Does the FTC Safeguards Rule require an annual penetration test?

If you are the Qualified Individual at a tax practice, a mortgage broker, or a state-registered adviser, the annual penetration test is one of the few Safeguards Rule duties with a fixed clock. Results of testing are one of the matters your annual report to the board or senior officer must address, so a missed test shows up there. SEC-registered advisers and broker-dealers follow Regulation S-P instead, covered below.

What does the FTC Safeguards Rule require for GLBA penetration testing?

It requires a penetration test every year unless the firm runs effective continuous monitoring. Under 16 CFR 314.4(d)(2), "the monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments" for information systems.

The rule then spells out the default. Absent "effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities," a covered firm must conduct two kinds of testing:

• Annual penetration testing of its information systems, "determined each given year based on relevant identified risks in accordance with the risk assessment."
• Vulnerability assessments, including systemic scans or reviews designed to identify publicly known security vulnerabilities, at least every six months, whenever there are material changes to operations or business arrangements, and whenever circumstances arise that may have a material impact on the information security program.

The two are different exercises. The rule's definitions in 16 CFR 314.2 describe penetration testing as "a test methodology in which assessors attempt to circumvent or defeat the security features of an information system." A vulnerability scan lists known weaknesses. A penetration test has someone try to use them. Running scans twice a year does not satisfy the annual test, and an annual test does not replace the six-month scans.

Which firms does the testing requirement reach?

Non-bank financial institutions under the FTC's jurisdiction. The rule's examples include tax preparation services, mortgage brokers, and investment advisory businesses, and the FTC's own Safeguards Rule guide names investment advisers that are not required to register with the SEC.

That covers many of the firms s90 works with: CPA firms and tax practices, mortgage brokers, and state-registered advisers. SEC-registered advisers and broker-dealers answer to Regulation S-P instead, which has no matching testing schedule. For those firms, see who should own and sign a Reg S-P program.

Tax practices have a second reason to care. The IRS treats the Safeguards Rule as the legal basis for the written information security plan it expects from preparers, so the testing record often ends up in the same binder as the WISP update before filing season.

Does the 5,000-consumer exception remove the test?

Yes. 16 CFR 314.6 exempts a firm that maintains customer information concerning fewer than five thousand consumers from paragraph (d)(2), along with the written risk assessment, the written incident response plan, and the annual board report.

The exception does not remove paragraph (d)(1), which still requires the firm to "regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures." A small practice still has to show that its controls work. It is simply not held to the annual and six-month schedule.

Count carefully before relying on the exception. The threshold turns on the customer information the firm maintains, wherever it sits: the practice management system, the tax software, the document portal, email archives, and backups. A count based on this year's active clients alone can come in low.

When does continuous monitoring replace the annual test?

Only when the monitoring is effective and detects, on an ongoing basis, changes in information systems that may create vulnerabilities. The FTC's guide says testing "can be accomplished through continuous monitoring of your system," but it does not define the term further.

That leaves the firm to show its monitoring meets the standard. A firm relying on this path should be able to describe in writing what is monitored, how a change that creates a vulnerability is detected, how quickly alerts are reviewed, and who acts on them. If those answers are thin, an annual test is usually the simpler record to defend.

Who can perform the penetration test?

The rule does not say. Neither 314.4(d)(2) nor the definition of penetration testing requires an outside or independent tester. What the rule does require is a real attempt to circumvent or defeat security features, scoped each year by the risk assessment.

Many firms still choose a tester who is independent of the team that runs their systems. The person who configured a firewall is poorly placed to attack it, and an outside report is easier to put in front of an owner or board. If your managed IT provider runs your environment, ask whether the tester is separate from the people who manage it, and keep that answer with the report.

The test can involve people as well as systems. When the FTC adopted the amended rule in its December 2021 final rule, it responded to a commenter by saying that "attempted social engineering and phishing are important parts of testing the security of information systems."

What should a year-end test cover?

Whatever this year's risk assessment says matters most. The rule ties scope to relevant identified risks, so a test copied from last year can miss what changed. For a tax practice, a mortgage broker, or a state-registered adviser, a useful scope often includes:

• External exposure: internet-facing services, remote access, client portals, and the firm's email domain.
• Internal reach: the rule's definition covers attempts "from outside or inside your information systems," so test what an attacker could get to from one compromised workstation, including the shares and databases that hold client records.
• Identity: the Microsoft 365 or Google Workspace configuration, multi-factor authentication coverage, and administrator accounts.
• People: a phishing or pretext-call exercise, if the risk assessment identifies social engineering as a top risk.

Agree on the scope in writing before testing starts, including any systems that are off limits and the dates of the test. That document belongs in the evidence file alongside the final report.

How do the results reach the board?

Through the Qualified Individual's annual report. Paragraph (i)(2) of 314.4 lists results of testing among the material matters the report must address, and paragraph (g) requires the firm to evaluate and adjust its program in light of the testing and monitoring results.

In practice, that means the board or senior officer should see more than the fact that a test happened. They should see what was found, what was fixed, what was accepted as a risk, and what still needs budget or a decision. For the full structure of that report, see what the Qualified Individual's annual board report must cover.

What should you do before the year closes?

A short checklist keeps the testing record complete going into the new year:

• Find the date of last year's penetration test and confirm this year's falls within the annual cycle.
• Update the written risk assessment first, then scope the test from it.
• Confirm the last two vulnerability assessments ran no more than six months apart, and that one ran after any material change, such as a new office or a new tax or loan origination platform.
• Assign an owner and a target date to every finding, and retest the high-risk items once they are fixed.
• If you rely on continuous monitoring instead, write down how it meets the rule's standard and who reviews the alerts.
• File the scope, the report, and the remediation evidence where the Qualified Individual can pull them for the annual board report.

This article describes what the Safeguards Rule and the FTC's published guidance say. Whether and how the rule applies to your firm depends on your facts, and your counsel is the right person to confirm.

How s90 helps

s90 supports tax practices, mortgage brokers, and advisers in Los Angeles and Orange County that answer to the FTC Safeguards Rule. We run the vulnerability scans and coordinate the penetration testing the rule calls for, track findings to closure, and keep the records your Qualified Individual needs for the annual report. If your test is due before year-end, we are glad to help you scope it.