FTC Safeguards Rule — GLBA Security, Built and Run

It depends on whether you are a “financial institution” under the FTC’s GLBA jurisdiction — not simply on whether you hold financial data. That definition is far broader than banks: it reaches tax preparers, accountants and CPAs, mortgage brokers and lenders, auto dealers, real estate settlement and escrow agents, investment advisers, and collection agencies. If you receive, maintain, or transmit nonpublic personal financial information about consumers, the Safeguards Rule is your obligation.

Nine elements, but a few carry real teeth. A designated Qualified Individual to run the program. A written risk assessment. Multi-factor authentication for anyone reaching systems that hold customer information, and encryption of that information at rest and in transit. Continuous monitoring, or regular penetration testing plus vulnerability scans. Oversight of your service providers, a written incident-response plan, and staff training — all documented in a written information security program.

The Qualified Individual is the single person accountable for overseeing, implementing and enforcing your security program. The rule is more flexible here than most firms realise: 16 CFR 314.4(a) says that person may be employed by you, by an affiliate, or by a service provider — so yes, the role can sit with us. What the rule does not allow is treating that as a transfer of responsibility. If you use an outside Qualified Individual, three things still bind you: you retain responsibility for compliance with the rule; you must designate a senior member of your own personnel to direct and oversee that individual; and you must require the provider to maintain a security program that protects you to the standard the rule sets.

We are happy to hold the role on those terms, and equally happy to be the security team behind your own designee. Either way one of your senior people stays accountable, and no provider can honestly tell you otherwise.

They’re two names for closely related obligations. The IRS requires tax preparers to maintain a Written Information Security Plan — and that WISP requirement is grounded in the same GLBA Safeguards Rule the FTC enforces. If you’re a tax or accounting firm, satisfying the FTC Safeguards Rule and maintaining your WISP are largely the same project, done once, properly.

The technical backbone of the program: MFA on every system with customer information, encryption at rest and in transit, access controls with a current inventory of where data lives, continuous monitoring with SIEM (Secure IT), internal vulnerability scanning with coordinated penetration testing (independent firm, published rate), and a written, tested incident-response plan. We also support the service-provider oversight and staff-training elements, and keep the written program current as your environment changes.

Enforcement is no longer theoretical. The amended rule has been fully in effect since June 2023, and it now includes a breach-notification obligation: security events affecting 500 or more consumers must be reported to the FTC. Beyond fines, the practical exposure is a breach you have to disclose while explaining why the required controls weren’t running. The controls are cheaper than the letter.

Both, on the IT side. We implement and operate the technical safeguards and produce the documentation your written information security program depends on — the risk assessment inputs, the monitoring and access evidence, the incident-response plan. Whoever holds the Qualified Individual role — your person or ours — the program has to be signed by someone who can stand behind it, and our job is to make sure what it describes is actually true.