Financial servicesPrivacyUSA

FTC Safeguard Rule

Keep your information-security programme accountable

Connect customer-information safeguards with documented responsibilities, reviews and corrective action.

Full title
Standards for Safeguarding Customer Information, 16 CFR Part 314, issued under the Gramm-Leach-Bliley Act
Issued by
US Federal Trade Commission
Current version
Original rule in force from 2003, substantially amended in 2021. The FTC notification requirement took effect on 13 May 2024.
Applies to
Non-bank financial institutions under FTC jurisdiction, a wider group than banks in everyday language
Nature
Binding US federal regulation. There is no certification.
Structure
Six sections. Section 314.4 sets the elements of a written information security programme.

Overview

What the Safeguards Rule requires

The Safeguards Rule requires financial institutions under the Federal Trade Commission’s jurisdiction to develop, implement and maintain a comprehensive information security programme that protects customer information. The programme must be written, and its administrative, technical and physical safeguards must be appropriate to the institution’s size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it holds.

The rule was first issued under the Gramm-Leach-Bliley Act and took effect in 2003. The FTC amended it substantially in 2021, turning general expectations into specific elements: a Qualified Individual to run the programme, a written risk assessment, named safeguards such as encryption and multi-factor authentication, testing, training, service provider oversight, a written incident response plan and an annual written report to the board.

In 2023 the FTC added a notification requirement, effective 13 May 2024. When unencrypted customer information of at least 500 consumers is acquired without authorisation, the institution must notify the FTC as soon as possible and no later than 30 days after discovery, using the FTC’s online form.

“Financial institution” is defined broadly. It covers businesses significantly engaged in financial activities, such as mortgage lenders and brokers, payday lenders, finance companies, collection agencies, tax preparers, many automobile dealers that arrange financing, and investment advisers not required to register with the SEC. Banks and others overseen by another federal regulator under the Act follow that regulator’s rules instead.

Who it applies to

The rule applies to financial institutions under FTC jurisdiction that are not overseen by another regulator under section 505 of the Gramm-Leach-Bliley Act. Examples the FTC gives include:

  • Mortgage lenders, mortgage brokers, payday lenders and finance companies
  • Account servicers, check cashers, wire transferors and collection agencies
  • Credit counsellors, financial advisers and tax preparation firms
  • Automobile dealers that offer financing or leasing
  • Non-federally insured credit unions and investment advisers not required to register with the SEC
  • Finders that bring together buyers and sellers of a product or service

Institutions that maintain customer information on fewer than 5,000 consumers are exempt from four provisions: the written risk assessment, continuous monitoring or penetration testing and vulnerability assessments, the written incident response plan and the annual board report. All other elements still apply. Indian service providers that handle customer information for covered institutions are often asked to meet these requirements through their clients’ contracts.

Structure

How the rule is organised

Six sections. The elements in section 314.4 are the core of the programme and are listed here in the order the rule sets them out.

314.1 to 314.3

Scope, definitions and objectives

Purpose and scope (314.1)
Sets standards for developing, implementing and maintaining safeguards for customer information, for financial institutions under FTC jurisdiction.
Definitions (314.2)
Defines terms including customer information, encryption, financial institution, information security programme, notification event, Qualified Individual and service provider.
Standards (314.3)
A written programme with safeguards appropriate to size, complexity, activities and sensitivity, designed to ensure security and confidentiality, protect against anticipated threats and protect against unauthorised access that could cause substantial harm.
314.4(a) and (b)

Ownership and risk assessment

Qualified Individual
Designate one person to oversee, implement and enforce the programme. If that person works for an affiliate or service provider, the institution keeps responsibility, designates senior personnel to direct and oversee them, and requires the provider to maintain a compliant programme.
Written risk assessment
Identify reasonably foreseeable internal and external risks to customer information, with criteria for evaluating them, assessing confidentiality, integrity and availability, and deciding how each risk is mitigated or accepted. Repeat periodically.
314.4(c)

