What does the FTC Safeguards Rule require of small firms?

The FTC Safeguards Rule requires covered non-bank financial institutions to keep a written information security program built on nine elements in 16 CFR 314.4. Firms holding customer information on fewer than 5,000 consumers are excused from four specific requirements. Every covered firm must report qualifying breaches to the FTC.

Who does the rule cover?

The rule applies to financial institutions under FTC jurisdiction that are not overseen by another regulator under the Gramm-Leach-Bliley Act (16 CFR 314.1(b)). An entity is a financial institution if it is significantly engaged in an activity that is financial in nature, as defined by the Bank Holding Company Act.

Section 314.2(h)(2) lists examples. Several describe small and mid-sized firms directly:

• An accountant or other tax preparation service that completes income tax returns.
• A mortgage broker.
• An entity that provides real estate settlement services.
• A personal property or real estate appraiser.
• An automobile dealership that, as a usual part of its business, leases automobiles for an initial term of at least 90 days.
• A business that regularly wires money, a check casher, an investment advisory company and a credit counseling service.

The FTC's business guidance adds payday lenders, finance companies, account servicers and collection agencies to the picture. Firms that are not significantly engaged in financial activity are excluded. A retailer that only accepts credit cards issued by others is not a financial institution (314.2(h)(4)(ii)).

What are the nine elements in 314.4?

Section 314.3(a) requires a written program with safeguards appropriate to your size, complexity and the sensitivity of the data. Section 314.4 then sets out what the program must contain.

1. A Qualified Individual (314.4(a)). One person oversees and enforces the program. That person may be your employee, or work for an affiliate or a service provider. The FTC's guidance states the person does not need a particular degree or title. If you use a service provider, you keep responsibility for compliance, you must name a senior member of your staff to direct that person, and the provider must keep its own security program.

2. A risk assessment (314.4(b)). The program must rest on an assessment of reasonably foreseeable internal and external risks to customer information. Under 314.4(b)(1) it must be written and include criteria for rating risks, criteria for assessing confidentiality, integrity and availability, and how each risk will be mitigated or accepted. Section 314.4(b)(2) requires periodic reassessment.

3. Safeguards (314.4(c)). Eight specific controls:

• Access controls that limit users to the customer information they need (314.4(c)(1)).
• An inventory of data, personnel, devices, systems and facilities (314.4(c)(2)).
• Encryption of customer information in transit over external networks and at rest, or compensating controls approved by the Qualified Individual where encryption is infeasible (314.4(c)(3)).
• Secure development practices for in-house applications, and security evaluation of external ones (314.4(c)(4)).
• Multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing (314.4(c)(5)).
• Secure disposal of customer information no later than two years after it was last used to serve the customer, subject to legal, business and feasibility exceptions, plus periodic review of your retention policy (314.4(c)(6)).
• Change management procedures (314.4(c)(7)).
• Monitoring and logging of authorized users' activity to detect unauthorized access, use or tampering (314.4(c)(8)).

4. Testing and monitoring (314.4(d)). You must regularly test or monitor whether key controls work. Under 314.4(d)(2), information systems need either continuous monitoring or, failing that, annual penetration testing and vulnerability assessments at least every six months. Scans are also due after material changes to your operations.

5. Training and staffing (314.4(e)). Staff need security awareness training updated to reflect the risk assessment. Security personnel, in-house or outsourced, need to stay current.

6. Service provider oversight (314.4(f)). Select providers that can protect the data, require safeguards by contract, and assess them periodically based on their risk.

7. Program adjustment (314.4(g)). Update the program after testing, reassessments and material business changes.

8. A written incident response plan (314.4(h)). It must cover goals, internal processes, roles and decision authority, communications, remediation, documentation and post-incident revision.

9. An annual written report (314.4(i)). The Qualified Individual reports at least annually to the board or, if there is none, to a senior officer. The report covers the program's status and material matters such as risk decisions, testing results, service provider arrangements and security events.

These expanded requirements came from the 2021 final rule (86 FR 70272). The FTC delayed several of them to June 9, 2023 (87 FR 71509). They have been in force since then.

What does the small-firm exemption remove?

Section 314.6 states that 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than 5,000 consumers. In practice, that means:

• No requirement for the risk assessment to be written with the specified criteria.
• No mandated schedule of annual penetration tests and six-month vulnerability assessments.
• No requirement for a written incident response plan.
• No annual written report from the Qualified Individual.

Everything else still applies. You still need a Qualified Individual, a risk assessment (unwritten if you choose), encryption, MFA, disposal procedures, training, provider oversight and regular testing under 314.4(d)(1).

Even under the threshold, we recommend keeping a written risk assessment and incident plan. They are the simplest way to show your work.

When must you notify the FTC?

Since May 13, 2024 (16 CFR 314.5), 314.4(j) requires covered firms to notify the FTC of a notification event involving at least 500 consumers. The 5,000-consumer exemption does not cover this duty.

A notification event is the acquisition of unencrypted customer information without the consumer's authorization (314.2(m)). Three details matter:

• Information counts as unencrypted if the encryption key was accessed by an unauthorized person.
• Unauthorized access is presumed to be acquisition unless you have reliable evidence that acquisition did not or could not reasonably have occurred.
• The event is discovered on the first day it is known to any employee, officer or other agent other than the person committing the breach (314.4(j)(2)).

Notice is due as soon as possible and no later than 30 days after discovery, through the FTC's online form. The notice must include your contact details, the types of information involved, the date range if known, the number of consumers affected, a general description and any law enforcement request for delay (314.4(j)(1)). The FTC's form page states that reports may be made public and that attorneys or service providers may file on your behalf. This federal notice is separate from any state law duty to notify affected individuals.

A practical checklist

Requirement	Citation	Applies under 5,000 consumers?	Evidence to keep
Qualified Individual named	314.4(a)	Yes	Designation memo; oversight assignment if outsourced
Written risk assessment	314.4(b)(1)	No (assessment still required)	Dated assessment with criteria and decisions
Access controls, inventory, encryption	314.4(c)(1)–(3)	Yes	Access reviews, asset list, encryption settings
MFA for all system access	314.4(c)(5)	Yes	MFA enforcement report; written exceptions
Disposal within two years	314.4(c)(6)	Yes	Retention schedule and disposal records
Logging and monitoring	314.4(c)(8)	Yes	Log configuration and review records
Pen test yearly, scans every six months	314.4(d)(2)	No	Test and scan reports, remediation tickets
Staff training	314.4(e)	Yes	Training completion records
Service provider contracts and reviews	314.4(f)	Yes	Contract clauses, review notes
Written incident response plan	314.4(h)	No	Plan with roles and contacts
Annual report to board or senior officer	314.4(i)	No	Signed annual report
FTC notice for 500+ consumers	314.4(j)	Yes	Incident log; filed form confirmation

Where to start

Count the consumers whose information you hold, because that sets your obligations. Name a Qualified Individual. If no one in the firm has the time or background, a virtual CISO can fill the role while a senior partner keeps oversight. Confirm MFA and encryption early, since the rule states both without qualification for firms of any size. Then decide between continuous monitoring through managed security and an annual penetration test with scheduled scans.

Firms with sector-specific questions can read our notes for accounting firms. If you want a second view on where your program stands, talk to us.