What must the Qualified Individual's annual board report cover under the FTC Safeguards Rule?

What does the FTC Safeguards Rule require the Qualified Individual to report?

The Qualified Individual must give the board a written report, at least once a year, on the state of the firm's information security program. 16 CFR 314.4(i) requires the firm to have its Qualified Individual "report in writing, regularly and at least annually," to the board of directors or equivalent governing body. If the firm has no board, the report goes to a senior officer responsible for the information security program.

The rule names two things the report must include. Paragraph (i)(1) covers "the overall status of the information security program" and the firm's compliance with the rule. Paragraph (i)(2) covers "material matters related to the information security program," and lists examples: risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses, and recommendations for changes to the program.

Which firms does the FTC Safeguards Rule apply to?

The FTC Safeguards Rule applies to non-bank financial institutions under the FTC's jurisdiction. The FTC's Safeguards Rule guide lists examples that include mortgage lenders and brokers, finance companies, tax preparation firms, and investment advisers that are not required to register with the SEC. The FTC's FAQ for automobile dealers adds dealers that finance or facilitate financing, and dealers that lease vehicles for longer than 90 days.

SEC-registered advisers and broker-dealers are generally outside this rule; their safeguards obligations come from Regulation S-P instead. For those firms, see who should own and sign a Reg S-P program.

Does every covered firm have to produce the report?

No. 16 CFR 314.6 exempts financial institutions that maintain customer information concerning "fewer than five thousand consumers" from paragraph (i), along with the written risk assessment in (b)(1), the testing requirements in (d)(2), and the written incident response plan in (h).

The exemption is narrower than many firms assume. It does not remove the duty in 314.4(a) to designate a Qualified Individual, and it does not remove the safeguards in 314.4(c), such as access controls, encryption and multi-factor authentication. Count carefully: the threshold turns on all the customer information the firm maintains, wherever it is stored.

Who can be the Qualified Individual?

The Qualified Individual can be an employee or someone at an affiliate or service provider. Under 314.4(a), the person is "responsible for overseeing and implementing your information security program," and the FTC's guide says the person "doesn't need a particular degree or title."

If the role sits with an outside provider, the rule adds three conditions. The firm must retain responsibility for compliance, designate a senior member of its own staff to direct and oversee the Qualified Individual, and require the provider to maintain an information security program that protects the firm consistent with the rule. In that setup, the outside Qualified Individual still writes the report, and the firm's own senior designee should be ready to answer for it.

What should a useful annual report contain?

A useful report gives the board something to act on. A one-line report saying there were no issues gives the board nothing to oversee. A practical structure follows the rule's own list:

• Program status: which of the 314.4 elements are in place, which changed this year, and any that are incomplete.
• Risk assessment: when the written risk assessment was last updated, the top risks it identified, and which were mitigated or accepted.
• Testing results: the annual penetration test and the vulnerability assessments required "at least every six months" under 314.4(d)(2), unless the firm runs effective continuous monitoring instead, with findings and how each was resolved.
• Service providers: which vendors hold customer information, what oversight was performed, and any contract changes.
• Security events: any incidents, how management responded, and whether any reached the FTC notification threshold.
• Recommendations: specific changes for next year, with owners and budget where needed.

Keep the report short enough to be read in the meeting, and attach the supporting documents rather than pasting them in. The board's job under the rule is oversight, so the report should end with the decisions the Qualified Individual needs from the board, such as approving a budget item, accepting a documented risk, or setting a deadline for a fix.

How does the FTC breach notice fit into the report?

Any FTC breach notice filed during the year belongs in the report as a security event. Since May 13, 2024, the FTC's notification requirement under 314.4(j) has required a firm to notify the FTC when unencrypted customer information of at least 500 consumers is acquired without authorization. Notice is due "as soon as possible, and no later than 30 days after discovery," through the FTC's online form. If the year included a notification event, the board report should say so and describe what changed afterward.

What should the Qualified Individual do this quarter?

If the annual report is due this year, start now:

• Confirm in writing who the Qualified Individual is and, if that person works for a provider, which senior staff member oversees them.
• Count the consumers whose information you maintain to confirm whether the 5,000-consumer exception applies.
• Pull the year's penetration test, vulnerability scans, risk assessment updates and vendor reviews into one folder.
• Draft the report using the six headings above and schedule time on the board or owners' agenda to present it.
• Record the meeting date, attendees and any decisions, and keep that record with the report.

Is this legal advice for my firm?

No. This article summarizes what the FTC Safeguards Rule and the FTC's published guidance say. Whether your firm is covered, and how the exception applies, depends on your facts. Your counsel is the right person to confirm.

How s90 helps

s90 supports financial firms in Los Angeles and Orange County that answer to the FTC Safeguards Rule. We run the vulnerability scans and coordinate the penetration testing the rule calls for, keep the vendor and asset records the report draws on, and help the Qualified Individual assemble a report the board can use. If your annual report is coming due, we are glad to help you prepare it.