FTC Safeguards Rule Compliance
FTC Gramm-Leach-Bliley Safeguards Rule — What Non-Bank Financial Firms Must Do Now
lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned
WHAT IS THE FTC SAFEGUARDS RULE?
The FTC Safeguards Rule expanded in 2023. Thousands of Sacramento firms are now in scope.
The FTC Safeguards Rule is a regulation implementing the Gramm-Leach-Bliley Act (GLBA) that requires financial institutions to develop, implement, and maintain a comprehensive information security program to protect customers’ nonpublic personal information (NPI). The Rule was significantly expanded in 2023, substantially broadening the definition of ‘financial institution’ and adding specific, prescriptive technical and organizational requirements.
The 2023 expansion brought many Sacramento-area businesses into scope for the first time — including CPA firms, tax preparers, bookkeeping services, mortgage brokers, auto dealers, payday lenders, and financial advisors who previously believed they were exempt. If your business handles customers’ financial information, the Safeguards Rule almost certainly applies.
2023
expanded rule effective
$5.56M
avg financial breach cost
9
required program elements
$100K+
FTC enforcement penalties
WHO IS COVERED
The expanded definition of ‘financial institution’.
The 2023 rule uses a broad functional definition — any business that is ‘significantly engaged’ in providing financial products or services to consumers. This includes:
CPA firms and tax preparers handling client financial data
Mortgage brokers and lenders
Auto dealers offering financing
Independent financial advisors and investment advisors
Insurance companies and agencies
Payday lenders and check cashing services
Accountants and bookkeepers handling customer financial accounts
Financial planners and wealth management firms
Exempt organizations: businesses with fewer than 5,000 customer records may qualify for a modified program — but the core Safeguards Rule requirement for a written information security program still applies regardless of size.
THE 9 REQUIRED PROGRAM ELEMENTS
What a compliant Safeguards Rule program must include.
Element
Requirement
1. Qualified Individual
Designate a qualified individual to oversee, implement, and enforce the information security program (may be a third-party service provider)
2. Risk Assessment
Conduct a written risk assessment identifying foreseeable risks to the security of customer information; update as circumstances change
3. Safeguards Implementation
Design and implement safeguards to control risks identified in the risk assessment, covering access controls, encryption, MFA, and more
4. Vendor Oversight
Oversee service providers by contractually requiring them to implement appropriate safeguards and periodically assessing their compliance
5. Monitoring & Testing
Continuously monitor and test the effectiveness of key safeguards through vulnerability assessments and penetration testing
6. Employee Training
Train employees to implement the information security program and keep training current as risks evolve
7. Incident Response Plan
Establish and maintain a written incident response plan addressing goals, internal processes, recovery procedures, and post-incident review
8. Board / Senior Officer Reporting
Report to the Board of Directors or equivalent at least annually on the state of the information security program
9. Program Updates
Evaluate and adjust the program in response to results of testing, material changes in operations, and changes in business arrangements
ENFORCEMENT & PENALTIES
FTC enforcement is active and escalating.
FTC CIVIL PENALTY PER VIOLATION
Up to $51,744 per day
The FTC can seek civil penalties for violations of final orders, and the Safeguards Rule’s requirements are directly enforceable. State attorneys general may also bring enforcement actions under GLBA.
Beyond FTC enforcement, the real financial exposure for non-compliant firms is breach liability. Financial institutions that suffer a data breach without a compliant information security program face:
Full liability for breach-related remediation, notification, and credit monitoring costs
Civil litigation from affected customers
State regulatory enforcement under California’s CPRA
Cyber insurance claim denial if the insurer determines the program was non-compliant at the time of the breach
HOW LBT BUILDS YOUR SAFEGUARDS RULE PROGRAM
A complete, documented program — not a policy template.
LBT Technology Group delivers FTC Safeguards Rule compliance as a managed program, functioning as your designated Qualified Individual and building the documentation, controls, and reporting infrastructure the Rule requires.
✓ Qualified Individual Services
LBT serves as your designated Qualified Individual under the Safeguards Rule — overseeing, implementing, and maintaining the information security program on your behalf, with documented accountability.
✓ Written Risk Assessment
A formal written risk assessment identifying and categorizing foreseeable risks to customer NPI, updated annually or upon material changes to your business environment.
✓ Technical Safeguard Implementation
Implementation of the specific technical controls the Rule now requires — MFA, encryption of NPI at rest and in transit, endpoint monitoring, and secure development practices.
✓ Vendor Oversight Program
Contract review and vendor assessment process ensuring all service providers handling customer NPI have appropriate safeguards in place and that your agreements reflect the Rule’s vendor oversight requirements.
✓ Written Incident Response Plan
Development and testing of a written incident response plan that addresses the Rule’s specific requirements for goals, roles, decision-making, recovery procedures, and post-incident review.
✓ Annual Board / Senior Officer Report
Preparation of the required annual written report to senior management summarizing the state of the information security program, material risks identified, and actions taken.
Is Your Business FTC Safeguards Ready?
Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them — at no cost and no obligation.
BOOK YOUR FREE FTC SAFEGUARDS ASSESSMENT →
+1 (916) 333-1062 · lbttechgroup.com · Sacramento, California
© 2026 LBT Technology Group, LLC · FTC Safeguards Rule Compliance Services · Sacramento, CA · Confidential