BlueKey IT helps firms covered by the FTC Safeguards Rule build and maintain the written information security program the rule requires. We implement the technical controls, support your Qualified Individual, and keep the documentation current.
Real reviews from real customers. See why businesses choose BlueKey IT.
Read All ReviewsThe FTC Safeguards Rule turns customer data protection into a written, testable security program. BlueKey IT builds the technical side of that program, supports the person you designate to run it, and keeps the evidence current, so you are ready when a regulator, insurer, or client asks how you protect their information.
Written security program support · Technical controls · Qualified Individual support · 200+ customers and 6,000+ endpoints managed
The rule applies to financial institutions under FTC jurisdiction. In the rule, a financial institution is a business whose activities are financial in nature or incidental to financial activities, which is a broader group than banks. Banks follow rules from their own regulators, and the rule excludes entities that are not significantly engaged in financial activities. The rule lists examples, and several of them are common among small and mid-sized firms.
| Type of business | Examples listed in the rule |
|---|---|
| Tax and accounting | Accountants and tax preparation services |
| Lending and settlement | Mortgage brokers, real estate settlement services, and finance companies that originate or service loans |
| Advice and counseling | Investment advisory companies, credit counseling services, and career counselors specializing in the financial industry |
| Money movement | Check cashing businesses and businesses that regularly wire money to and from consumers |
| Retail and dealers | Retailers that issue their own credit card directly to consumers, and auto dealerships that lease vehicles on a nonoperating basis for longer than 90 days |
| Other financial services | Personal property and real estate appraisers, businesses that print and sell checks, and travel agencies operating in connection with financial services |
Tax and accounting professionals: IRS Publication 5708 states that tax and accounting professionals are considered financial institutions under the rule regardless of size, that the rule requires a written information security plan, and that the plan must be written and accessible. The IRS publishes a sample plan, and the FTC enforces the rule.
What counts as customer information: any record containing nonpublic personal information about a customer, on paper, electronic, or in any other form, that you or your affiliates handle or maintain. Scanned returns in a shared folder, statements attached to old emails, and paper files in a storage room all count, which is why a data inventory is the first practical step.
Not sure whether the rule applies to you? Ask your attorney, then ask us what a compliant program would take. If you are covered and have no written program, that is the gap to close first.
Section 314.4 requires a written information security program with specific elements. This table shows each element and how BlueKey IT supports it. The sections below explain what each one means in practice.
| Rule element | What it requires | How BlueKey IT helps |
|---|---|---|
| Qualified Individual | A designated person to oversee and enforce the program. It can be an employee, an affiliate, or a service provider, but your firm keeps responsibility | We can support that role through our vCISO packages while you keep oversight |
| Written risk assessment | A written assessment of risks to customer information, repeated periodically | We run the technical assessment and document the findings |
| Access controls and data inventory | Periodically reviewed access controls, and an inventory of the data, personnel, devices, systems, and facilities that matter to your business | Access reviews, role-based permissions, and a device and system inventory |
| Encryption and MFA | Encryption of customer information in transit and at rest, and multi-factor authentication for any individual accessing any information system | MFA across email, remote access, and business applications, plus device, email, and backup encryption |
| Monitoring and testing | Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months | 24/7 monitoring, plus vulnerability scanning and penetration testing |
| Logging, change management, and disposal | Log and monitor user activity, manage system changes, and dispose of customer information within two years of last use unless an exception applies | Audit logging, patch and change management, and secure disposal of retired devices and data |
| Training and vendor oversight | Security awareness training for staff, qualified security personnel, and oversight of service providers | Security awareness training and support for vendor security reviews |
| Incident response and reporting | A written incident response plan, and a written report from the Qualified Individual to your board or senior leadership at least once a year | Incident response documentation and support preparing the annual report |
FTC notification requirement: Since May 2024, covered firms must notify the FTC as soon as possible, and no later than 30 days after discovery, of an event involving unauthorized acquisition of unencrypted customer information of 500 or more consumers.
Someone has to be accountable. The rule lets you designate an employee, an affiliate, or a service provider, but it does not let you hand off responsibility. Small firms often have no one with security expertise on staff, so a vCISO arrangement is a practical fit. We support the role by running the technical work, preparing the reporting, and advising on decisions, while your leadership stays in charge.
The assessment identifies the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and it has to be written and updated periodically. In practice that means documenting where customer information lives, who can reach it, how it could be exposed, and what you will do about each risk. We run the technical review of your devices, accounts, network, cloud services, and backups, and we record the findings so your Qualified Individual can approve a remediation plan.
Access should follow job duties, and it should be reviewed on a schedule. The inventory covers the data itself plus the personnel, devices, systems, and facilities that touch it. We build the inventory from your device management and cloud admin data, flag shared or orphaned accounts, and document access reviews so you can show who had access to what and when it was removed.
The rule requires encryption of customer information in transit over external networks and at rest. For most firms that means full disk encryption on laptops and desktops, encrypted mobile devices, encrypted backups, and secure email or file sharing for documents that contain customer data. If a system cannot be encrypted, the Qualified Individual can approve a compensating control in writing, and we help document the reasoning.
The rule requires MFA for any individual accessing any information system, not only administrators or remote users. We enable MFA on email, cloud storage, remote access, tax and accounting software that supports it, and administrative accounts, and we document any exception that your Qualified Individual approves in writing.
Customer information must be disposed of securely no later than two years after the last date it is used to provide a product or service, unless you have a legitimate business need or legal requirement to keep it. You also need change management procedures and logging that lets you detect unauthorized access, use, or tampering. We handle secure disposal of retired devices, patch and change records, and centralized logging with alerting through our 24/7 monitoring.
The rule gives you two options. Continuous monitoring satisfies it on its own. Without continuous monitoring, you need annual penetration testing plus vulnerability assessments at least every six months and after material changes. Many firms use continuous monitoring with regular vulnerability scanning. When a penetration test is the better route, we help scope and perform it, with the report provided by a third party, and track the fixes through our penetration testing and vulnerability scanning service.
Staff need security awareness training, your security personnel need to stay qualified, and the vendors that touch customer information need to be selected carefully, contractually bound to protect it, and reassessed periodically. We deliver ongoing training with phishing simulations and keep training records, and we support vendor reviews for the software and cloud services you rely on. The program itself has to be adjusted when your operations or risks change.
You need a written incident response plan that covers roles, communication, containment, recovery, and documentation of what happened and what you changed afterward. Your Qualified Individual must also report in writing to your board or a senior officer at least once a year on the status of the program, risk assessment results, service provider arrangements, security events, and recommended changes. We draft the plan, support tabletop reviews, and prepare the annual report package.
The notification requirement is narrower than many firms assume. It applies to a notification event, which is the acquisition of unencrypted customer information without authorization, involving 500 or more consumers.
Contain the incident, preserve logs, and bring in your Qualified Individual and legal counsel. Discovery is the clock start.
Determine whether unencrypted customer information was acquired. Unauthorized access is presumed to be acquisition unless you have reliable evidence that the information was not acquired. Encrypted data with a protected key is treated differently.
Count the consumers whose information was involved. Below 500, the FTC notice is not required, though your other legal duties may still apply.
Notify the FTC through its online form as soon as possible and no later than 30 days after discovery.
State breach laws, client contracts, and insurers may require their own notices and deadlines. