FTC Safeguards Rule

Usually, yes. FTC staff guidance says dealers who finance or facilitate financing of automobiles for consumers are financial institutions under the Safeguards Rule, and 16 CFR 314.2(h)(2)(ii) covers dealers that lease vehicles for longer than 90 days. Covered dealers must maintain a written information security program meeting 16 CFR 314.4, including encryption, multifactor authentication, logging, and vendor oversight.

Yes, with a Microsoft Purview DLP policy for the Microsoft 365 Copilot location. Microsoft documents that the policy can prevent Copilot from using files and emails with chosen sensitivity labels when it generates responses. The labeled item may still appear as a citation, but its content is not used. The control only works on files and messages that actually carry the label.

Treat them as taxpayer data. The FTC Safeguards Rule, at 16 CFR 314.4(c)(6), requires secure disposal of customer information no later than two years after it was last used for the customer, unless a business or legal reason requires keeping it. Confirm the data was migrated and backed up, then wipe or destroy the drives and record the method and date.

Under the FTC Disposal Rule, 16 CFR 682.3, anyone who keeps consumer report information for a business purpose must dispose of it with reasonable measures against unauthorized access. The rule's examples include burning, pulverizing, or shredding paper and destroying or erasing electronic media so the information cannot practicably be read or reconstructed. This applies whether or not the applicant was approved.

Deleting helps contain the exposure, but it does not answer whether a notice duty applies. Capture what was uploaded, when, and by whom before deleting, because that record supports the firm's Section 7216, FTC Safeguards Rule and state breach analysis. Vendor terms decide how long deleted content stays on their systems. OpenAI, for example, says deleted chats are scheduled for permanent deletion within 30 days.

Regulation S-P does not name multifactor authentication. It requires written policies and procedures covering administrative, technical and physical safeguards for customer information, and the SEC's fiscal 2026 exam priorities name access controls and account management. State-registered advisers under the FTC Safeguards Rule must use MFA for anyone accessing any information system unless the Qualified Individual approves an equivalent control in writing.

A dormant account is a working credential that nobody is watching. If its password is guessed, reused or leaked, an attacker can sign in with it, and no owner is around to notice unfamiliar activity or an unexpected sign-in prompt. Dormant accounts are also a control gap under common frameworks: CIS Safeguard 5.3 calls for disabling them after 45 days of inactivity.

Yes, with the right license. Entra entitlement management can expire an access package on a set date, which Microsoft lists under Entra ID P2 or ID Governance. Lifecycle Workflows can disable an account on the leave date stored in its profile, listed under Entra ID Governance. On Business Premium alone, a named person must disable seasonal accounts on schedule.

Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment, penetration and vulnerability testing, the written incident response plan, and the annual board report. They still must designate a Qualified Individual and maintain the rule's other safeguards, such as access controls, encryption and multi-factor authentication.

The FTC Safeguards Rule requires the Qualified Individual to report in writing, regularly and at least annually, to the board of directors or equivalent governing body. If the firm has no board, the report goes to a senior officer responsible for the information security program. Firms with customer information on fewer than 5,000 consumers are exempt from this report.

Within 30 days of discovering a notification event involving the unencrypted information of at least 500 consumers. The report is filed through the FTC's online form.

They can be. The FTC's reporting form states that your report may be made public, and the FTC's guide notes reports can be released, for example through a Freedom of Information Act request. If law enforcement has determined in writing that public disclosure would impede a criminal investigation, the form has a checkbox to request a delay in publication.

Generally, yes. 16 CFR 314.4(c)(6) requires secure disposal of customer information no later than two years after it was last used to serve that customer, unless it is needed for business operations or another legitimate purpose, required by law, or not reasonably feasible to target. Firms must also periodically review their data retention policy.

The encryption provision, 16 CFR 314.4(c)(3), requires compensating controls to be reviewed and approved by the Qualified Individual. Unlike the multi-factor authentication exception, it does not say "in writing." A dated, signed approval is still the practical way to show the FTC, an auditor or your board that the review happened and what was approved.

16 CFR 314.4(c)(3) lets a firm that determines encryption is infeasible secure that customer information with effective alternative compensating controls reviewed and approved by its Qualified Individual. Document the system, the reason, the controls, the approval and the date, and revisit the exception when the system changes.

Only with a documented exception. The FTC Safeguards Rule, 16 CFR 314.4(c)(5), requires multifactor authentication for anyone accessing an information system unless the firm's Qualified Individual approves reasonably equivalent or more secure access controls in writing. Common replacements put a second factor in front of the system, such as a remote access gateway that requires MFA or limiting access to managed firm devices whose own sign-in requires MFA.

Yes. The Qualified Individual can work for an affiliate or service provider. If so, the firm must retain responsibility for compliance, designate a senior member of its own staff to direct and oversee the Qualified Individual, and require the provider to maintain an information security program that protects the firm consistent with the FTC Safeguards Rule.

The rule does not say. 16 CFR 314.4(d)(2) and the definition in 314.2 call for a test in which assessors attempt to circumvent or defeat security features, scoped by the risk assessment, but they name no required tester. Many firms choose a tester independent of the team that runs their systems, because the results are easier to rely on and to present to the board.

Yes, for most covered firms. Under 16 CFR 314.4(d)(2), a firm without effective continuous monitoring must conduct penetration testing annually, scoped by its risk assessment, and vulnerability assessments at least every six months and after material changes. Firms that maintain customer information on fewer than 5,000 consumers are exempt from this testing schedule under 16 CFR 314.6.

Section 314.4 requires a covered firm to designate a Qualified Individual, write a risk assessment, put safeguards in place such as access controls, encryption and multi-factor authentication, test or monitor its systems, train staff, oversee service providers, keep a written incident response plan, report to the board at least annually, and notify the FTC of breaches affecting 500 or more consumers.

Yes, if the event involves at least 500 consumers. The 16 CFR 314.6 exception for firms with customer information on fewer than 5,000 consumers removes the written risk assessment, testing, written incident response plan and board report. It does not list the FTC notification requirement in 314.4(j), so that duty still applies.

The rule does not ban or endorse SMS codes. When the FTC finalized the 2021 amendments, it declined to list text messages as a possession factor so the definition would not become a safe harbor that skips risk evaluation. The Commission said firms may use factors like SMS for less sensitive information and stronger factors for more sensitive systems.

Yes. The FTC's Safeguards Rule reporting form has a separate section for third parties, such as attorneys or service providers, submitting on behalf of the affected financial institution. The report still names the affected institution and its contact person, and the institution remains responsible for making sure the notice is filed within 30 days of discovery.

Neither the FTC Safeguards Rule nor Regulation S-P sets a fixed schedule. The FTC rule requires periodic assessment based on the risk a provider presents, and Reg S-P requires oversight through due diligence and monitoring. Many firms tier vendors by risk, review high-risk vendors at least annually and after major changes, and document the cadence in their written policy.

At least every six months, unless the firm uses effective continuous monitoring. 16 CFR 314.4(d)(2) also requires a vulnerability assessment whenever there are material changes to operations or business arrangements, and whenever circumstances arise that may have a material impact on the information security program. The assessments must be designed to identify publicly known security vulnerabilities.

The one person accountable for your information security program. It can be an employee or someone at a service provider, but the firm keeps responsibility and must oversee that person.

It depends on the rule that implements GLBA for your firm. The FTC Safeguards Rule requires encryption of customer information at rest and in transit over external networks, with Qualified Individual approved compensating controls where infeasible. Regulation S-P requires technical safeguards without naming encryption, and the banking agencies' guidelines list it as a measure each institution must consider.

No rule names AI tools specifically. The FTC Safeguards Rule requires the assessment to identify reasonably foreseeable internal and external risks to customer information, and requires firms to identify and manage the systems that hold it. An AI tool that receives, stores or generates customer information is one of those systems, so it falls within the assessment's scope.

The FTC Safeguards Rule requires a written risk assessment and requires firms to periodically perform additional assessments, without setting a fixed interval. It also requires adjusting the program after material changes to operations or business arrangements. Many firms update the assessment at least annually so it can feed the Qualified Individual's annual board report, and again when they adopt significant new systems.

The Safeguards Rule sets no review frequency for logs. It asks for controls designed to detect unauthorized use, which points to a risk-based schedule the Qualified Individual sets and writes down. Many practices review automated alerts as they arrive and sample activity more often during filing season. Whatever the cadence, record who reviewed, when, and what was found.

Yes. In IR-2026-106, the IRS stated that the MFA requirement applies to tax preparation firms regardless of size. The FTC Safeguards Rule, 16 CFR 314.4(c)(5), requires MFA for any individual accessing any information system unless the Qualified Individual approves reasonably equivalent or more secure controls in writing.

Yes. 16 CFR 314.2(h)(2)(xi) names a mortgage broker as a financial institution because brokering loans is a financial activity under the Bank Holding Company Act. That brings the full rule: a written information security program, a Qualified Individual, encryption, multi-factor authentication, service provider oversight, secure disposal, and notice to the FTC within 30 days of a breach involving 500 or more consumers.

Phishing is a message, usually an email or text, that tricks someone into clicking a link, opening a file or entering credentials. Pretexting is the invented story behind a request, such as a caller posing as a client or the client's CPA, used to get staff to hand over information or approve an action. Many attacks combine the two. Under GLBA, obtaining customer information through false statements violates 15 U.S.C. 6821 whatever the channel.

The rule requires firms to implement and periodically review access controls but does not set a frequency. The firm decides based on its risk assessment and should write the schedule into its information security program. CIS Safeguard 5.1, a common benchmark, calls for validating that all active accounts are authorized at least quarterly.

The rule does not name an approver. The Qualified Individual oversees the information security program and reports on it, so that person usually owns the review process. Each account is best confirmed by the manager who knows whether the person still needs that access, with IT making and recording the changes.

Yes. 16 CFR 314.1(b) applies the rule to all customer information in the firm's possession, including information about customers of other financial institutions that provided it. Applications that were withdrawn or denied still contain nonpublic personal information, so they need the same protection, and the rule's two-year disposal requirement in 314.4(c)(6) applies to them unless retention is needed for business or legal reasons.

The rule does not mention AI. It does require covered firms, including tax preparers, to monitor and log the activity of authorized users and detect unauthorized access to or use of customer information, under 16 CFR 314.4(c)(8). When staff put client data into an AI tool, that tool is part of the systems holding customer information, so its activity belongs in the firm's logging and review.

Nonbank mortgage lenders do. The rule covers financial institutions under the FTC's jurisdiction, and lending is a financial activity under the Bank Holding Company Act, the same basis that brings mortgage brokers in under 16 CFR 314.2. One of the FTC's first Safeguards Rule cases, in 2004, was against a Florida mortgage lender. Banks and credit unions follow their own regulators' security guidelines instead.

Under 16 CFR 314.6, a firm that maintains customer information on fewer than 5,000 consumers is exempt from four requirements: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the Qualified Individual's annual written report. Everything else, including MFA, encryption, training, access controls and vendor oversight, still applies.

Yes. 16 CFR 314.6 exempts firms that maintain customer information on fewer than 5,000 consumers from a short list of requirements: the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan, and the Qualified Individual's annual report. The access control requirement in 314.4(c)(1), including periodic review, is not on that list.

Under the FTC Safeguards Rule, 16 CFR 314.4(c)(5), the firm's Qualified Individual approves any alternative to multi-factor authentication, and the approval must be in writing. The alternative must be a reasonably equivalent or more secure access control. The rule does not provide for simply turning MFA off for a user because filing season is busy.

Yes. The rule's definition of financial institution, at 16 CFR 314.2(h)(2)(viii), includes an accountant or other tax preparation service in the business of completing income tax returns. Covered firms must maintain a written information security program meeting 16 CFR 314.4, scaled down somewhat for firms with fewer than 5,000 consumers.

The IRS says to report the theft to your local IRS Stakeholder Liaison right away, because speed is critical to blocking fraudulent returns. Its data theft guidance also lists the state tax agencies (through the Federation of Tax Administrators), state attorneys general, the FBI, the Secret Service if directed, local police and affected clients. If the event involves the information of 500 or more consumers, the FTC Safeguards Rule also requires notice to the FTC within 30 days of discovery.

Under the FTC Safeguards Rule, the Qualified Individual approves MFA and encryption exceptions, and the MFA approval must be in writing (16 CFR 314.4(c)(3) and (c)(5)). Reg S-P names no approver for SEC-registered firms, so most advisers route exceptions through the CCO who administers the Rule 206(4)-7 program, often with the system owner co-signing.

Yes. Microsoft supports an in-place upgrade from Windows Server 2016 directly to Windows Server 2019, 2022 or 2025. It keeps the same hardware, so it suits a server with several years of life left. Before upgrading, confirm every program on it, including prior-year tax software, supports the new version, and test a restore from backup.

If staff use AI tools with client information, the plan should address them. The FTC Safeguards Rule requires access controls, monitoring of authorized users and oversight of service providers, and the IRS reminds tax professionals that federal law requires a written information security plan. A short AI section names approved tools, prohibited data and the controls that enforce the rule.

At least once a year and whenever something material changes. IRS Publication 5708 tells firms to review the plan at least annually or whenever there is a material change, and 16 CFR 314.4(g) requires tax preparers to adjust their security programs after material changes to operations, testing results or risk assessments.