FTC Safeguards Rule Support
Know What Needs Protecting. Know What to Do.
Customer information ends up in email, on computers, and in paper files. The FTC Safeguards Rule calls for a plan to protect it. Let’s work through what that means for your business.
Start with three questions
Can You Explain How Customer Information Is Protected?
Where Is It?
List where customer information is kept, including email, shared folders, paper files, and outside services. You cannot protect a copy you have forgotten about.
Who Can Reach It?
Check staff accounts, former employees, and outside support access. Each person should have the access their work requires, with old access removed.
Who Checks It?
Name the person responsible for the program. Keep records of checks, problems found, and work still needed so responsibility does not disappear between meetings.
What the rule covers
Start With the Information You Keep
A finance application can leave several copies behind: one in your business software, another attached to an email, and a printed copy on someone’s desk. Protecting the main system does not automatically protect the other two.
The rule generally covers dealers that arrange financing or lease vehicles for longer than 90 days. Coverage follows what your business does, not simply the word “automotive” on the sign. A repair or collision shop is not automatically covered just because it works on cars.
Covered businesses need a written information security program that fits their operations. The FTC’s dealer guidance explains coverage and customer information. If your activities leave that question unclear, have your legal adviser confirm it before setting the scope.
Put the plan into practice
What Your Security Program Needs
The program needs a Qualified Individual: someone with the knowledge to oversee it. It also needs a risk assessment, meaning a review of what could expose customer information and how you will address it.
- Safer sign-ins: Multi-factor authentication adds a second check beyond a password.
- Protected information: Encryption makes stored and transmitted information unreadable without the right key.
- Useful checks: Test or monitor whether safeguards work, rather than assume installed software is doing its job.
- Outside access: Review service providers, their contracts, and how they protect your information.
- A plan for trouble: Know who responds to an incident. Where required, maintain a written response plan and give leadership a written report at least annually.
The rule sets conditions for alternatives to encryption and multi-factor authentication, and specific testing requirements. It also has limited exceptions for institutions holding information on fewer than 5,000 consumers, explained below. See 16 CFR Part 314 for the requirements.
Make the Written Plan Match the Work
A policy that says former employees lose access is only useful if someone actually removes it. Staff also need training they can use when an email asks them to send a file or change payment details.
ParJenn helps review your systems, put agreed protections in place, develop or refine the written plan, and train staff. We keep track of the work and revisit it when your systems change. Your business retains responsibility for its program; buying IT support does not transfer that responsibility.
A check you can make today
Ask to See the Work, Not Just the Policy
You do not need to know every setting to ask useful questions. Start with these:
- Can we find our current written program and name the person responsible?
- Do we know where customer information is stored, including paper and email?
- When did we last review who can access it?
- Can we show the last security checks, staff training, and unresolved findings?
- If information is exposed today, does everyone know whom to call?
If the answer is “I’m not sure,” that gives us a place to start. We can review what is there, explain the gaps, and agree on the work before making changes.
Keep the records together: who checked, what they found, what changed, and what still needs attention. The FTC’s business guide is a useful reference alongside those records.
Related services: Firewall Management · Security Awareness Training.
Questions worth asking
Before You Start Safeguards Work
No. Maintaining customer information on fewer than 5,000 consumers exempts a covered institution from certain detailed requirements: the prescribed written risk assessment, specified testing provisions, written incident response plan, and annual written leadership report. It does not exempt the business from the rule as a whole. A written security program and other safeguards still apply.
The threshold concerns information you maintain, not just this year’s sales. Check section 314.6 when deciding which provisions apply.
No. Software can protect an account or detect a problem. It cannot decide who should have access, train your staff, or make management follow up on an unresolved risk.
We help with the agreed safeguards, written plan, training, and supporting records. We do not promise a compliance certificate simply because you buy a service.
Bring whatever you have: your written program, account and equipment lists, software providers, and recent security or backup reports. Missing paperwork is something we can identify during the review; you do not need to tidy everything up before calling.
For an active incident, get help immediately. Unauthorized acquisition of at least 500 consumers’ unencrypted information must be reported to the FTC as soon as possible and within 30 days of discovery. An exposed encryption key can also bring encrypted information into scope. See the FTC’s notification guidance.