You don't have an FTC Safeguards problem. You have a "prove it" problem.
Almost nobody discovers the FTC Safeguards Rule by reading regulations. It arrives sideways — from an insurer, a client, a peer, or an engagement that suddenly won't move forward.
Knowing the rule exists is rarely the challenge. Completing the work that demonstrates it is.
How firms usually find out
- An insurer asks about it at renewal
- A client engagement letter references it
- A peer at another firm mentions it
- A customer questionnaire lands
- A security review delays a new engagement
By the time you hear about it, somebody is already waiting for an answer.
Who the FTC Safeguards Rule applies to
The rule sits under the Gramm-Leach-Bliley Act and applies to non-bank financial institutions under FTC jurisdiction. The FTC's definition of "financial institution" is far broader than what most firms picture — which is why so many find out late.
What kind of firm are you?
CPA and accounting firms
Likely appliesTax preparation and many accounting services are financial activities under the rule, and you hold the most sensitive financial data a person has. The rule applies regardless of firm size; firms with records on fewer than 5,000 consumers only get relief from a few documentation requirements.
- Tax returns, SSNs and banking details in one place
- Client engagement letters increasingly reference security terms
- Busy season, when nobody has capacity to assemble evidence
Tax preparation firms
Likely appliesPreparing returns means handling customer financial information, which is precisely the trigger. Seasonal staffing makes the access control requirement harder than it looks.
- Seasonal preparers who need access, then do not
- Return data retained across multiple years
- Software vendors who are also your service providers
Bookkeeping services
Likely appliesYou touch client banking and payroll data continuously, usually across dozens of small clients, each with their own systems.
- Access spanning many client environments
- Evidence that each client’s data stays separate
- Security terms appearing in new engagement letters
Payroll providers
Likely appliesPayroll data is identity data. A breach here is immediate and personal for every employee involved, which is why clients audit you rather than trust you.
- Client audits of how you handle employee records
- Oversight of the systems you depend on
- An incident response plan clients will ask to see
Financial advisors
Depends on registrationSEC-registered investment advisers fall under the SEC’s Regulation S-P rather than the FTC rule. State-registered advisers and other advisory businesses may fall under the FTC Safeguards Rule. Either way, regulators and clients expect a documented, maintained program.
- Confirm with counsel which rule governs your firm
- Custodian and platform security questions
- Evidence at renewal, not just at onboarding
Mortgage brokers
Likely appliesHandling loan applications means handling exactly the customer financial information the rule was written about.
- Application data across multiple lenders
- Third parties in the process you are accountable for
- Retention and disposal of what you no longer need
A practical rule of thumb
If your firm handles customer financial information, the FTC Safeguards Rule probably deserves your attention. Whether it strictly applies is a question for your counsel — but "we assumed it didn't" has not been a useful answer for any firm that later had to explain itself.
What the FTC Safeguards Rule actually requires
Most firms expect a policy requirement.
What it actually is:A written information security program — assigned to someone, built from nine elements, and maintained.
Designate a Qualified Individual
One named person oversees and enforces the program. It can be an employee or an outside provider, but your firm stays responsible.
Conduct a written risk assessment
Identify reasonably foreseeable risks to customer information and judge whether your current safeguards control them.
Design and implement safeguards
Access controls, a data and systems inventory, encryption in transit and at rest, MFA for anyone accessing your systems, secure disposal, change management and activity logging.
Monitor and test the safeguards
Continuous monitoring, or an annual penetration test plus vulnerability assessments every six months.
Train your staff
Security awareness training for everyone, and qualified people running the program.
Oversee service providers
Choose vendors that can protect customer information, require it by contract, and assess them periodically.
Keep the program current
Update the program when your operations, systems or test results change.
Write an incident response plan
A written plan for responding to and recovering from a security event, including FTC notification when the threshold is met.
Report to your board annually
The Qualified Individual reports in writing, at least once a year, to the board or a senior officer.
