Meet the GLBA Safeguards Rule with evidence you can show the FTC

The FTC Safeguards Rule is a federal regulation at 16 CFR Part 314, issued under the Gramm-Leach-Bliley Act, that requires non-bank financial institutions to keep a written information security programme protecting customer information. The programme must include administrative, technical and physical safeguards appropriate to the size and complexity of the business, the nature of its activities and the sensitivity of the customer information it holds.

Financial institutions under the FTC's jurisdiction must comply. These are mainly non-bank businesses significantly engaged in financial activities, such as mortgage lenders and brokers, auto dealers offering financing, payday lenders, tax preparers, collection agencies, non-bank lenders and many fintech firms. Banks and credit unions are generally covered by their own banking regulators' safeguards guidelines instead of the FTC rule.

Section 314.4 requires a Qualified Individual to oversee the programme, a written risk assessment, safeguards including access controls, a data and systems inventory, encryption, secure development, multi-factor authentication, secure disposal, change management and activity logging. Firms must also test safeguards, train staff, oversee service providers, keep a written incident response plan, report to the board at least annually and notify the FTC of qualifying security events.

Since 13 May 2024, a covered financial institution must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving the information of at least 500 consumers. A notification event is the acquisition of unencrypted customer information without the authorisation of the individual it relates to. Notice is submitted electronically using the FTC's online form.

Only partly. Institutions that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment, penetration testing and vulnerability scanning, written incident response plan and annual board report requirements. They must still run an information security programme with a Qualified Individual, access controls, encryption, multi-factor authentication, staff training, service provider oversight and FTC breach notification.

The Safeguards Rule is a legal requirement, while ISO 27001 and SOC 2 are voluntary frameworks, but they overlap heavily. Risk assessment, access control, encryption, MFA, logging, change management, vendor oversight and incident response appear in all three. An organisation with a mature ISO 27001 or SOC 2 programme will already meet much of section 314.4, though rule-specific items such as FTC notification and board reporting still need attention.

No. There is no official certification or audit scheme for the Safeguards Rule. Each institution is responsible for maintaining its own programme and evidence, and the FTC enforces compliance through investigations and enforcement actions. Many firms use an independent assessment, penetration test or an ISO 27001 or SOC 2 report to demonstrate their safeguards to partners and examiners.

Yes, on request. The Safeguards Rule is mapped in OneClickComply's control library and can be enabled for your account, but it is not yet a live self-serve framework. Once enabled, its requirements share controls and evidence with frameworks such as ISO 27001 and SOC 2, and our in-house audit team can guide you through the risk assessment, incident response plan and board reporting.