IT Blog

Tax returns. Mortgage applications. Client financial records. Consumer payment plans.

If your business handles sensitive financial information, the FTC Safeguards Rule may apply, even if you are a small firm without a dedicated IT department. The rule is not limited to large banks. It can reach businesses such as tax preparers and mortgage brokers, and it may also apply to certain activities in law, real estate, accounting, or health care.

The key is what your business does, not simply what it calls itself.

First, a crucial distinction: being a professional firm does not automatically make you subject to the Rule. Coverage depends on whether your business is a financial institution under the Gramm-Leach-Bliley Act (GLBA), is subject to FTC jurisdiction, and handles covered customer information. That makes an activity-based review important.

What the FTC Safeguards Rule requires

The Rule requires covered financial institutions to develop, implement, and maintain a written information security program. In plain language, you need a documented, ongoing approach to protecting customer information, not a one-time checklist or a folder of security policies no one follows.

The FTC’s guide to the Safeguards Rule describes requirements that include:

1. A designated qualified individual. Someone must be responsible for overseeing and implementing the security program. That person may be an employee, an affiliate, or a service provider, but responsibility and reporting still need to be clear.
2. A risk assessment. Identify the information you hold, where it is stored, who can access it, and how it could be exposed. Then use that assessment to decide what safeguards are appropriate.
3. Access controls and authentication. Limit access to people who need it for their roles. Use secure authentication, including MFA, to make stolen passwords less useful to attackers.
4. Encryption and endpoint security. Protect customer information while it is stored and transmitted, as required by the Rule, and secure the devices that access it.
5. Vendor oversight. Evaluate service providers that may access customer information and put appropriate safeguards in place. A vendor relationship does not make the risk disappear.
6. Employee training and security testing. Staff need practical guidance on recognizing threats and handling information safely. Your safeguards also need to be monitored and tested.
7. An incident response plan. Define who does what when an event occurs, how you contain it, and how you assess notification obligations.

The Rule’s requirements are risk-based and should reflect your business’s size, complexity, activities, and the sensitivity of the information you handle. But “we’re a small office” is not the same as “we don’t need a security program.”

Does the Rule apply to your type of business?

Some business categories are clearer than others. The FTC specifically identifies tax-preparation firms and mortgage brokers among examples of financial institutions. Other businesses require a closer look at their actual services.

• Tax preparers: A firm preparing consumer tax returns is a clear example to investigate. Tax preparation may bring the business within the Rule’s scope.
• Accounting firms: Accounting services alone do not automatically establish coverage. But if your firm also prepares consumer tax returns or performs another covered financial activity, the analysis may change. That makes accounting firm IT planning especially relevant when your work involves sensitive customer financial data.
• Mortgage brokers and lenders: These are among the FTC’s examples. If you handle customer information in those activities, take the question seriously.
• Real estate and title companies: The label “title company” does not answer the question by itself. Some services connected with real estate financing may fall within the Rule’s scope; others may not.
• Law firms: Handling confidential client information does not, by itself, make a firm subject to the Safeguards Rule. A firm performing covered financial activities may need a different analysis. That is separate from the broader need for strong law firm cybersecurity and confidentiality safeguards.
• Medical practices: A medical office is not automatically covered just because it holds patient information. If it offers consumer financing or engages in another potentially covered financial activity, get advice on whether the Rule applies. HIPAA compliance remains a separate consideration where the practice is subject to HIPAA.

For a useful starting point, review the FTC’s Safeguards Rule guide and have qualified counsel assess your activities. This article is general information, not a legal determination of your firm’s coverage.

Since May 2024, some security events must be reported to the FTC

There is a separate requirement that business owners should know about. Since May 13, 2024, a covered financial institution must notify the FTC of a qualifying security event involving the unencrypted customer information of 500 or more consumers.

The institution must notify the FTC as soon as possible, and no later than 30 days after discovering the event. The threshold does not mean every incident must be reported under this specific Rule. Whether an event qualifies depends on its facts, including the type of information involved and whether it was acquired without authorization. The FTC explains the requirement in its notification guidance, and provides a security event reporting form.

A quiet office can still have a serious incident. A compromised mailbox. A stolen laptop. A vendor account that was never disabled. You need a response plan before a crisis so you can investigate promptly, bring in the right people, and evaluate applicable reporting duties.

Why “I got a guy” is not a security program

“I got a guy.” It’s a familiar answer when someone asks who handles IT. Maybe that person fixes a printer, resets a password, or helps when the office Wi-Fi stops working.

Helpful? Absolutely. A complete security program? Not necessarily.

The problem is that temporary fixes rarely provide a joined-up view. MFA may be enabled for some accounts but not others. Employees may share credentials. Former staff may retain access. Backups might exist but never have been tested. Email security could be filtering obvious spam while missing a convincing fraudulent invoice.

It is a little like medical care. A trusted doctor can help you recover from an urgent problem. But you still need preventive care, records, and a plan for what comes next. Cybersecurity works the same way: helpdesk support matters, but it needs to sit inside a consistent program.

Practical steps to close the gap

You do not have to solve every security issue in one afternoon. Start with a clear view of your exposure, then prioritize.

1. Confirm your coverage. List the services you provide, the customer information you handle, and how it flows through your business. Ask qualified counsel whether those activities bring you within the Rule.
2. Inventory access and devices. Identify who can reach sensitive data, from which devices, and through which accounts. Remove access that is no longer needed.
3. Strengthen the basics. Enforce MFA, keep devices updated, deploy endpoint security, and configure email security to reduce phishing and account-takeover risk.
4. Review vendors and backups. Know which providers can access customer information. Confirm backups are protected and periodically test that you can restore what matters.
5. Document and practice your response. Write down who investigates an incident, who makes decisions, and how you will evaluate notification requirements. A plan nobody has rehearsed is hard to use under pressure.
6. Schedule an IT assessment. A structured review can identify gaps, prioritize fixes, and establish a realistic roadmap for your business.

A managed services provider can help put those practices into operation through business IT support, monitoring, security configuration, documentation, and ongoing review. For firms that lack internal IT leadership, outsourced IT can provide a more consistent approach than relying on ad hoc help. Businesses in finance may also benefit from IT for financial advisors that takes sensitive client data and regulatory obligations into account.

The right provider can help implement safeguards; it cannot take away your responsibility to understand your obligations and oversee your program. And no single tool (MFA, encryption, or otherwise) makes a firm compliant on its own.

The upside, and the trade-offs

Building an internal program gives you direct control and can work well if you have the right people and time. But recruiting and retaining experienced security staff can be costly, and the responsibility does not stop when your IT generalist is on vacation or leaves the company.

Working with a managed services provider can bring structure, specialized expertise, and more predictable costs. The trade-off: you still need to choose a provider carefully, understand what they cover, and maintain oversight of the relationship.

Final word: Treat compliance as a way to reduce risk

The FTC Safeguards Rule is not a badge to earn and forget. It is a framework for protecting customer information through practical, ongoing controls. For many firms, that means reviewing their activities, documenting an information security program, securing accounts and devices, overseeing vendors, training staff, and preparing for incidents.

If your firm handles consumer financial information, do not assume the Rule is only for someone else. Start with an IT assessment and a clear review of your business activities. Then build a security program that fits your actual risks, and keep it current as your firm changes.