FTC Safeguards Rule: is your information security program ready?
If you prepare tax returns, finance cars, broker mortgages or lend money, the FTC expects a written information security program with nine elements — MFA for everyone, encryption, a named person in charge, and a 30-day notice to the FTC after a large breach. This free check walks through them in plain English and checks your website's encryption. About ten minutes. No login, nothing stored.
16 CFR Part 314 (as amended 2023–2024) · grc-scan 2026.1. A readiness / gap report — not legal advice, not an FTC determination.
First, two scope questions
Is your business one of the “financial institutions” the rule covers?
- Tax preparers and accountants who prepare returns
- Auto dealers that finance or lease vehicles
- Mortgage brokers and non-bank mortgage lenders
- Payday, installment and other non-bank lenders
- Collection agencies and credit counselors
- Check cashers, money transmitters and wire-transfer services
- Finance companies, and some fintech and investment advisers not regulated elsewhere
Banks and credit unions answer to their own regulators, not this rule.
Do you keep customer information on 5,000 or more consumers?
Past and present customers whose information you still hold — not this year's count.