FTC Safeguards Rule Compliance IT Support in Reno
The FTC Safeguards Rule requires non-bank financial businesses, such as tax preparers, mortgage brokers and auto dealers that finance, to protect customer information with a written security program. Computer Services Reno sets up and maintains the IT controls behind it for businesses in Reno, Sparks and Carson City: MFA, encryption, access control, logging and patching.
Who needs to comply with the FTC Safeguards Rule?
The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It covers financial institutions under FTC jurisdiction, which means businesses that offer financial products or services to consumers but are not banks.1 Examples the FTC gives include:
- Tax preparation firms
- Mortgage lenders, mortgage brokers and account servicers
- Payday lenders and finance companies
- Collection agencies, credit counselors and other financial advisors
- Investment advisors that are not required to register with the SEC
- Check cashers, wire transferors and non-federally insured credit unions
Auto dealers that arrange financing or leasing for customers are also commonly covered. Accounting firms that prepare tax returns or offer other financial services should check with their advisors whether the rule applies to them.
When did the updated rule take effect?
The FTC rewrote the rule in 2021. Most of the new requirements took effect on June 9, 2023, and the FTC breach notification requirement took effect on May 13, 2024.2
The rule protects "customer information", meaning nonpublic personal information about your customers, in paper or electronic form. For most small firms that is tax returns, Social Security numbers, bank details and loan files, stored on office computers, a file server, email and cloud apps.
If you run an accounting or tax practice, our accounting firm IT support page covers the day-to-day side of that work.
What are the FTC Safeguards Rule requirements?
Section 314.4 lists the elements of the written information security program.3 The right-hand column shows which ones a firm with fewer than 5,000 consumers is exempt from under Section 314.6.
| Required element | Applies under 5,000 consumers? |
|---|---|
| Designate a Qualified Individual | Yes |
| Written risk assessment | Exempt |
| Safeguards: access control, data inventory, encryption, MFA, secure disposal, change management, activity logging | Yes |
| Continuous monitoring, or annual penetration test and vulnerability assessments every six months | Exempt |
| Security awareness training for staff | Yes |
| Oversight of service providers | Yes |
| Keep the program current | Yes |
| Written incident response plan | Exempt |
| Annual written report to the board or senior officer | Exempt |
| Notify the FTC of a breach affecting 500 or more consumers | Yes |
The exemption is narrower than many firms assume. A small tax office still needs MFA, encryption, access control, disposal rules and training, along with a Qualified Individual.
What are the FTC Safeguards Rule IT requirements?
The safeguards in Section 314.4(c) are where most of the technical work sits. These are the controls Computer Services Reno sets up and maintains as part of managed IT services.
Multi-factor authentication
The rule requires MFA for anyone accessing an information system. We turn it on and support it for email, remote access, tax software and admin accounts.
Encryption
Customer information must be encrypted in transit over external networks and at rest. We encrypt laptops and workstations and set up secure file transfer and email options.
Access control
Staff should reach only the customer data their job needs. We set up individual accounts and permissions, and remove access when someone leaves.
Logging and monitoring
The rule calls for logging and monitoring user activity. Your business decides how that activity is reviewed. We turn on logging on key systems, and our 24/7 monitoring covers the health of devices and network equipment.
Patching
Regular updates on computers, servers and network equipment close known weaknesses in software and firmware.
Secure disposal
Customer information must generally be disposed of no later than two years after its last use, unless you need it for a legal or business reason. We can help with secure wiping before drives are reused or recycled.
Change management support
The rule requires change management procedures. We keep a record of system changes we make, which supports the procedures your firm adopts.
Asset and data inventory
We keep a current list of computers, servers and cloud systems, which helps you build the data and systems inventory the rule asks for.
Backups
Tested backup and disaster recovery protects customer files from ransomware and hardware failure.
Can an outside provider be your Qualified Individual?
The rule allows the Qualified Individual to be an employee or someone at an affiliate or service provider. If you choose an outside person, your business keeps responsibility for compliance, must designate a senior member of its own staff to direct and oversee that person, and must require the provider to maintain its own security program.2
Computer Services Reno is not your Qualified Individual. We do not write your risk assessment, your written information security program or your board report. We run the IT controls your Qualified Individual relies on and give them clear records of how those controls are configured.
When must you notify the FTC of a breach?
Since May 13, 2024, a covered business must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information about at least 500 consumers is acquired without authorization.2 The notice goes through a form on the FTC's website.
Your business decides whether an event is reportable and files the notice. We help find out which systems and accounts were involved. Encryption matters here too: the FTC rule treats information as unencrypted if the encryption key was also taken.
State breach laws can add separate duties to notify customers. Ask your advisor which apply.
How do you start on FTC Safeguards Rule IT controls?
Check your current setup
Our free on-site IT assessment reviews your computers, network, backups and security and ranks what to fix. It is a starting point, not a substitute for the FTC written risk assessment your business is responsible for.
Turn on the required controls
MFA and encryption are the two items the rule names most directly, so they usually come first. Our small business cybersecurity page explains the controls in plain terms.
Keep records current
Staff turnover, new software and new devices change the picture. Ongoing support keeps controls and documentation up to date for your Qualified Individual. See how managed IT pricing works, or read the IT compliance overview.
This page is general information, not legal advice.
FTC Safeguards Rule FAQ
See where your IT stands, at your office.
Book a free on-site IT assessment. A local technician comes to you, looks at your setup, and gives you a plain-English list of what to fix first. No cost, no contract.