Cybersecurity · Compliance
Who the amended rule covers, the nine elements of the required security program, what smaller firms can skip and the breach reporting deadline.
Are you a covered business?
The nine required elements
Reporting breaches to the FTC
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
The FTC Safeguards Rule requires non-bank financial businesses, such as tax preparers, mortgage brokers, auto dealers that arrange financing, payday lenders and collection agencies, to run a written information security program with nine elements: a qualified individual in charge, a written risk assessment, specific safeguards including encryption and multi-factor authentication, regular testing, staff training, vendor oversight, keeping the program current, a written incident response plan and an annual written report to leadership.
The amended rule’s main requirements took effect June 9, 2023. Since May 2024, covered businesses must also report a breach involving 500 or more consumers to the FTC within 30 days of discovery. Firms with customer information on fewer than 5,000 consumers are exempt from some of the paperwork, but not from the core safeguards. This is general information; confirm how it applies to you with counsel.
The rule applies to “financial institutions” under FTC jurisdiction that are not regulated by a banking agency. The test is what you do, not what you call yourself. The FTC’s business guidance lists examples including:
If your business handles consumer financial information as part of providing a financial product or service, assume you may be covered and check with counsel. Many CPA firms, insurance-adjacent businesses and dealerships discover they are in scope only when a client, lender or insurer asks.
One person oversees the program. It can be an employee, an affiliate or an outside provider. If you outsource the role, you remain responsible and must oversee the provider.
Identify reasonably foreseeable internal and external risks to customer information, with criteria for rating them, and repeat the assessment periodically.
The rule names specific controls:
Either continuous monitoring, or an annual penetration test plus vulnerability assessments, including system-wide scans, every six months and after material changes.
Security awareness training for all staff, and qualified people (in-house or outsourced) to run the program, with ongoing training for them.
Choose providers that can protect the data, put security requirements in contracts and periodically assess them.
Update it as your business, systems and threats change.
Goals, roles, communication, remediation, documentation and a post-incident review.
The qualified individual reports in writing at least yearly to the board or a senior officer on the program’s status and material risks.
Want a quick read on which of the nine elements you already meet? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Financial institutions that maintain customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, the continuous monitoring or penetration testing and scanning requirement, the written incident response plan and the annual written report. They still need a qualified individual, the safeguards in element 3, including MFA and encryption, training, vendor oversight and a program that stays current.
Two cautions. Count consumers carefully, including past customers whose records you still keep. And remember the exemption is from paperwork, not from risk: a small tax office with no incident plan still has to respond to a breach.
Since May 2024, covered businesses must notify the FTC as soon as possible, and no later than 30 days after discovery, of a “notification event” involving the unencrypted information of at least 500 consumers. Notice goes through an online form on the FTC’s website. Information is treated as unencrypted if the encryption key was also taken. State breach notification laws may separately require notice to consumers and state attorneys general on different timelines, so involve counsel immediately.
Encryption is the most practical way to reduce exposure here: a lost encrypted laptop is usually not a reportable event, while a lost unencrypted one may be.
If the FTC, a lender, a franchisor or an insurer asks how you comply, a policy document alone is weak. Keep a simple evidence file that shows the program runs:
A folder updated quarterly takes little time and turns a stressful request into a ten-minute reply.
Our cybersecurity services cover most of the technical safeguards: MFA, access reviews, same-day removal of leavers, endpoint protection, encryption, email security and monitored backups with tested restores. Many covered firms are also asked the same questions by their cyber insurer; our guide to cyber insurance requirements overlaps closely.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Non-bank financial institutions under FTC jurisdiction, including tax preparers, mortgage brokers, auto dealers that arrange financing, finance companies, collection agencies and some investment advisors. Coverage depends on activities, so confirm with counsel.
Most amended requirements took effect June 9, 2023. The requirement to report breaches involving 500 or more consumers to the FTC took effect in May 2024.
Yes. The rule requires multi-factor authentication for any individual accessing an information system, with limited exceptions approved in writing by the qualified individual.
The written risk assessment, continuous monitoring or annual penetration testing and six-month scanning, the written incident response plan and the annual report to leadership. Other requirements still apply.
As soon as possible and no later than 30 days after discovery, if unencrypted information of at least 500 consumers is involved. State laws may add other deadlines.
