The FTC Safeguards Rule: The Security Law Many Small Businesses Do Not Know Applies to Them

The compliance obligation hiding in plain sight

Ask the owner of a used-car lot, a small accounting practice, or a two-person mortgage brokerage whether they are subject to a federal information-security law, and most will say no — that is for banks. They are usually wrong, and the gap between what they believe and what the law actually says is exactly where trouble lives. The Federal Trade Commission's Safeguards Rule, issued under the Gramm-Leach-Bliley Act, defines "financial institution" far more broadly than everyday intuition suggests, and its 2021 amendments turned what used to be a vague "have reasonable safeguards" expectation into a list of specific, checkable controls. This article is general education about who the Rule reaches and what it asks for. To be unambiguous from the start: reading it does not make you compliant, and neither does buying software — ours included. Compliance with the Safeguards Rule is a legal determination that belongs to your counsel, and the security work belongs to your team. What a monitoring platform can do is help you organize the required elements as tracked work and evidence the ones your systems can actually demonstrate — a support role, not a certification.

"Financial institution" is much wider than "bank"

The reason so many small businesses miss this obligation is that the statutory definition keys off activity, not signage. Under the Rule, a financial institution is any business "significantly engaged" in an activity that is financial in nature — and the FTC has been explicit that this sweeps in a long list of businesses that would never call themselves financial:

• Automobile dealers that arrange or extend financing (the single most-discussed category, because nearly every dealer does).
• Tax-preparation firms and accountants who handle client financial data.
• Mortgage brokers and lenders, payday lenders, and finance companies.
• Collection agencies, and businesses that offer layaway or installment plans.
• Wire-transfer services, check cashers, and certain investment advisors not registered with the SEC.
• Retailers that issue their own credit cards or extend meaningful in-house credit.

The common thread is handling other people's financial information as part of a financial activity — and the moment you do, the Rule's requirement to protect that "customer information" attaches. The definition is a legal question with edges, which is precisely why the "am I covered?" call routes to your attorney rather than to a blog post or a vendor. But if any of the categories above sound like your business, the honest working assumption is that you are in scope until counsel tells you otherwise.

The nine elements the amended Rule actually requires

The 2021 amendments (with the deadline for the harder pieces landing in 2023) replaced the old open-ended standard with a written information security program built around specific required elements. Read as tasks rather than legalese, they map remarkably well onto fundamentals we have written about repeatedly:

• 1. Designate a Qualified Individual. Someone must be named as responsible for the program — a real accountable owner, whether an employee or a qualified third party. Not a committee, not "IT in general."
• 2. Conduct a written risk assessment. You must actually write down the foreseeable risks to customer information and how you evaluate them — the disciplined version of the risk register every program needs. A verbal "we know our risks" does not satisfy the Rule.
• 3. Implement safeguards to control those risks, and specifically: enforce access controls and least privilege, maintain an inventory of where customer data lives, apply encryption to customer information at rest and in transit, adopt secure development practices for any in-house apps, require multi-factor authentication for anyone accessing customer information, and establish secure disposal and change-management procedures.
• 4. Monitor and test the safeguards — through continuous monitoring or periodic penetration testing and vulnerability assessments.
• 5. Train your people with security-awareness training and keep security staff current.
• 6. Oversee your service providers — select vendors capable of protecting the data and hold them to it by contract, the discipline of vendor risk management.
• 7. Keep the program current — revisit it as your business, systems, and threats change.
• 8. Establish a written incident-response plan — an IR plan that says who does what when customer information is compromised.
• 9. Report to leadership. The Qualified Individual must deliver a written report to a board or senior officer at least annually — the board-reporting cadence the Rule makes non-optional.

There is a partial exemption worth knowing: businesses that maintain customer information on fewer than 5,000 consumers are relieved of a few of the heavier documentation requirements (the written risk assessment, continuous-monitoring/pen-test specifics, the IR plan, and the annual report). Everything else still applies — and whether you clear that threshold is, again, a determination to confirm with counsel rather than assume.

From a legal list to tracked, evidenced work

The failure mode with any compliance list is treating it as a document you write once and file away. The Safeguards Rule specifically resists that — it requires monitoring, currency, and an annual report precisely because point-in-time compliance decays. The way a lean team makes it real is the same discipline that carries any program:

• Turn each required element into an owned, tracked item. "Implement MFA for all access to customer information" is not a paragraph in a binder; it is a finding with an owner and a due date until it is demonstrably done. Running the nine elements through a real findings workflow is what converts the regulation into progress you can see.
• Keep the evidence current, not reconstructed. When a regulator or an insurer asks, you want to show that MFA is enabled now, that the risk assessment was updated this year, that access reviews actually ran — the discipline of continuous evidence collection rather than a scramble.
• Watch for drift between reviews. MFA quietly disabled on one account, a new system that never made the data inventory, encryption that lapsed on a backup — continuous monitoring is what keeps a required safeguard from silently failing between annual reports.

This is the honest boundary of what a platform contributes. Ours can hold the nine required elements as tracked work, surface the ones your systems can be observed to satisfy, keep the supporting evidence fresh, and show you the gaps worst-first so the Qualified Individual's annual report is a summary of real state rather than a fiction. It does not perform the encryption rollout, write your risk assessment for you, or — most importantly — make the legal judgment that you are compliant. The controls are your team's to run; the compliance determination is your counsel's to make. The tool organizes and proves.

Prepare deliberately, and get the legal call from a lawyer

If any part of this describes your business, the productive next move is not panic and not denial — it is a deliberate readiness pass. Confirm scope with your attorney. Name a Qualified Individual for real. Write the risk assessment down. Then take the nine elements and work them the way you would any compliance framework: assess honestly against each, make every gap a tracked finding with an owner and a date, and keep the evidence living. Much of the underlying work overlaps cleanly with a NIST CSF backbone or SOC 2 readiness, so nothing you build is wasted if a customer later asks for one of those too.

The FTC Safeguards Rule reaches far past banks — auto dealers, tax preparers, accountants, and many other small businesses are "financial institutions" under it, and the amended Rule names specific controls: a Qualified Individual, a written risk assessment, MFA, encryption, vendor oversight, an incident-response plan, and an annual report to leadership. Whether it applies to you, and whether you comply, are legal calls for your counsel — no article and no tool decides them. What software can do is turn the nine required elements into tracked, evidenced work so that when a regulator, insurer, or auditor asks, you can show real state instead of a binder nobody has opened since it was written.