Safeguards

Safeguards to control the risks the assessment identifies, including:

Access controls
Authenticate users and limit their access to the customer information they need.
Inventory
Identify and manage data, personnel, devices, systems and facilities according to their importance.
Encryption
Encrypt customer information in transit over external networks and at rest. Where that is infeasible, use compensating controls approved by the Qualified Individual.
Secure development
Secure development practices for in-house applications, and procedures to evaluate externally developed applications.
Multi-factor authentication
For any individual accessing any information system, unless the Qualified Individual approves reasonably equivalent or more secure controls in writing.
Disposal and retention
Dispose of customer information no later than two years after it was last used for the customer, subject to exceptions, and review the retention policy periodically.
Change management
Procedures for managing changes.
Monitoring of users
Monitor and log the activity of authorised users and detect unauthorised access, use or tampering.
314.4(d) to (g)

Testing, people, providers and adjustment

Testing and monitoring
Regularly test or monitor key controls. Without effective continuous monitoring, carry out annual penetration testing, and vulnerability assessments at least every six months and after material changes.
Personnel
Security awareness training updated for identified risks, qualified security personnel, and continuing education to keep them current.
Service providers
Select providers able to maintain appropriate safeguards, require them by contract and periodically assess providers based on risk.
Evaluation and adjustment
Adjust the programme in light of testing, material changes in operations, risk assessment results and other relevant circumstances.
314.4(h) and (i)

Incident response and board reporting

Incident response plan
A written plan covering goals, internal processes, roles and decision-making authority, internal and external communication, remediation of weaknesses, documentation and reporting of security events, and review of the plan after an event.
Report to the board
The Qualified Individual reports in writing at least annually to the board, or a senior officer if there is no board, on overall programme status and compliance and on material matters such as risk assessment, risk decisions, service provider arrangements, test results, security events and recommended changes.
314.4(j)

Notification to the FTC

Trigger
A notification event, meaning unauthorised acquisition of unencrypted customer information, involving at least 500 consumers. Information is treated as unencrypted if the key was also accessed.
Timing and method
As soon as possible and no later than 30 days after discovery, through the FTC’s electronic form.
Contents
Name and contact details, the types of information involved, the date or date range if known, the number of consumers affected, a general description, and whether law enforcement has requested a delay.
Law enforcement delay
The FTC’s public posting of the notice can be delayed for up to 30 days at a law enforcement official’s written request, extendable by up to 60 more days on a further request.
314.5 and 314.6

Effective dates and exceptions

Effective dates (314.5)
The notification requirement in 314.4(j) took effect on 13 May 2024.
Exceptions (314.6)
Institutions with customer information on fewer than 5,000 consumers are exempt from 314.4(b)(1), (d)(2), (h) and (i).

Implementation roadmap

How to implement it, step by step

A practical sequence for a programme that meets section 314.4.

  1. 1

    Confirm coverage and size

    Confirm that you are a financial institution under FTC jurisdiction and count the consumers whose customer information you hold, which decides whether the 5,000 consumer exception applies.

    OutputsCoverage noteConsumer count
  2. 2

    Appoint the Qualified Individual

    Name the person who will oversee and enforce the programme. If it is an outsourced role, designate senior personnel to oversee them.

    OutputsAppointment recordOversight arrangement
  3. 3

    Inventory and assess risk

    Map customer information, systems, devices and facilities, then write the risk assessment with criteria and a decision on each risk.

    OutputsAsset and data inventoryWritten risk assessment
  4. 4

    Implement the safeguards

    Put access controls, encryption, multi-factor authentication, secure development, two-year disposal, change management and user activity monitoring in place. Record any compensating controls the Qualified Individual approves.

    OutputsSafeguard recordsWritten approvals
  5. 5

    Test and train

    Choose continuous monitoring or a testing schedule of annual penetration tests and six-monthly vulnerability assessments. Run awareness training and keep security staff current.

