GLBA and the FTC Safeguards Rule for non-bank financial institutions
FTC Safeguards Rule: who it covers, the nine elements and the 30-day breach notice
What 16 CFR Part 314 asks of mortgage brokers, lenders, auto dealers, tax preparers and other non-bank financial institutions, the relief for small firms, and how to evidence the program.
In short
The FTC Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for financial institutions under the Federal Trade Commission's jurisdiction, such as mortgage brokers, payday and other non-bank lenders, auto dealers that finance or lease, and tax preparation firms. It requires a written information security program led by a Qualified Individual, built on a written risk assessment, with access controls, encryption, multi-factor authentication, monitoring, testing, training, service provider oversight, an incident response plan and an annual report to the board. Since 13 May 2024, a breach affecting at least 500 consumers must be reported to the FTC within 30 days of discovery.
Who the Safeguards Rule covers
The rule applies to "financial institutions" as the FTC defines them, which is broader than everyday usage: what a business does matters more than what it calls itself. Section 314.2 lists examples including mortgage lenders and brokers, payday lenders, finance companies, account servicers and tax preparation firms. The FTC's guidance says most automobile dealers that finance or lease vehicles are covered.
Banks, credit unions and other institutions supervised by a federal banking agency follow their regulators' versions of the GLBA safeguards standards instead. The FTC rule covers the rest.
- Customer information
- Nonpublic personal information about a customer, handled or maintained by the institution or for it.
- Qualified Individual
- The one person designated to oversee, implement and enforce the program. Can be an employee, or work for an affiliate or service provider, in which case a senior employee keeps oversight.
- Notification event
- Unauthorised acquisition of unencrypted customer information, or of encrypted information with its key. Acquisition is presumed unless there is reliable evidence it did not happen.
The nine elements of the program
Section 314.4 sets out what the written information security program must contain. The 2021 amendment made most of them specific, and they have been fully in force since 9 June 2023.
| Section | Element | In practice |
|---|---|---|
| 314.4(a) | Qualified Individual | One named person oversees the program |
| 314.4(b) | Written risk assessment | Identify risks to customer information, with criteria for evaluating them, and repeat it periodically |
| 314.4(c) | Safeguards | Access controls, a data and system inventory, encryption, secure development, MFA, disposal within two years of last use, change management, and monitoring and logging |
| 314.4(d) | Testing | Continuous monitoring, or annual penetration testing and vulnerability assessments at least every six months |
| 314.4(e) | Training | Security awareness for staff, and specialised training for security personnel |
| 314.4(f) | Service providers | Select capable providers, require safeguards by contract, and assess them periodically |
| 314.4(g) | Keep it current | Adjust the program for test results, changes and incidents |
| 314.4(h) | Incident response plan | Written plan with goals, roles, communications, remediation and documentation |
| 314.4(i) | Board report | The Qualified Individual reports in writing at least annually |
The 30-day breach notice to the FTC
Since 13 May 2024, section 314.4(j) requires a covered institution to notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving the information of at least 500 consumers. Reports are filed through the FTC's online form, which asks for the institution, the dates of the event, the number of consumers affected or potentially affected, the types of information involved and a summary. A third party, such as an attorney or service provider, may file for the institution.
How the Safeguards Rule relates to NIST CSF, ISO 27001 and SOC 2
The rule names outcomes and a few hard requirements (MFA, encryption, a two-year disposal limit, an annual board report). Many of its safeguards have counterparts in NIST CSF, ISO 27001 and SOC 2, but there is no official FTC mapping to any of them, so confirm overlaps control by control.
What another framework will not cover is specific to the rule: the Qualified Individual, the small-firm exemptions, the testing cadence when monitoring is not continuous, and the 30-day FTC notice.
Building a Safeguards Rule program
Start by naming the Qualified Individual and counting the consumers whose information you hold.
-
01
Name the Qualified Individual
Designate one person, and if they are external, a senior employee to oversee them.
Your leadership
-
02
Count and inventory
Work out whether you hold information on 5,000 or more consumers, and inventory the data, people, devices and systems that handle it.
Your compliance and IT teams, in Certifyi
-
03
Assess the risks
Write the risk assessment with its criteria, and map each safeguard in 314.4(c) to a control with an owner.
