Many small business owners assume federal data-security rules are for banks. The FTC Safeguards Rule says otherwise. If your business offers financial products or services to consumers, it probably applies to you, and the FTC has expanded what it expects.
Who is covered?
The rule comes from the Gramm-Leach-Bliley Act and applies to "financial institutions" under the FTC's jurisdiction. That is a much wider group than banks. It commonly includes:
- Tax preparation firms and many bookkeepers
- Mortgage brokers, lenders and loan servicers
- Auto dealers that arrange financing or leasing
- Payday and consumer lenders, check cashers and collection agencies
- Some financial advisers, investment and real estate settlement services
If you are unsure, the FTC's own guide for businesses walks through examples.
What the rule requires
At its heart, the rule asks you to run a written information security program that protects customer information. The main pieces are:
- A Qualified Individual who oversees the program. This can be an employee or an outside provider, but your business remains responsible.
- A written risk assessment of where customer data lives and what could go wrong.
- Safeguards based on that assessment, including access controls, encryption of customer data at rest and in transit, and multi-factor authentication for anyone accessing customer information.
- Monitoring and testing, through continuous monitoring or regular penetration testing and vulnerability scans.
- Staff training and oversight of service providers who handle your data.
- An incident response plan and a regular written report to your board or owner.
- Breach notification to the FTC when unencrypted information about 500 or more consumers is involved.
Smaller firms get some relief
Businesses that maintain customer information on fewer than 5,000 consumers are exempt from a few requirements, including the written risk assessment, the incident response plan and the annual report. The core safeguards, like MFA, encryption and access control, still apply.
Where to start
- List every system that holds customer data: email, file shares, tax or loan software, your CRM and any paper records that get scanned.
- Turn on multi-factor sign-in everywhere customer data can be reached.
- Confirm laptops and backups are encrypted.
- Remove access promptly when staff leave.
- Ask each vendor that touches your data how they protect it, and get it in writing.
- Write it down. A simple, honest program document beats a perfect one that does not exist.
This article is general information, not legal advice. Your attorney or accountant can confirm how the rule applies to your business.
How we help
Bitnode Technologies helps US small businesses put the technical safeguards in place: MFA, encryption, backups, monitoring and documented access controls, with remote support nationwide. Book a free 30-minute consultation and we will review your setup against the rule's core safeguards.
Useful references
- FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission
- Cybersecurity for Small Business, Federal Trade Commission
- Secure Our World, CISA
Cover photo by Sasun Bughdaryan on Unsplash.