FTC Safeguards Rule Compliance for Auto Dealers, Accountants and Non-Bank Lenders
FTC Safeguards Rule compliance became a specific engineering job when the FTC rewrote the rule. It no longer asks for a 'reasonable' program in the abstract; it names the controls: a qualified individual, a written risk assessment, encryption, multifactor authentication, logging, testing, vendor oversight and an incident response plan. NetSys implements those for dealerships, accounting firms and lenders with no security staff, and keeps the records.
The short answer
The FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions under FTC jurisdiction, such as auto dealers that arrange financing, tax preparers and mortgage brokers, to run a written information security program with named elements, from a Qualified Individual and a risk assessment to MFA, encryption, vendor oversight and an incident response plan. Since May 13, 2024 it also requires notice to the FTC within 30 days of discovering that unencrypted information about at least 500 consumers was acquired without authorization. NetSys builds and evidences the technical side with your Qualified Individual; your adviser confirms applicability, and we give no legal opinion or certification.
Customer information may pass through financing or tax software, email, shared files and outside service providers. A useful engagement maps those flows first, then identifies who owns the safeguards and the supporting records. Your Qualified Individual needs a practical view of what is implemented, what has been tested and what still needs work.
NetSys scopes access protection, endpoint and email controls, backup, documentation and technical evidence with your designated program owner. Confirm legal applicability and any relevant exceptions with your adviser. A limited external test alone cannot demonstrate that the broader information security program is operating as required.
Inventory the Customer Information, Then Protect Every Path to It
We begin with our free remote external penetration test, limited to available information and agreed external scope. Under a separate assessment and implementation scope, we inventory where customer information lives and flows, write the risk assessment with your qualified individual, and implement the controls: MFA and conditional access in Entra ID, device encryption through Intune, email encryption and data loss prevention, endpoint detection with monitoring, logging, backups and secure disposal. Service providers who touch customer information are inventoried and their contracts reviewed. Testing and reporting go on a calendar, so the annual written report to ownership is assembled from records.
What Our FTC Safeguards Rule Compliance Covers
Program and Qualified Individual
The rule wants a named person and a written plan.
- Qualified individual designated, with vCISO support or a vCISO in the role as the rule permits
- Written information security program and risk assessment, tailored to your business
- Annual written report to the board or owners, prepared from evidence
- Policies for access, retention, disposal and change management
Required Technical Controls
Encryption, MFA, logging and the rest, as configured systems.
- MFA for every user who reaches customer information, including the DMS and tax software
- Encryption of customer information at rest on devices and in transit by email
- Access controls and a data inventory that limit who can see what
- Activity logging and monitoring for unauthorized access, with alerts reviewed
Testing and Vendor Oversight
Prove the controls work; make vendors prove theirs.
- Penetration testing and vulnerability assessments on the rule's schedule, or continuous monitoring in their place
- Service provider inventory, due diligence questionnaires and contract terms requiring safeguards
- Secure disposal of customer information when it is no longer needed
- Security awareness training with phishing simulations built on dealership and tax-season lures
Incident Response and Evidence
A plan before the breach, and records after.
- Written incident response plan with roles, notification duties and counsel's role defined
- Backups tested for restoration and a disaster recovery plan
- Evidence organized by rule element for the FTC, insurers and, for tax firms, the IRS
- Delivered remotely nationwide; on-site in our coverage areas
Why Dealers and Firms Choose NetSys for FTC Safeguards Rule Compliance
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your ftc safeguards rule compliance stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- Every element of the amended rule is tied to a specific control, document or record
- MFA, encryption, monitoring and disaster recovery are included in the managed agreement
- Experience with the dealer management systems and tax platforms the rule sweeps in
- A vCISO can carry the qualified individual role for firms with no security staff
- Month to month, starting with a free remote external penetration test within an agreed external scope
Where we deliver FTC Safeguards Rule Compliance
FTC Safeguards Rule Compliance in Nassau County, NY · FTC Safeguards Rule Compliance in Suffolk County, NY · FTC Safeguards Rule Compliance in New Jersey · FTC Safeguards Rule Compliance in Westchester County. We also support clients remotely wherever their systems run. See all locations and service areas.
FTC Safeguards Rule Compliance FAQs
What is the FTC Safeguards Rule?
The Safeguards Rule is the Federal Trade Commission's regulation under the Gramm-Leach-Bliley Act requiring non-bank financial institutions to protect customer information with a written security program. The amended rule specifies the program's elements: a qualified individual, a risk assessment, access controls, encryption, MFA, logging, testing, training, vendor oversight, secure disposal, an incident response plan and reporting to leadership, plus notice to the FTC after qualifying security events.
Who has to comply with the FTC Safeguards Rule?
The rule applies to financial institutions under FTC jurisdiction based on their activities, including certain lenders, financing dealers and tax preparation firms. An institution holding customer information about fewer than 5,000 consumers is exempt from four provisions (the written risk assessment, the continuous monitoring or annual penetration testing requirement, the written incident response plan and the Qualified Individual's annual written report), but not from the rest of the rule. Confirm your activities, regulator and applicable requirements before defining the engagement.
How much does FTC Safeguards Rule compliance cost?
It depends on how many systems hold customer information and how much of the required control set already exists. For a NetSys managed client the technical controls are part of the monthly agreement, so the added cost is the program documents, vendor reviews and qualified individual support. We do not publish prices. We agree the broader review and implementation scope before quoting.
What does the Safeguards Rule require of auto dealers?
A dealer that arranges financing or leasing should assess whether it is covered and which provisions apply. Start with the customer information handled by F&I, the DMS, lender portals, email and service providers. NetSys can scope technical controls and evidence around those systems with the designated program owner; legal applicability and any exceptions should be confirmed with the dealer’s adviser.
Can NetSys be our qualified individual?
The rule allows the qualified individual to be employed by the institution, an affiliate or a service provider, provided the institution keeps responsibility for compliance, designates a senior employee to direct and oversee the qualified individual. A NetSys vCISO can fill the role on that basis. We still cannot certify compliance; the program remains yours and the FTC judges it.
Do accountants and tax preparers have to comply with the FTC Safeguards Rule?
Yes. Tax preparation is a financial activity, so CPA firms, enrolled agents and other preparers that hold client information are covered. The IRS separately requires paid preparers to maintain a written information security plan and asks about it at PTIN renewal. One program satisfies both; we build it to the Safeguards Rule's element list and format the WISP the way IRS guidance describes.
What changed in the FTC Safeguards Rule in 2024?
One addition took effect on May 13, 2024: a financial institution must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information, and encrypted information counts as unencrypted if an unauthorized person accessed the key. The notice goes through a form on the FTC's website and covers what was involved, when it happened and how many consumers were affected. That is one more reason device encryption matters: a lost laptop whose data stayed encrypted is not a notification event.
Guides on this topic
- IT and security support for auto dealerships
- IT and security support for accounting firms
- Define the technical assessment scope
- FTC Safeguards Rule for Auto Dealers
- WISP for Tax and Accounting Firms
- GLBA Compliance Services
- Multi-Factor Authentication
- Free External Penetration Test
- vCISO support for the Qualified Individual role
- Vendor oversight for the service providers that touch customer information
Make the safeguards and their owners explicit.
Bring your written program, customer-data systems and the questions your adviser or program owner has raised. We will scope the technical review, remediation and evidence support.