Nine requirements, and not one of them is a document you file and forget.Every one has to be maintained, and every one has to be evidenced when an insurer, a client or a regulator asks.
Source: 16 CFR Part 314 and the FTC's compliance guide.
FTC Safeguards is not a project. It's an ongoing program.
Here's a year of it. Every dot is work somebody has to do and evidence — pick a row to see what it involves.
| Activity | J | F | M | A | M | J | J | A | S | O | N | D |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Scheduled | ||||||||||||
| Scheduled | Scheduled | Scheduled | Scheduled | |||||||||
| Scheduled | Scheduled | |||||||||||
| Scheduled | Scheduled | |||||||||||
| Scheduled | ||||||||||||
| Scheduled | ||||||||||||
| Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | Scheduled | |
| Scheduled | Scheduled |
- Risk assessment
- Annually, and again after any significant change to your systems or the data you hold.
- Access reviews
- Quarterly. Leavers, role changes and shared accounts are where this quietly breaks between reviews.
- Security training
- Annually for everyone, plus every new hire and seasonal preparer as they arrive.
- Vendor reviews
- At onboarding and at every renewal. You remain accountable for the providers who touch customer information.
- Policy reviews
- Annually, or whenever the firm changes. A policy describing systems you no longer run is worse than none.
- Incident response exercise
- Tested, not just written. Insurers increasingly ask when you last exercised the plan.
- Security monitoring
- Continuous. This is the one that never stops, and the one most often assumed rather than evidenced. Without continuous monitoring, the rule requires an annual penetration test and vulnerability assessments every six months.
- Reporting to the board
- The rule requires a written report at least annually. A mid-year check-in keeps leadership from being surprised.
Cadences shown are Greypike's recommended practice. The rule sets some minimums (annual board reporting, and either continuous monitoring or annual penetration testing with six-monthly vulnerability scans) and otherwise requires periodic review as your firm changes.
Checklist thinking
- Do it once
- Store the document
- Hope nobody asks again
Program thinking
- Assign the work
- Complete the work
- Collect the evidence
- Review it
- Repeat
How Greypike runs FTC Safeguards
Every requirement becomes one or more tasks. Instead of remembering what has to happen next quarter or next year, your team receives structured assignments and a documented record of completion.
Who this usually lands on
- Managing partners
- Firm owners
- Controllers
- Operations managers
- Office managers
- Your IT provider
A compliance analyst, included
Most firms have no compliance department. Greypike includes a named compliance analyst who reviews completed work, answers the questions that come up, and keeps the program moving between busy seasons.
Review who has access to client financial data
Export the current user list from your tax software and file storage. Confirm each person still needs access, record the decision, and remove anyone who doesn't.
- Owner
- Karen Ellis, Operations
- Due
- March 31
- Evidence
- Reviewed user list, signed off
- Accepted when
- Every account decisioned, removals actioned
- Recurs
- Quarterly
Accepted. Four seasonal preparer accounts from last season removed. I've noted the date — it's the first thing an insurer asks for at renewal.
Implement once. Attest many.
Compliance obligations accumulate as firms grow. The worst outcome is rebuilding the same security program every time a new one appears.
We establish the program
FTC Safeguards is a reasonable place to start, because almost everything it requires is foundational. Build it properly now and the next obligation costs a fraction of this one.
What we set up
- The written information security program itself
- A named Qualified Individual, with the role defined
- Risk assessment, access control and training as recurring tasks
- Vendor oversight and incident response, documented
- Evidence organized from the first day, not retrofitted
We reuse what you already have
Risk assessments remain risk assessments. Access reviews remain access reviews. Training remains training. The same evidence supports multiple obligations through framework mapping in the platform.
What carries across
- Completed tasks map to the equivalent FTC requirement
- Existing evidence is reused rather than recollected
- Only genuine gaps become new work
- Your compliance analyst identifies the overlap up front
- The second framework is materially less work than the first
The same work also answers
- Client security questionnaires
- Cyber insurance requirements
- Vendor reviews
- SOC 2 initiatives
- Internal governance programs
Why firms choose Greypike for FTC Safeguards
The hardest part of FTC Safeguards isn't understanding the rule. It's maintaining the work that demonstrates it, month after month, through a busy season and out the other side.
| The traditional approach | Greypike |
|---|---|
| Spreadsheets and calendar reminders | Assigned recurring tasks |
| Policies sitting in a folder | Ongoing tracked work |
| Evidence scattered across email and drives | Centralized evidence management |
| One-time consulting projects | Continuous compliance workflows |
| Interpreting the rule yourself | A compliance analyst reviewing your work |
| Duplicate effort for every new obligation | Framework reuse |
FTC Safeguards compliance pricing
No sales process required to see the number. FTC Safeguards is one framework, and one framework is what the subscription covers.
$399per month
or $4,000 a year, saving $788
First 25 customers only. Standard pricing is higher. Founding customers keep this rate for 24 months. 12-month term, no setup fee.
Book a demoWhat's included
- A compliance analyst reviewing your work
- FTC Safeguards converted into assigned tasks
- Evidence management
- Continuous monitoring
- Framework mapping and reuse
Adding SOC 2 later? See framework pricing →
FTC Safeguards Rule FAQ
Something not covered here? Ask us directly. Industry-specific answers for accounting firms are on the financial services page.
Who does the FTC Safeguards Rule apply to?
Non-bank financial institutions under FTC jurisdiction. That includes tax preparers and many accounting firms, mortgage brokers, non-bank lenders, auto dealers that arrange financing, and other businesses significantly engaged in financial activities. Banks and SEC-registered firms are covered by other regulators.
What are the nine requirements of the FTC Safeguards Rule?
Under 16 CFR Part 314, you must designate a Qualified Individual, conduct a written risk assessment, implement safeguards, monitor and test them, train staff, oversee service providers, keep the program current, maintain a written incident response plan, and have the Qualified Individual report to the board in writing at least annually.
When did the updated FTC Safeguards Rule take effect?
Most of the amended requirements took effect on June 9, 2023. The requirement to notify the FTC of certain data breaches took effect on May 13, 2024.
Can the Qualified Individual be outsourced?
Yes. The Qualified Individual can work for an affiliate or a service provider. Your firm still keeps responsibility for compliance, must designate a senior member of its own staff to oversee that person, and must require the provider to maintain an information security program that protects you.
Is multi-factor authentication required by the FTC Safeguards Rule?
Yes. MFA is required for any individual accessing any information system, unless your Qualified Individual approves in writing the use of reasonably equivalent or more secure controls.
Are small businesses exempt from the FTC Safeguards Rule?
Only partly. If you maintain customer information on fewer than 5,000 consumers, you are exempt from the written risk assessment, the written incident response plan, the annual report to the board, and continuous monitoring or annual penetration testing. The remaining requirements still apply.
When do we have to notify the FTC of a data breach?
When unencrypted customer information for 500 or more consumers is acquired without authorization. You must notify the FTC as soon as possible and no later than 30 days after discovering the event.
Does the FTC Safeguards Rule apply to SEC-registered investment advisers?
No. SEC-registered investment advisers and broker-dealers are covered by the SEC's Regulation S-P instead. State-registered advisers should confirm with counsel which rule applies to them.
How much does Greypike cost for FTC Safeguards compliance?
Founding customer pricing is $399 a month on a 12-month term, or $4,000 a year paid up front, for one framework. That includes the platform, FTC Safeguards converted into tasks, and a compliance analyst reviewing your work.
General information, not legal advice.
FTC Safeguards compliance that actually gets done
Assigned tasks, a compliance analyst reviewing the work, and current evidence sitting ready when an insurer, a client or a regulator asks. Turn a binder of policies into a program that runs.
