidence of encryption and multi-factor authentication
- Penetration test and vulnerability assessment reports, or continuous monitoring records
- Security awareness training records
- Service provider contracts and oversight records
- Written incident response plan and the annual report to the board
Who must comply with the Safeguards Rule?
The rule applies to financial institutions under the FTC's jurisdiction that are not banks or credit unions. The FTC's guidance names mortgage lenders and brokers, payday lenders, finance companies, check cashers, collection agencies, credit counselors and tax preparers, among others.
Auto dealers are covered when they finance or arrange financing for customers, or lease vehicles for more than 90 days. Accounting and CPA firms that prepare tax returns should treat the rule as applying to that work and the customer information it involves.
What does the rule require?
Section 314.4 sets out the elements of a written information security program. The program has to fit your size, the complexity of your business and the sensitivity of the customer information you hold.
- A Qualified Individual who oversees and enforces the program
- A written risk assessment
- Safeguards including access controls, encryption of customer information in transit and at rest, and multi-factor authentication for anyone accessing an information system
- Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months
- Security awareness training for staff
- Oversight of service providers, including contract terms
- A written incident response plan
- A written report to the board, or to a senior officer if there is no board, at least annually
What changed in 2023 and 2024?
The FTC substantially expanded the rule in 2021. Most of the new requirements took effect on June 9, 2023, after a six-month extension.
A further amendment added a duty to notify the FTC, effective May 13, 2024. When unencrypted customer information of at least 500 consumers is acquired without authorization, notice is due as soon as possible and no later than 30 days after discovery.
Is there an exemption for small businesses?
Institutions that maintain customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, continuous monitoring or annual penetration testing and vulnerability assessments, the written incident response plan, and the annual written report to the board. The rest of the rule still applies.
What we do
We perform the risk assessment, compare your safeguards with each element of section 314.4 and give you a remediation plan ranked by risk. We write the information security program and incident response plan, help put MFA and encryption in place, and can run the penetration test and vulnerability assessments the rule calls for.
The Qualified Individual can work for you, an affiliate or a service provider. If you use an outside provider, you keep responsibility for compliance and must designate a senior staff member to oversee them. Our vCISO service can fill or support that role.
What you get
Written risk assessment
The risk assessment the rule requires, kept current as your business changes.
Format: PDF report
Gap assessment
Your safeguards against each element of 16 CFR 314.4.
Format: PDF report
Information security program
The written program, sized to your business.
Format: Policy set (Word)
Incident response plan
Includes the steps for notifying the FTC.
Format: Plan (Word)
Penetration test and vulnerability assessments
The testing the rule calls for, if you don't use continuous monitoring.
Format: PDF reports
Service provider oversight review
How you select, contract with and monitor providers.
Format: Memo
Annual board report support
For the Qualified Individual's annual written report.
Format: Report template + review
Services
Services that apply
- Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- Managed Security ServicesManaged SecurityManaged device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
Frameworks and industries
Related frameworks and industries affected
- GDPR, CCPA/CPRA and DPIAsData PrivacyData privacy compliance for GDPR and CCPA/CPRA, including data mapping, gap assessment, security controls and Data Protection Impact Assessments.
- CPA and Tax PracticesAccounting FirmsA written information security plan and FTC Safeguards Rule controls for CPA and tax practices.
FAQ
Questions, answered
Are auto dealers covered by the Safeguards Rule?
Yes, if they finance or arrange financing for customers, or lease vehicles for more than 90 days. Those activities make a dealer a financial institution under the rule. The FTC has published guidance specifically for dealers.
Does the rule apply to CPA and accounting firms?
The FTC names tax preparation as a covered activity. Firms that prepare tax returns should treat the rule as applying to that work and the customer information it involves.
What is a Qualified Individual?
The person who oversees, implements and enforces your information security program. They can be your employee or work for an affiliate or service provider. If you use an outside provider, you remain responsible and must designate a senior staff member to oversee them.
When do we have to notify the FTC of a breach?
When unencrypted customer information of at least 500 consumers is acquired without authorization, notify the FTC as soon as possible and no later than 30 days after discovery. This requirement took effect on May 13, 2024. State breach notification laws may also apply.
Can CyberAccord certify that we comply?
No. There is no certification under the Safeguards Rule; the FTC enforces it. What you can show is a written program, a current risk assessment and records of testing, training and reporting. We help you build and maintain that evidence.
Talk to a practitioner about FTC Safeguards Rule
Tell us the framework, your deadline and where you stand. We'll scope a gap assessment with a fixed quote.