FTC Safeguards Rule testing: continuous monitoring or annual pen tests?

The FTC Safeguards Rule lets covered firms rely on continuous monitoring instead of an annual penetration test. If you are the Qualified Individual, owner or operations lead at a tax practice, mortgage company, dealership or adviser under FTC jurisdiction, the path you rely on decides what your evidence file and your annual board report must show.

What does the FTC Safeguards Rule let you choose between?

Two ways to test your information systems: effective continuous monitoring, or a fixed schedule of annual penetration testing and vulnerability assessments every six months. 16 CFR 314.4(d)(2) says the monitoring and testing of information systems "shall include continuous monitoring or periodic penetration testing and vulnerability assessments." The fixed schedule applies only when the firm lacks effective continuous monitoring or "other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities."

That choice sits inside a broader duty. Section 314.4(d)(1) requires every covered firm to regularly test or otherwise monitor the effectiveness of its key controls, systems and procedures, including ways to detect actual and attempted attacks. Picking a path for (d)(2) answers how you test your systems. It does not switch off (d)(1).

The rule reaches non-bank financial institutions under FTC jurisdiction: tax preparers, mortgage brokers and lenders, auto dealers that finance, and investment advisers not required to register with the SEC, among others. For the people accountable at those firms, the decision shows up in three places: the budget, the evidence file, and the Qualified Individual's annual report to the board.

What counts as continuous monitoring under the Safeguards Rule?

The rule gives a functional test and no product list. The definitions section, 16 CFR 314.2, defines penetration testing but not continuous monitoring. The only description sits in 314.4(d)(2) itself: a system that detects, on an ongoing basis, changes in your information systems that may create vulnerabilities. The FTC's small business guidance says the same thing in plainer words: testing "can be accomplished through continuous monitoring of your system."

NIST's SP 800-137 is the most useful outside reference. It defines information security continuous monitoring as maintaining ongoing awareness of information security, vulnerabilities and threats to support risk management decisions, and it treats "continuous" as assessing controls and risks often enough to support those decisions. Neither source names a scan interval or a tool category.

Read together, a defensible continuous monitoring program usually has these traits:

• Coverage of every system that stores, processes or connects to customer information, matched against your asset inventory.
• Ongoing detection of new vulnerabilities and configuration drift, run often enough that there is no six-month gap between looks.
• Detection of new devices, accounts, software and cloud services as they appear.
• Someone assigned to review findings, with documented triage and remediation dates.
• Records that let an outsider see what was found, when, and what was done about it.

A firewall subscription or an endpoint agent on its own rarely meets that test. The word "effective" carries the weight. If the monitoring misses systems, or produces alerts nobody reviews, a firm relying on it may struggle to show it qualified for the alternative to annual testing.

What does the annual testing path require?

Two recurring activities, both tied to your risk assessment. Under 314.4(d)(2)(i), you conduct annual penetration testing of your information systems, scoped each year from the relevant risks your risk assessment identifies. Under (d)(2)(ii), you run vulnerability assessments at least every six months, including systemic scans or reviews designed to find publicly known vulnerabilities, and again after material changes to operations or business arrangements or when circumstances arise that may materially affect your program.

Section 314.2(n) defines penetration testing as a method in which assessors attempt to circumvent or defeat the security features of an information system, from outside or inside your systems. A vulnerability scan alone does not meet that definition. Our explainer on the annual penetration test covers scoping and who may perform it.

How do the two paths compare?

