SecurafyColumbus, Ohio, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
FTC Safeguards/GLBA
The FTC Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for financial institutions that are not supervised by a banking regulator: mortgage brokers and lenders, auto dealers that finance, payday and finance companies, tax preparers, collection agencies, check cashers, wire transfer services, credit counselors, investment advisers not registered with the SEC, and similar businesses.
The 2021 amendments took effect on January 10, 2022, with most of the new program requirements applying from June 9, 2023, and turned the rule into a prescriptive program.
A further amendment effective May 13, 2024 requires notice to the FTC as soon as possible, and no later than 30 days after discovery, of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers.
The rule is written-program heavy. A covered institution must designate a Qualified Individual, keep a written risk assessment, implement listed safeguards (access controls, encryption in transit over external networks and at rest, MFA, secure disposal, change management, activity logging), test and monitor them, train staff, oversee service providers by contract, keep a written incident response plan, and have the Qualified Individual report in writing to the board at least annually.
Institutions holding information on fewer than 5,000 consumers are exempt from some of the written elements.
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedSafeguards program v2by name, on record
Qualified Individual Approvedwith AllyMatter
Safeguard the Modern WayYour written information security program, acknowledged by every employee
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee on record
Who read which version, and when
03
Report to the board with the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Financial institutions under FTC jurisdiction that hold customer information, meaning businesses significantly engaged in financial activities that are not banks, credit unions, SEC-registered advisers or other agency-supervised entities.
Institutions with information on fewer than 5,000 consumers are exempt from the written risk assessment, continuous monitoring or annual penetration testing, written incident response plan and annual board report requirements.
What you have to write
Documents on this site that FTC Safeguards/GLBA requires or expects, each with who must have it, the review cycle and the obligations that cite it.
- Incident Response Plan Information security
What the assessor asks to see
Designation of the Qualified Individual; written risk assessment; written information security program and policies; access control and MFA configuration; encryption evidence; data inventory and disposal schedule; change management records; logging and monitoring evidence; penetration test and vulnerability assessment reports; training records; service provider contracts and oversight records; written incident response plan; annual board report; notification event records.
Where the requirement sits: 16 CFR 314.4(a) qualified individual; (b) written risk assessment; (c) safeguards incl. (c)(5) MFA; (d) monitoring/testing; (e) training; (h) written IR plan; (i) annual board report
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones FTC Safeguards/GLBA turns on. Build the whole library in one place, across every department, and prove who has read what.
Policies you can run here
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with FTC Safeguards/GLBA
Yes. IT security firms and compliance consultants serving auto dealers, mortgage brokers, tax practices and lenders offer Safeguards gap assessments, written program templates, virtual Qualified Individual services, MFA and encryption rollouts, and vendor oversight programs. Engagements are usually short, with an annual review cycle.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
TruvantisSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Genius GRCWoodstock, GA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TestprosSterling, Virginia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
FRSecureEdina, Minnesota, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
ConsilienTorrance, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Omega SystemsUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
MeriplexHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, SOC 2, HIPAA, PCI DSS, CMMC and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Compass IT ComplianceNorth Providence, RI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
PCR Business SystemsAkron, OH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, PCI DSS.
- Standards
- Pricing
- Not published
Vertex11Ashburn, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, GDPR and more.
- Standards
- Pricing
- Not published
Integrate CyberAustin, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Technology Response TeamDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
Cyber Security Services (CSS)Westerville, OH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, PCI DSS, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
BD EmersonRichmond, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
RB Advisory LLCWinter Park, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
ArcherHall (formerly Vestige Ltd)USA, multiple offices
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Secured IT SolutionsNevada, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
AiriamLewisburg, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171.
- Standards
- Pricing
- Not published
InTech PacificHawaii, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
Alliant CybersecurityHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
ThriveUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Cantey Tech ConsultingNorth Charleston, SC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
CompassMSPWest Hartford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Deer Brook ConsultingNew Gloucester, ME, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
DenaliTEKAnchorage, AK, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
DevilDog CybersecurityDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
First Class NetworksBoston, MA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, PCI DSS.
- Standards
- Pricing
- Not published
Intech HawaiiHonolulu, HI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Justice IT ConsultingBurleson, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, DFARS, SOX.
- Standards
- Pricing
- Not published
LaScalaTemperance, MI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
M3 Technology Consultants, Inc.Fairfax, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
NetCov (Network Coverage)Danvers, MA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
NovacoastWichita, KS, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
NuViewPortsmouth, NH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Ocean SolutionsAshburn, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Orion Network SolutionsNagpur, Maharashtra, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171.
- Standards
- Pricing
- Not published
Semel ConsultingSarasota, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Systems EngineeringPortland, ME, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
ThriveonEden Prairie, MN, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
VancordMilford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
WingSweptGarner, NC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
46SolutionsLexington, KY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, PCI DSS, SOX.
- Standards
- Pricing
- Not published
Advantage IndustriesColumbia, MD, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
CISPoint (COMSO)Columbia, MD, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Cyber Security Solutions (CSS)Tampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
DataSure24Buffalo, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Accent ConsultingLafayette, Indiana, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, HIPAA, CMMC, PCI DSS, NIST CSF and more.
- Standards
- Pricing
- Not published
Foresite Technologies IncOverland Park, KS, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
Relic Law PLLCBrighton, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Flexible ITHauppauge, New York, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Impact Risk Advisor
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
ForgePath SecurityNorfolk, Virginia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Security PS
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, PCI DSS, NIST CSF, FFIEC and more.
- Standards
- Pricing
- Not published
Who assesses FTC Safeguards/GLBA
Government enforcement only. The FTC investigates and brings enforcement actions; there is no certification or third-party audit requirement. Institutions may commission independent assessments voluntarily or under a consent order.
Assessors
Be the first FTC Safeguards/GLBA assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for FTC Safeguards/GLBA
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation2 tools
Controls, evidence and audit workflows, with a policy module inside.
Privacy and data governance2 tools
Consent, data maps and data subject requests under GDPR, CCPA and similar laws.
Related reading
- FTC strengthens GLBA information security requirements for non-bank financial institutionsExplains who counts as a financial institution and what the written information security program, qualified individual and board reporting duties mean.Davis Wright Tremaine
- Updates to the Safeguards Rule will require non-banking financial institutions to report data security breaches to the FTCCovers the notification amendment, the 30-day clock and the 500-consumer threshold that now sits on top of the program requirements.WilmerHale
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Sources
eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information (current text)Federal Register: 2021 amendments, 86 FR 70272 (December 9, 2021)Federal Register: compliance date extended to June 9, 2023, 87 FR 71509Federal Register: notification amendment, 88 FR 77499 (effective May 13, 2024)FTC: Safeguards Rule, what your business needs to know
Need a hand implementing it?
Find a Consultant for FTC Safeguards/GLBA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of FTC Safeguards/GLBA in AllyMatter
Approve the policies FTC Safeguards/GLBA asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff