AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor non-bank financial institutions under FTC jurisdiction, such as lenders, brokers and tax preparers, whose Qualified Individual maintains the written program.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Financial institutions under FTC jurisdiction under the Gramm-Leach-Bliley Act, including mortgage brokers, payday lenders, collection agencies, tax preparation firms and investment advisers not registered with the SEC.
The FTC, through investigations and enforcement actions; boards or a senior officer receive the Qualified Individual's annual written report.
No set examination cycle; written report to the board at least annually, with the program adjusted after testing, risk assessments and material changes
16 CFR Part 314 as amended in 2021 (86 FR 70308) and 2023 (88 FR 77499), 2024-05-13 (latest provision effective, 314.4(j) FTC notification). Free to read.
Each one needs an owner, an approval, and proof it reached the people it covers.
16 CFR 314.3(a)
A comprehensive written program, in one or more accessible parts, with administrative, technical and physical safeguards suited to the business and the sensitivity of its customer information.
16 CFR 314.4(b)(1)
The risk assessment is written and sets criteria for evaluating risks, assessing controls and deciding how each risk is mitigated or accepted.
16 CFR 314.4(e)(1)
Personnel receive security awareness training that is updated as necessary to reflect risks identified by the risk assessment.
16 CFR 314.4(h)
A written plan sets goals, internal processes, roles and decision authority, communications, remediation, documentation of security events and post-event review.
16 CFR 314.4(i)
The Qualified Individual reports in writing at least annually on overall program status, compliance with the Rule and material matters such as testing results.
16 CFR 314.4(c)(5)-(6)
Any alternative to multi-factor authentication needs the Qualified Individual's written approval, and the data retention policy is reviewed periodically.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
In an investigation the FTC asks for the written program and written risk assessment, then compares them with the safeguards actually in place.
Expect requests for the Qualified Individual's annual written reports and evidence they reached the board or senior officer.
Investigators ask for security awareness training content and records showing personnel completed it.
They ask how service providers were selected, what security terms their contracts carry and how they are periodically assessed under 314.4(f).
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of FTC Safeguards Rule? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Institutions holding customer information on fewer than 5,000 consumers are exempt from the written risk assessment, the continuous monitoring or testing requirement, the written incident response plan and the annual board report. The written program, Qualified Individual, safeguards and training still apply.
For a notification event involving at least 500 consumers, notify the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form. The requirement took effect on 13 May 2024.
Yes. A service provider or affiliate can serve, provided the institution keeps responsibility, designates a senior member of staff to oversee them and requires the provider to maintain a program that protects the institution.
Without effective continuous monitoring, the Rule calls for annual penetration testing and vulnerability assessments at least every six months. Assessments also follow material changes to operations or business arrangements.
The IRS points tax professionals to the Safeguards Rule as the source of their duty to keep a written information security plan. Its Publication 5708 provides a template built on the Rule's elements.
free for 30 days