They trade depth at a point in time for breadth over time. An annual penetration test tells you how far a skilled tester could get on the day of the test. Continuous monitoring tells you what changed since yesterday. The practical differences:

• Cadence: the testing path is calendar driven (once a year, twice a year, plus event triggers). Continuous monitoring runs all the time and depends on people acting on what it finds.
• What it catches: a penetration test can chain weaknesses together the way an attacker would. Monitoring catches the unpatched laptop, the new cloud app or the firewall rule change between tests.
• Evidence: the testing path produces a few large documents, usually a test report, scan reports and a remediation log. Continuous monitoring produces a steady stream of alerts and tickets that someone must summarize.
• Cost profile: the testing path is a predictable project fee each year. Monitoring is an ongoing operating cost plus staff or provider time to review results.
• Exposure: the testing path can leave months between checks. Monitoring can fail quietly if coverage drifts or alerts go unreviewed.

Which firms tend to fit each path?

Firms with few systems that rarely change often find the testing path simpler to run and to prove. A small tax practice with a handful of workstations, a cloud tax platform and Microsoft 365 can scope a test, scan twice a year and keep a clean file.

Firms whose environment changes often tend to get more from continuous monitoring. Frequent hiring, new offices, new software and many vendor connections all create the kind of change the rule describes, and a six-month scan window can miss most of it. Mortgage operations and dealer groups with several locations often fall here.

For the rest of the rule by firm type, see our Safeguards Rule checklist for tax preparers, the guide for mortgage brokers and the guide for auto dealers.

Whichever path you choose, the decision belongs in your written risk assessment under 314.4(b), with the reasons stated. This article describes what the rule requires; your counsel can advise on how it applies to your specific firm.

Can you run both?

Yes. Nothing in the rule prevents a firm with continuous monitoring from also commissioning an annual penetration test. The combination answers both questions an examiner or a board member is likely to ask: what changed since the last review, and how far could an attacker get today.

Running both also hedges against an argument over whether your monitoring is "effective." If your monitoring program had a coverage gap during the year, a current penetration test and semiannual scans mean you still meet the fixed schedule.

Does the 5,000-consumer exception change the choice?

Yes. It removes the (d)(2) choice entirely for the smallest firms. 16 CFR 314.6 says that 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than 5,000 consumers. Those firms need neither the annual test nor continuous monitoring under (d)(2).

The general duty in 314.4(d)(1) to regularly test or monitor key controls still applies, as does the 314.4(c)(8) requirement to monitor and log the activity of authorized users. Count carefully. The threshold is about consumers whose information you maintain, which can include former customers and people who applied but never became customers.

How do you document the choice for the board and the FTC?

In writing, in two places: your risk assessment and the Qualified Individual's annual report. Under 314.4(i), the Qualified Individual reports in writing at least annually to the board or a senior officer, and the report covers material matters including testing results. Our guide to the Qualified Individual's board report lists what else belongs in it.

For the testing path, keep the scoping memo, the penetration test report, both vulnerability assessment reports, any event-driven scans, and the remediation log. For continuous monitoring, keep a description of the tooling and its coverage, an asset reconciliation showing what is monitored, periodic summaries of findings, and tickets showing remediation. Section 314.4(g) also requires you to evaluate and adjust the program in light of testing and monitoring results, so record what changed because of what you found.

The FTC explained the 2021 amendments that created these requirements in its final rule, published at 86 FR 70272. The rule text is the controlling source.

What should you do this quarter?

• Write down which (d)(2) path your firm relies on today. If nobody can answer, you are effectively on the testing path and should check whether your last test and scans are current.
• If you claim continuous monitoring, reconcile its coverage against your asset inventory and fix the gaps.
• Confirm who reviews monitoring alerts or scan findings, and how quickly.
• If you rely on testing, book the next penetration test and put the two vulnerability assessments on the calendar now.
• Recount the consumers whose information you maintain to confirm whether 314.6 applies.
• Add the path, the reasons and this year's results to the Qualified Individual's next board report.

How can s90 help?

s90 works with FTC-regulated financial firms in Los Angeles and Orange County to pick a (d)(2) path, set up monitoring that covers every system holding customer information, schedule testing where it is needed, and keep the evidence your Qualified Individual needs for the board report. If you want a second look at which path your firm is on and whether the file supports it, we are happy to talk it through.