    OutputsTest reportsTraining records
  6. 6

    Oversee service providers

    Assess providers before selection, include safeguard requirements in contracts and reassess them periodically by risk.

    OutputsProvider assessmentsContract clauses
  7. 7

    Prepare for incidents and notification

    Write the incident response plan and add a step to decide quickly whether an event is a notification event affecting 500 or more consumers, so the FTC can be notified within 30 days.

    OutputsIncident response planNotification procedure
  8. 8

    Report and adjust

    The Qualified Individual reports to the board at least annually. Adjust the programme after tests, incidents and changes in the business.

    OutputsAnnual board reportProgramme updates

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no certification. The FTC enforces the rule through investigations and actions, and examines whether the written programme exists, whether each element is in place and whether the institution can show it operates.

What reviewers look for

  • A written programme that covers every element of section 314.4
  • A named Qualified Individual and oversight where the role is outsourced
  • A written risk assessment with criteria and decisions, repeated periodically
  • Encryption at rest and in transit, or approved compensating controls
  • Multi-factor authentication for anyone accessing information systems
  • Disposal of customer information within two years of last use, subject to exceptions
  • Continuous monitoring, or annual penetration testing and six-monthly vulnerability assessments
  • Service provider selection, contracts and periodic assessment
  • A written incident response plan and a working FTC notification process
  • Annual written reports from the Qualified Individual to the board

Key timelines

Notification to the FTC of a notification eventWithin 30 days of discovery
Penetration testing, without continuous monitoringAnnually
Vulnerability assessments, without continuous monitoringAt least every 6 months
Qualified Individual report to the boardAt least annually
Disposal of customer information2 years after last use
Risk assessmentPeriodically
FTC notification requirement in forceSince 13 May 2024

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Written information security programme
  • Qualified Individual appointment
  • Annual board reports

Risk

  • Written risk assessment
  • Risk criteria and decisions
  • Asset and data inventory

Safeguards

  • Access control records
  • Encryption configuration
  • MFA coverage
  • Change records
  • Disposal records

Testing

  • Penetration test reports
  • Vulnerability assessment reports
  • Monitoring and log reviews

People

  • Awareness training records
  • Security staff training

Service providers

  • Selection due diligence
  • Contract safeguard clauses
  • Periodic assessments

Incidents

  • Incident response plan
  • Incident records
  • FTC notification records

Areas that often need attention

  • No single Qualified Individual, or no oversight of an outsourced one
  • A risk assessment that is not written or not repeated
  • MFA missing for some users or systems without written approval of an alternative
  • Customer information kept long after the two-year disposal limit
  • Penetration tests or vulnerability assessments not run on schedule
  • Service provider contracts without safeguard requirements
  • No process to identify a notification event and meet the 30-day limit
  • Board reports that are not written or not annual

How Netra helps

Where each part of the work lives in Netra

Netra loads the Safeguards Rule as requirements, tasks and policies, so each element of the programme has an owner, a schedule and evidence.

Each element owned and scheduled

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover penetration tests, six-monthly vulnerability assessments, disposal reviews and training.

Status for each element

Compliance Centre

Status is derived from completed tasks and evidence, never typed in. One task can also satisfy other frameworks that ask for the same control.

Written programme and incident response plan

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Written risk assessment

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked tasks are completed.

Inventory of data, systems and devices

Asset Management

Assets linked to tasks, so teams know which systems each safeguard covers.

Service provider oversight

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Annual report to the board

Dashboard & Reports

A live Posture Score and a one-click board report built from live data, for the Qualified Individual to review and present.

Netra organises work, evidence and reviews. It does not by itself establish compliance with the Safeguards Rule, it is not a legal adviser, and it does not notify the FTC. The Qualified Individual remains responsible for the programme.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Privacy

CCPA

Keep California privacy obligations organised

Financial services

SEC

Support cyber disclosures with a traceable governance record

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See FTC Safeguard Rule in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.