# FTC Safeguards Rule compliance

> The FTC Safeguards Rule, 16 CFR Part 314, requires non-bank financial institutions under the FTC's jurisdiction, including auto dealers that arrange financing, mortgage brokers and tax preparers, to run a written information security program. CyberAccord performs the written risk assessment, closes gaps in controls such as MFA and encryption, and supports the person who oversees your program.

Source: https://www.cyberaccord.com/compliance/ftc-safeguards-rule · Last reviewed: 2026-10-22

We help financial institutions under the FTC's jurisdiction, from auto dealers and mortgage brokers to tax preparers, build the written information security program the Safeguards Rule requires and keep it current.

## Key facts

- **Who it applies to:** Non-bank financial institutions under FTC jurisdiction
- **Rule:** 16 CFR Part 314, under the Gramm-Leach-Bliley Act
- **Enforced by:** Federal Trade Commission
- **Breach notice:** To the FTC within 30 days for events involving at least 500 consumers

## Who must comply with the Safeguards Rule?

The rule applies to financial institutions under the FTC's jurisdiction that are not banks or credit unions. The FTC's guidance names mortgage lenders and brokers, payday lenders, finance companies, check cashers, collection agencies, credit counselors and tax preparers, among others.

Auto dealers are covered when they finance or arrange financing for customers, or lease vehicles for more than 90 days. Accounting and CPA firms that prepare tax returns should treat the rule as applying to that work and the customer information it involves.

## What does the rule require?

Section 314.4 sets out the elements of a written information security program. The program has to fit your size, the complexity of your business and the sensitivity of the customer information you hold.

- A Qualified Individual who oversees and enforces the program
- A written risk assessment
- Safeguards including access controls, encryption of customer information in transit and at rest, and multi-factor authentication for anyone accessing an information system
- Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months
- Security awareness training for staff
- Oversight of service providers, including contract terms
- A written incident response plan
- A written report to the board, or to a senior officer if there is no board, at least annually

## What changed in 2023 and 2024?

The FTC substantially expanded the rule in 2021. Most of the new requirements took effect on June 9, 2023, after a six-month extension.

A further amendment added a duty to notify the FTC, effective May 13, 2024. When unencrypted customer information of at least 500 consumers is acquired without authorization, notice is due as soon as possible and no later than 30 days after discovery.

## Is there an exemption for small businesses?

Institutions that maintain customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, continuous monitoring or annual penetration testing and vulnerability assessments, the written incident response plan, and the annual written report to the board. The rest of the rule still applies.

## What we do

We perform the risk assessment, compare your safeguards with each element of section 314.4 and give you a remediation plan ranked by risk. We write the information security program and incident response plan, help put MFA and encryption in place, and can run the penetration test and vulnerability assessments the rule calls for.

The Qualified Individual can work for you, an affiliate or a service provider. If you use an outside provider, you keep responsibility for compliance and must designate a senior staff member to oversee them. Our vCISO service can fill or support that role.

## What you get

- Written risk assessment
- Gap assessment against each element of 16 CFR 314.4
- Written information security program
- Incident response plan, including FTC notification steps
- Penetration test and vulnerability assessments
- Service provider oversight review
- Support for the Qualified Individual's annual report to the board

## How it works

1. **Scope.** We identify the customer information you hold, the systems and service providers that touch it, and whether the small-institution exemption applies.
2. **Assess.** We run the written risk assessment and compare your safeguards with each element of the rule.
3. **Remediate and document.** We help put missing controls in place and write the security program and incident response plan.
4. **Test and report.** We run the required testing and help your Qualified Individual prepare the annual report to the board.

## Frequently asked questions

### Are auto dealers covered by the Safeguards Rule?

Yes, if they finance or arrange financing for customers, or lease vehicles for more than 90 days. Those activities make a dealer a financial institution under the rule. The FTC has published guidance specifically for dealers.

### Does the rule apply to CPA and accounting firms?

The FTC names tax preparation as a covered activity. Firms that prepare tax returns should treat the rule as applying to that work and the customer information it involves.

### What is a Qualified Individual?

The person who oversees, implements and enforces your information security program. They can be your employee or work for an affiliate or service provider. If you use an outside provider, you remain responsible and must designate a senior staff member to oversee them.

### When do we have to notify the FTC of a breach?

When unencrypted customer information of at least 500 consumers is acquired without authorization, notify the FTC as soon as possible and no later than 30 days after discovery. This requirement took effect on May 13, 2024. State breach notification laws may also apply.

### Can CyberAccord certify that we comply?

No. There is no certification under the Safeguards Rule; the FTC enforces it. What you can show is a written program, a current risk assessment and records of testing, training and reporting. We help you build and maintain that evidence.

## Related

- [vCISO](https://www.cyberaccord.com/services/advisory/vciso): A part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing): Manual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- [Managed Security](https://www.cyberaccord.com/services/managed-security): Managed device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
- [Data Privacy](https://www.cyberaccord.com/compliance/data-privacy): Data privacy compliance for GDPR and CCPA/CPRA, including data mapping, gap assessment, security controls and Data Protection Impact Assessments.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com
- Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054