Key takeaways
- 16 CFR 314.4(c)(1) requires implementing and periodically reviewing access controls, limited to the customer information each user needs.
- The rule sets no review frequency, so the firm sets one in its written program and has to meet it.
- CIS Safeguard 5.1 calls for validating active accounts at least quarterly, a common benchmark.
- Good evidence is a dated user list per system, manager confirmation, a record of fixes and MFA status.
- The small-firm exceptions in 16 CFR 314.6 do not remove the access control requirement.
What does the Safeguards Rule say about user access reviews?
The Safeguards Rule requires "implementing and periodically reviewing access controls." 16 CFR 314.4(c)(1) says those controls must authenticate and permit access only to authorized users, and limit each authorized user's access "only to customer information that they need to perform their duties and functions." That sentence is the whole requirement. The rule does not define "periodically," prescribe a format, or say what record to keep.
The rule covers non-bank financial institutions under FTC jurisdiction. 16 CFR 314.1(b) lists, among others, mortgage lenders, mortgage brokers, finance companies, tax preparation firms and investment advisers that are not required to register with the SEC. An SEC-registered adviser or broker-dealer answers to Regulation S-P instead, though the user access review practices below work under either rule.
Because the rule is short, the burden of proof sits with the firm. If the FTC or a state regulator asks how you know access is limited to people who need it, a written policy will not answer the question. A dated record of the last review will.
How often should user access be reviewed?
User access should be reviewed as often as your written risk assessment says, and then on that schedule every time. The FTC's business guide to the rule tells firms to "determine who has access to customer information and reconsider on a regular basis" whether those people still have a legitimate business need for it. It leaves the interval to you.
Quarterly is a common choice because CIS Safeguard 5.1 calls for validating that all active accounts are authorized "on a recurring schedule at a minimum quarterly, or more frequently." CIS Safeguard 5.3 adds disabling dormant accounts after 45 days of inactivity. Neither is a legal requirement under the Safeguards Rule. Both give a defensible baseline. Whatever you choose, write it into the information security program. A quarterly policy with one review on file for the year reads as a control that does not operate.
What evidence shows a user access review actually happened?
A dated package that shows what was reviewed, who confirmed it, what changed and when the changes were done is the evidence. For each review cycle, keep:
- System user lists. An export, dated the day of the review, from every system that holds customer information: Microsoft 365, the CRM or loan origination system, document storage, e-signature, and lender or custodian portals.
- Manager confirmation. Each account confirmed as still needed, at its current level, by the person who manages that user. IT approving its own list does not show business need.
- Admin accounts, reviewed separately. Global administrators and other privileged roles, with the reason each one exists.
- Shared and service accounts. Each with a named owner, or a note that it was removed.
- MFA status. 16 CFR 314.4(c)(5) requires multi-factor authentication for anyone accessing any information system unless the Qualified Individual approves an equivalent control in writing. Attach those written approvals to the review.
- Change log. Every account removed or reduced, with the ticket or note and the date it was closed.
Activity logs help close the loop. Section 314.4(c)(8) requires controls designed to monitor and log the activity of authorized users. A sign-in log showing no activity from a removed account after its removal date is stronger proof than the removal ticket alone.
How does the access review connect to the rest of the program?
The user access review feeds three other requirements, which is why a clean record matters beyond the review itself. Section 314.4(d)(1) requires firms to "regularly test or otherwise monitor the effectiveness of the safeguards' key controls," and the access review is one of those tests. Section 314.4(g) requires the firm to evaluate and adjust the program based on what testing finds. Section 314.4(i) requires the Qualified Individual to report in writing, at least annually, to the board or a senior officer on the overall status of the program and material matters such as risk assessment and testing results. Our guide to the Qualified Individual's annual board report shows where those results go.
In practice: if a review finds a departed loan officer still had access to the loan system three weeks after leaving, the fix goes in the change log, the offboarding process gets adjusted, and both belong in the Qualified Individual's next report. Mortgage brokers can find more on securing loan files under the Safeguards Rule.
Smaller firms should note what 16 CFR 314.6 does and does not exempt. A firm that maintains customer information on fewer than 5,000 consumers is excused from the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan and the annual report. Access controls and their periodic review still apply.
Where do access reviews usually fall short?
Most gaps come from reviewing too narrowly or not recording the result. Watch for these:
- Reviewing Microsoft 365 and skipping the line-of-business apps where customer files actually live.
- Removing a departed employee's email but leaving their lender, custodian or e-signature portal login active.
- Shared logins that make it impossible to say who accessed what.
- Role changes that add access without removing the old access.
- A review that happened but left no dated record of what was checked.
What should you do this quarter?
Run one complete review and make it repeatable. A practical order:
- List every system that stores or processes customer information, and who administers each one.
- Set the review frequency in the written information security program.
- Export dated user lists and send each manager the accounts they need to confirm.
- Remove or reduce what no one confirms, and record each change with its completion date.
- Check MFA coverage and file the Qualified Individual's written approval for any exception.
- Save the package where the Qualified Individual can cite it in the annual report, and schedule the next review.
How does s90 help?
Our Identity Posture service does the collection work for you. Each month it reports active, stale and privileged accounts and MFA status across Microsoft 365 and connected applications, so your managers confirm a short list instead of building one. The results are packaged as dated evidence your Qualified Individual can file and cite, and we produce it within 24 hours when a regulator asks. If you would like to see a sample report, we are happy to share one.
