Are CPAs and tax preparers covered?

The rule lists an accountant or other tax preparation service that is in the business of completing income tax returns as an example of a financial institution. If your firm prepares individual tax returns, assume the rule applies and confirm the details with counsel.

Are auto dealers covered?

The rule gives the example of a dealership that, as a usual part of its business, leases vehicles on a non-operating basis for longer than 90 days, and it treats arranging or brokering credit for a consumer to buy a vehicle as a customer relationship. Dealers that lease or arrange financing should assume the rule applies to that part of the business.

Who can be our Qualified Individual?

The rule says the Qualified Individual may be employed by you, an affiliate, or a service provider. If you use an affiliate or service provider, you still retain responsibility for compliance, must designate a senior member of your staff to direct and oversee that person, and must require the provider to maintain its own information security program.

Is MFA really required for everyone?

The rule requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves in writing the use of reasonably equivalent or more secure access controls. Information system is defined broadly, including systems connected to ones that hold customer information.

When do we have to notify the FTC of a breach?

When a notification event involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery, using the electronic form on the FTC website. This requirement has been in effect since May 13, 2024, and the fewer-than-5,000 exemption does not remove it.

Does CyberCascadia run penetration tests or set up MFA?

No. CyberCascadia is advisory-only and does not touch your systems. We define what the rule requires, write the risk assessment and incident response plan, specify the controls your IT provider or MSP implements, and review the evidence that the work was done. Testing is performed by your IT provider or an independent testing firm.

FTC Safeguards Rule Checklist for Small Businesses

Q: Does the FTC Safeguards Rule apply to small businesses?

Yes, if the business is a financial institution under the rule. There is no general small business exemption. Institutions that maintain customer information on fewer than 5,000 consumers are excused from four specific requirements, but they still need a written information security program with every other element.

This is general information, not legal advice; CyberCascadia is not a law firm. Talk to your attorney about whether and how the rule applies to your business. Last reviewed against 16 CFR Part 314 and FTC guidance in October 2026.

What is the FTC Safeguards Rule?

The Safeguards Rule, 16 CFR Part 314, is the FTC's information security rule under the Gramm-Leach-Bliley Act. It requires covered financial institutions to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards appropriate to their size, complexity, activities, and the sensitivity of customer information.

The rule was substantially updated in 2021 to spell out specific elements, such as a Qualified Individual, multi-factor authentication, and encryption, and amended again in 2023 to add a requirement to notify the FTC of certain security events.

Is my business a "financial institution" under the Safeguards Rule?

Probably, if you are significantly engaged in an activity that is financial in nature. The definition in 16 CFR 314.2 is much broader than banks. It reaches mortgage brokers, tax preparers, auto dealers that lease vehicles, appraisers, check cashers, and others. The rule covers the financial institutions over which the FTC has enforcement jurisdiction under the Gramm-Leach-Bliley Act.

The rule ties the definition to activities that are "financial in nature" under the Bank Holding Company Act, and it lists thirteen examples in 16 CFR 314.2(h)(2):

A retailer that extends credit by issuing its own credit card directly to consumers
An automobile dealership that, as a usual part of its business, leases vehicles on a non-operating basis for longer than 90 days (for its leasing business)
A personal property or real estate appraiser
A career counselor that specializes in counseling people employed by, or seeking employment with, financial organizations or finance, accounting, or audit departments
A business that prints and sells checks for consumers
A business that regularly wires money to and from consumers
A check cashing business
An accountant or other tax preparation service that is in the business of completing income tax returns
A travel agency operated in connection with financial services
An entity that provides real estate settlement services
A mortgage broker
An investment advisory company and a credit counseling service
A "finder" that brings together buyers and sellers for transactions the parties negotiate themselves

The FTC's business guidance adds mortgage lenders, payday lenders, finance companies, account servicers, collection agencies, non-federally insured credit unions, and investment advisors that are not required to register with the SEC to that picture.

Auto dealers. Beyond the leasing example, the rule's definition of a customer relationship includes a consumer who enters into an agreement with you to arrange or broker credit to purchase a vehicle (16 CFR 314.2(e)(2)(i)(E)). Dealers that arrange financing should plan as though the rule applies.

What is not covered. The rule says businesses are not financial institutions if they are not significantly engaged in financial activities. Its examples include a retailer whose only credit is occasional layaway or deferred payment plans, a merchant that accepts credit cards it did not issue, and a merchant that lets customers run a tab.

What does the Safeguards Rule require?

Section 314.4 lists the required elements of your information security program: a Qualified Individual, a written risk assessment, specific safeguards including MFA and encryption, regular testing, staff training, service provider oversight, a written incident response plan, an annual written report to your board, and FTC notification for larger events.

Here is each element in plain terms, with the paragraph of 16 CFR 314.4 it comes from.

1. Designate a Qualified Individual (314.4(a))

One person must be responsible for overseeing, implementing, and enforcing your program. That person may be employed by you, an affiliate, or a service provider. If you use an affiliate or service provider, you must retain responsibility for compliance, designate a senior member of your own staff to direct and oversee the Qualified Individual, and require the provider to maintain an information security program that protects you. The FTC puts it simply: "the buck still stops with you."

2. Base the program on a written risk assessment (314.4(b))

Identify reasonably foreseeable internal and external risks to customer information and assess whether your current safeguards control them. The written assessment must include criteria for evaluating and categorizing risks, criteria for assessing confidentiality, integrity, and availability of your systems and customer information, and requirements for how each risk will be mitigated or accepted. You must also perform additional risk assessments periodically.

