FTC Safeguards Rule Readiness Checklist

The FTC Safeguards Rule (16 CFR Part 314) requires a written information-security program with specific, named elements — and the FTC enforces it. Score your firm against the nine required components.

First: are you even covered? (Most firms don't realize they are.)

"Financial institution" is defined broadly — it's not just banks. It includes accountants and tax-preparation firms, financial advisors and RIAs, mortgage brokers and lenders, auto dealers, wire transferors, collection agencies, and payday/installment lenders, among others. If your firm handles customers' financial information, assume it applies until an attorney tells you otherwise.

How to use this: check a box only if you could produce the document or demonstrate the control today. What you can't produce is what an FTC inquiry — or your cyber-insurer — will ask for first. Unchecked boxes are your roadmap.

Section 1

Program foundations

The written spine of the program — the parts the FTC and your insurer ask to see first.

A designated Qualified Individual responsible for the information-security program §314.4(a)One named, accountable person — can be in-house or a qualified outside provider.
A written risk assessment identifying reasonably foreseeable risks to customer information §314.4(b)
A written incident response plan §314.4(h)
The Qualified Individual reports in writing at least annually to your board or senior leadership §314.4(i)
You periodically evaluate and adjust the program as your business and risks change §314.4(g)

Section 2

Required safeguards

The eight controls the rule requires you to design and implement §314.4(c).

Access controls — least privilege; people can reach only the customer info their role needs
A data inventory — you know what customer information you have and where it lives
Encryption of customer information at rest and in transit
MFA for anyone accessing systems with customer information
Secure disposal of customer information no longer needed (and generally within two years)
Change management procedures for your systems
Logging and monitoring of authorized user activity, and detection of unauthorized access

Section 3

Testing the safeguards

Prove the controls actually work §314.4(d).

Continuous monitoring — or — an annual penetration test plus vulnerability assessments at least every six months

Section 4

People & service providers

Your staff and your vendors are in scope too §314.4(e),(f).

Security-awareness training for staff, and qualified personnel running security
Service-provider oversight — selected for their safeguards, required by contract to maintain them, and periodically reassessed

Two things firms get wrong

"We're not a bank, so this doesn't apply." The definition is broad — most accounting, tax, advisory, lending, and dealer businesses are covered. And "our IT company handles security." The rule requires a named Qualified Individual, a written risk assessment, and an annual written report to leadership — governance documents an IT vendor doesn't produce. The FTC (and your cyber-insurer) ask for those first.

No Qualified Individual or no written risk assessment — the program has no spine yet. Start here.

Foundations in place, safeguards or testing gaps — real, citable exposure. Prioritize MFA, encryption, logging, and the annual test.

All fifteen checked, with evidence — you have a defensible program. Keep the risk assessment and annual report current.

Not sure how you'd really score — or how to close the gaps?

I build FTC Safeguards programs for small financial, accounting, and advisory firms — the written risk assessment, the safeguards, the incident response plan, and the governance documents — and I can serve as your Qualified Individual on retainer. Enterprise-grade rigor, small-firm price.

Book a free 15-minute call: [email protected] · trentcyber.com

Reflects the FTC Safeguards Rule, 16 CFR Part 314 §314.4. Firms maintaining information on fewer than 5,000 consumers are exempt from some elements (written risk assessment, penetration testing, incident response plan, annual report) — confirm your status with counsel. Not legal advice; verify current requirements before relying.

This checklist is an educational self-assessment provided by Trent Cyber Advisory, a technical security and compliance advisory practice. It is not legal advice; whether the Rule applies and how it applies to your firm are determinations for the firm and its counsel. © 2026 Trent Cyber Advisory.