What security awareness training does the FTC Safeguards Rule require?

What does the FTC Safeguards Rule say about security awareness training?

GLBA security awareness training is mandatory under the FTC Safeguards Rule, the Gramm-Leach-Bliley Act rule for non-bank financial firms, and its content must track your own risk assessment. 16 CFR 314.4(e)(1) directs a covered financial institution to provide its personnel with "security awareness training that is updated as necessary to reflect risks identified by the risk assessment." The rule does not set a course length, a vendor, a format or a minimum frequency. It ties the content of training to your own risk assessment, which is what makes a generic annual video hard to defend.

Paragraph (e) sits under a broader duty: to implement policies and procedures "to ensure that personnel are able to enact your information security program." Training is the first of four ways the rule says you do that. The other three deal with the people who run the program, which comes up below.

The rule reaches non-bank financial institutions under FTC jurisdiction: mortgage brokers and lenders, tax preparers, auto dealers that finance or lease, and investment advisers that are not required to register with the SEC, among others. If your firm is one of them, the training requirement applies to you.

Does a small firm still have to train staff?

Yes. 16 CFR 314.6 exempts institutions that maintain customer information on fewer than 5,000 consumers from four provisions: the written risk assessment in 314.4(b)(1), the penetration testing and vulnerability assessment schedule in (d)(2), the written incident response plan in (h), and the annual board report in (i). Paragraph (e) is not on that list. A ten-person mortgage office trains its staff under the same sentence as a 300-person lender.

The small firm still has to perform a risk assessment under 314.4(b), even if it does not have to write it down. Because (e)(1) points training at that assessment, a small firm benefits from keeping at least a short record of the risks it identified, so it can show why its training covers what it covers.

What makes training "updated as necessary"?

Training is current when its content tracks the risks your firm has actually identified, and changes when those risks change. The rule links the two directly. If your risk assessment flags wire fraud on closing funds, or impersonation calls to your loan processors, your training should address those scenarios by name.

The FTC's own business guidance on the Safeguards Rule puts it plainly: "Provide your people with security awareness training and schedule regular refreshers." It also frames the stakes: "A financial institution's information security program is only as effective as its least vigilant staff member." Practical triggers for an update include:

• A new risk in your risk assessment, such as a new payment method, a new client portal or a new AI tool in daily use.
• A security event at your firm, or a near miss someone reported.
• A material change to operations, such as a merger, a new office or a move to remote work.
• A shift in how attackers target your industry, such as a new phishing lure aimed at borrowers or filers.

Paragraph (g) of the rule separately requires you to evaluate and adjust the whole program in light of testing, monitoring and material changes. Training content is one of the easiest pieces of the program to show you adjusted.

What should security awareness training cover?

It should cover the people-driven risks in your own risk assessment, because the rule lists no required topics. For most mortgage brokers, tax preparers, auto dealers and lenders, that list tends to include:

• Phishing and impersonation, including calls or texts that pose as a client, a lender or your IT provider.
• Payment and wire instructions: how to verify a change by calling a known number before money moves.
• Handling customer information: secure sending, where files may be stored, and how to dispose of them.
• Multi-factor authentication prompts and passwords, including what to do with a prompt you did not request.
• How and to whom to report a suspicious message, a lost device or a mistake, quickly and without blame.

Who has to complete GLBA security awareness training?

Anyone who can reach customer information or the systems that hold it should complete it, because the rule says personnel and does not define the term. That usually includes full-time staff, part-time and seasonal staff, owners and partners, and contractors who work inside your systems. Leaving out the people with the most access, often the principals, is a common gap.

Service providers are handled separately. Under 314.4(f) you oversee them through selection and contracts, and the FTC guidance says to "insist on specialized training for employees, affiliates, or service providers with hands-on responsibility" for the program. In practice, that means asking your IT provider how it trains its own technicians, and keeping the answer.

What does the rule require for the people who run the program?

Paragraphs (e)(2) through (e)(4) go beyond general awareness. You must use qualified information security personnel, employed by you or by an affiliate or service provider, sufficient to manage your risks. You must give them "security updates and training sufficient to address relevant security risks." And you must verify that key security personnel "maintain current knowledge of changing information security threats and countermeasures."

That last word, verify, matters. It puts the burden on your firm to confirm that your Qualified Individual and any outsourced security team keep their knowledge current. A line in the Qualified Individual's annual report naming the certifications, courses or threat briefings that person completed is a simple way to create that record.

What evidence shows the training requirement is met?

The rule does not prescribe records for training, but you cannot show a regulator what you did without them. A short, consistent evidence set usually covers it:

• A training policy that states who must complete training, when new hires complete it, and how often refreshers run.
• Completion records by person and date, including new hires and departures.
• The training content itself, or a dated outline, with a note on which risk assessment items it addresses.
• Results from phishing simulations or knowledge checks, if you run them, and what you did with people who struggled.
• A record of each content update and the reason for it.

For structure, NIST SP 800-50 Rev. 1, published in September 2024, describes a life cycle approach to building a cybersecurity and privacy learning program and suggests metrics for evaluating it. The Safeguards Rule does not adopt it, though it is a useful model for a firm that wants its program to hold up to questions.

Is a once-a-year video enough?

Usually not on its own. A single annual video may tick a checklist, but the rule's test is training updated to reflect your identified risks. A purchased annual module that never mentions your loan files, your client portal or the scams aimed at your customers leaves a gap between your risk assessment and what staff learned.

Many firms pair a short annual course with brief, targeted refreshers through the year: a five-minute note after a new scam appears, a walk-through when a new tool goes live, or a quick review after a reported phishing email. Each one is easy to date and easy to tie back to a risk.

What should you do this quarter?

A practical sequence for the next 90 days:

• Pull your current risk assessment and list the top five risks that involve people, such as phishing, payment fraud or misdirected email.
• Compare your current training content against that list and note what is missing.
• Confirm everyone with access to customer information is enrolled, including owners, part-time staff and contractors.
• Add one targeted refresher tied to a risk on your list, and record the date and the reason.
• Ask your IT or security provider how its staff stay current, and file the answer for your Qualified Individual's report.

Training records also support other parts of the program, such as user access reviews, since both depend on an accurate list of who has access.

How s90 helps

s90 helps financial firms in Los Angeles and Orange County connect security awareness training to their risk assessment and keep completion and update records ready for review. If you want a second look at whether your current program lines up with 314.4(e), we are happy to talk it through.