Your Qualified Individual, in Certifyi
-
04
Test on a cadence
Set annual penetration tests and six-monthly vulnerability assessments, unless monitoring is continuous.
Your security team
-
05
Prepare the notice route
Agree who decides that a notification event has happened and who files with the FTC within 30 days.
Your incident response and legal teams
Who does what
The FTC enforces; the institution owns its program. Certifyi is a tool and does not file with the FTC on your behalf.
| Task | Your team | Certifyi | FTC |
|---|---|---|---|
| Risk assessment | Written assessment, repeated periodically | Holds the risk register with criteria, owners and review dates | May request the program in an investigation |
| Inventory | Data, personnel, devices and systems | Asset register with owner, location, model, serial number and information classification | Reviews during an investigation |
| Testing | Annual pen test, six-monthly vulnerability assessments | Control test cadences and imported scanner findings | Reviews test records |
| Service providers | Select, contract and assess | Vendor tiering, questionnaires, contracts and documents | Reviews provider oversight |
| Breach notice | 500+ consumers, within 30 days | Incident register with its timeline and decisions | Receives the report through its online form |
How Certifyi helps
Run the Safeguards Rule on the controls you already have
Certifyi does not make you compliant with the Safeguards Rule. It gives you a workspace where its requirements, the evidence behind them and your records sit together.
-
The rule in the framework catalogue
The catalogue includes the FTC Safeguards Rule as 34 requirements across sections 314.4(a) to (i). Map them to the controls you already run for SOC 2, ISO 27001 or NIST CSF.
-
Inventory that answers 314.4(c)(2)
The asset register records each system's owner, location, model, serial number and information classification.
-
Testing on the rule's cadence
Give each control a test cadence, from daily to annual, and import findings from Qualys, Tenable, Rapid7 or OpenVAS into vulnerability management.
-
Service provider oversight
Tier providers, send questionnaires and keep contracts and documents current in third-party risk.
-
Access reviews and MFA evidence
Run periodic access reviews, and keep the decisions and your MFA evidence against the controls they prove.
Sources
Where these facts come from
- FTC: FTC Safeguards Rule, What Your Business Needs to Know Primary source
- FTC: Safeguards Rule (16 CFR Part 314) Primary source
- FTC: Safeguards Rule notification requirement now in effect (May 2024) Primary source
- FTC: FTC amends Safeguards Rule to require non-banking financial institutions to report data security breaches Primary source
- Federal Register: Standards for Safeguarding Customer Information (13 November 2023) Primary source
- FTC: Automobile Dealers and the FTC's Safeguards Rule, Frequently Asked Questions Primary source
Questions
FTC Safeguards Rule, answered
Who must comply with the FTC Safeguards Rule?
Financial institutions under the FTC's jurisdiction, defined broadly by activity: for example mortgage lenders and brokers, payday and other non-bank lenders, finance companies, account servicers, tax preparation firms, and most auto dealers that finance or lease vehicles. Banks and credit unions follow their own regulators' standards instead.
When must a breach be reported to the FTC?
As soon as possible and no later than 30 days after discovering a notification event that involves the information of at least 500 consumers. The requirement has applied since 13 May 2024, and reports go through the FTC's online form.
What does the rule ask of small businesses?
An institution holding customer information on fewer than 5,000 consumers is exempt from the written risk assessment, the testing cadence in 314.4(d)(2), the written incident response plan and the annual board report. All other requirements still apply.
What is a Qualified Individual?
The single person designated to oversee, implement and enforce the information security program. They can be an employee, or work for an affiliate or service provider, with a senior employee then keeping oversight.
How often must we test?
Either monitor continuously, or run penetration tests at least once a year and vulnerability assessments at least every six months, plus after material changes.
Is MFA required?
Yes. Multi-factor authentication is required for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing.
Does Certifyi make us compliant with the Safeguards Rule?
No. Compliance depends on the program and safeguards that are yours to build and operate. Certifyi provides the workspace to map, evidence and track them, and it does not file with the FTC.
Map the Safeguards Rule to your controls in a 30-minute call.
Bring your consumer count and the name of your Qualified Individual. You leave with the requirements, the testing cadence and your evidence laid out in one Certifyi workspace.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them