3. Design and implement safeguards (314.4(c))

The rule names eight areas:

Access controls that limit authorized users to the customer information they need, reviewed periodically
An inventory of the data, personnel, devices, systems, and facilities you rely on
Encryption of all customer information at rest and in transit over external networks; if that is infeasible, compensating controls reviewed and approved by your Qualified Individual
Secure development practices for in-house applications, and a way to evaluate the security of outside applications that handle customer information
Multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent or stronger control in writing
Secure disposal of customer information no later than two years after it was last used to serve the customer, with limited exceptions, and periodic review of your data retention policy
Change management procedures
Monitoring and logging of authorized user activity to detect unauthorized access, use, or tampering

Note that "information system" in 314.2(j) includes systems that contain customer information and systems connected to them. MFA scope is wider than many businesses assume.

4. Test and monitor (314.4(d))

Regularly test or monitor whether your key controls work. For information systems, that means either continuous monitoring or, if you do not have effective continuous monitoring, annual penetration testing plus vulnerability assessments at least every six months and whenever there are material changes to your operations or business arrangements.

5. Train your people (314.4(e))

Provide security awareness training updated to reflect the risks in your risk assessment, use qualified security personnel (yours, an affiliate's, or a service provider's), and make sure key security staff keep their knowledge current.

6. Oversee service providers (314.4(f))

Select providers capable of protecting customer information, require safeguards by contract, and periodically assess each provider based on the risk it presents.

7. Keep the program current (314.4(g))

Adjust the program based on testing results, material business changes, new risk assessments, and anything else that could materially affect it.

8. Write an incident response plan (314.4(h))

A written plan to respond to and recover from security events materially affecting customer information. It must cover goals, internal response processes, roles and decision-making authority, internal and external communications, remediation of identified weaknesses, documentation and reporting, and review of the plan after an event.

9. Report to the board at least annually (314.4(i))

The Qualified Individual must report in writing, regularly and at least annually, to your board of directors or equivalent governing body. If there is no board, the report goes to a senior officer responsible for the program. It must cover the overall status of the program and your compliance, plus material matters such as risk decisions, service provider arrangements, test results, security events, and recommended changes.

10. Notify the FTC of notification events (314.4(j))

Covered in detail below.

What is the exemption for fewer than 5,000 consumers?

If you maintain customer information on fewer than 5,000 consumers, four requirements do not apply: the written risk assessment, the annual penetration testing and six-month vulnerability assessment schedule, the written incident response plan, and the annual written report to the board. Everything else in the rule still applies.

The exemption is in 16 CFR 314.6 and covers paragraphs 314.4(b)(1), (d)(2), (h), and (i). Read it narrowly. A small institution still needs:

A Qualified Individual
A risk assessment as the basis of the program (only the specific written-content requirements of (b)(1) are excused)
All eight safeguards in 314.4(c), including MFA, encryption, and secure disposal
Regular testing or monitoring of key controls under 314.4(d)(1)
Training, service provider oversight, and program updates
FTC notification for events affecting 500 or more consumers

"Consumer" here means an individual who obtains a financial product or service from you primarily for personal, family, or household purposes, as defined in 314.2(b). Even small firms should keep an incident response plan; you will need one to meet the 30-day notification clock.

When do you have to notify the FTC about a breach?

If unencrypted customer information about at least 500 consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. The notice is filed electronically through a form on ftc.gov. This requirement took effect May 13, 2024.

The details, from 314.4(j), 314.5, and the 2023 amendment published in the Federal Register (88 FR 77499):

What triggers it. A "notification event" is acquisition of unencrypted customer information without the authorization of the person it pertains to. Information counts as unencrypted if the encryption key was accessed by an unauthorized person. Unauthorized access is presumed to include acquisition unless you have reliable evidence it did not, or could not reasonably have, occurred.
When the clock starts. The event is treated as discovered on the first day it is known to you, and you are deemed to know if any employee, officer, or other agent knows, other than the person who committed the breach.
What the notice includes. Your name and contact information, the types of information involved, the date or date range if it can be determined, the number of consumers affected or potentially affected, a general description of the event, and whether law enforcement has determined in writing that public notice would impede a criminal investigation or damage national security.
Law enforcement delay. A law enforcement official may request an initial delay of up to 30 days after notice is given to the FTC, extendable by up to 60 more days on written request.

This federal notice is separate from any state breach notification laws that apply to you.

Can a vCISO serve as your Qualified Individual?

The rule allows the Qualified Individual to be employed by a service provider, so an outside vCISO may serve in that role or support an internal person who holds it. Either way, the rule keeps compliance responsibility with your business and requires a senior member of your own staff to direct and oversee the Qualified Individual.

That gives you two workable models:

The vCISO is the Qualified Individual. The outside advisor oversees the program, reviews and approves any encryption compensating controls, approves any MFA alternative in writing, and delivers the annual board report. You name a senior owner, often the owner, managing partner, or CFO, who directs and oversees that work, and your contract requires the provider to maintain its own security program as 314.4(a)(3) demands.
An internal person is the Qualified Individual, supported by a vCISO. Someone on your team holds the title and accountability. The vCISO supplies the risk assessment, policies, incident response plan, vendor review, and board report drafts that person needs.

Which model fits depends on your size, who on staff has time and authority, and what your counsel is comfortable with. Neither model moves legal responsibility off your business. CyberCascadia's vCISO advisory runs at a fixed monthly fee, typically $2,500 to $5,000 for 10 to 50 employees, and can be scoped to either model. We are advisory-only: your IT provider or MSP implements and operates the controls, and we define, document, and verify.