The FTC Safeguards Rule requires non-bank financial businesses to run a written security program that protects their customers' data. If you prepare taxes, broker mortgages, lend, appraise, close real estate deals or arrange car financing, it almost certainly applies to you, at any size.
The rule dates back to 2003. The FTC rewrote it into a specific list of requirements, and most of them have been mandatory since June 9, 2023 (FTC). You need one named person in charge, a written risk assessment, access limits, encryption, multi-factor authentication, regular testing, staff training, vendor oversight, an incident response plan and a yearly report to the owner. Since May 13, 2024, a breach exposing unencrypted data on 500 or more consumers has to be reported to the FTC within 30 days.
Firms holding data on fewer than 5,000 consumers skip four of those items. The rest still apply. A first violation brings no fine under the law. It brings an FTC order that can run 20 years.
Who the Safeguards Rule covers
The rule covers financial institutions the FTC oversees under the Gramm-Leach-Bliley Act. The FTC's definition is broad, and its examples run from mortgage brokers and finance companies to tax preparers, appraisers, title companies, collection agencies and car dealers that finance or lease (16 CFR 314.2).
Banks, SEC-registered advisers and insurance agencies have their own regulators and their own rules. Almost everyone else in finance lands here. Our GLBA guide explains that split.
The rule protects "customer information." That's any record, paper or electronic, with nonpublic personal information about someone you've done financial business with. Tax returns, loan applications, credit reports, bank details, the deal jacket in a filing cabinet.
Safeguards Rule requirements, one at a time
All of these come from 16 CFR 314.4.
A Qualified Individual. One named person runs the program. It can be you, an employee, or someone at an outside IT company. If it's an outsider, you're still responsible, and someone on your staff has to oversee them.
A written risk assessment. Write down what customer data you have, where it lives, and what could expose it. Redo it when your business changes. Our risk assessment guide walks through one.
Safeguards that answer the risks. This is the technical core.
- Give each person access only to the data their job needs, and review that access.
- Keep an inventory of your data, devices and systems.
- Encrypt customer information when it's stored and when it's sent.
- Require multi-factor authentication for anyone who logs into a system holding customer data.
- Dispose of customer data no later than two years after you last used it, unless you have a business or legal reason to keep it.
- Manage changes to your systems so an update doesn't quietly open a hole.
- Log and monitor what users do with customer data.
Testing. Either monitor your systems continuously, or run a penetration test every year and vulnerability scans every six months.
Training. Your staff gets security awareness training, kept current. More in our training guide.
Vendor oversight. Pick service providers that can protect your data, require it in their contracts, and check on them from time to time. Your tax software, CRM, payroll service and IT company all count.
Keeping it current. Update the program when testing finds a gap or your business changes.
A written incident response plan. Who does what when something goes wrong. Our incident response guide covers what goes in it.
An annual report. The Qualified Individual reports to the owner or board in writing at least once a year.
A breach report to the FTC. More on this below.
The 5,000-consumer exemption
If you hold customer information on fewer than 5,000 consumers, four requirements fall away (16 CFR 314.6). Everything else stays.
| Requirement | Fewer than 5,000 consumers | 5,000 or more |
|---|---|---|
| Written security program | Required | Required |
| Qualified Individual | Required | Required |
| Written risk assessment | Not required | Required |
| Access limits, encryption, multi-factor authentication, disposal | Required | Required |
| Continuous monitoring, or a yearly pen test and scans every six months | Not required | Required |
| Staff training | Required | Required |
| Vendor oversight | Required | Required |
| Written incident response plan | Not required | Required |
| Annual written report to the owner or board | Not required | Required |
| Breach report to the FTC at 500+ consumers | Required | Required |
You'll see online claims that the rule only applies above 5,000 records. That's wrong.
Count everyone whose information you still keep, not this year's clients. Seven years of tax files adds up.
The 30-day breach report
Since May 13, 2024, if unencrypted information about 500 or more consumers is taken without authorization, you have to tell the FTC as soon as possible and no later than 30 days after you find out (FTC). The FTC takes the report through an online form.
Notice the word unencrypted. Encryption is the one control that can turn a reportable breach into a non-event.
What enforcement looks like
The Gramm-Leach-Bliley Act doesn't set a dollar fine for breaking the Safeguards Rule the first time (15 U.S.C. 6805). What the FTC does is put the business under an order, often for 20 years.
An online tax preparation company that had no written security program until late 2015 settled with an order barring it from violating the rules for 20 years, plus outside assessments every two years for a decade (FTC). A Georgia car dealer got 20 years of audits every other year (FTC).
Those orders have teeth. Breaking one brings civil penalties for each violation (15 U.S.C. 45(l)). And states don't wait for the FTC. New York settled with a small accounting firm for $60,000 after ransomware exposed unencrypted Social Security numbers (NY Attorney General).
The failures in these cases repeat. No written program. No risk assessment. No training. No encryption. Nobody watching the vendors.
The plan in the drawer
Plenty of small firms have something on file. A template filled in once and never opened again. One poster in a tax forum described theirs as "a template we filled in once and never touched."
The rule asks for a program you run, not a document you keep. If a breach happens, the questions will be whether multi-factor authentication was on, whether training happened, and whether anyone reviewed the logs. Your cyber insurer will ask the same things.
Where to start this month
- Count the consumers whose data you hold.
- Name your Qualified Individual.
- Turn on multi-factor authentication for email, tax or loan software, and remote access.
- Confirm customer data is encrypted on laptops, servers and in transit.
- List your vendors and check what their contracts say about security.
- Write the program down. Tax and accounting firms can start from the IRS template, covered in our WISP template guide.
Want to know where your firm stands first? Our security check gives you a plain score and can match you with one IT company that works with firms like yours.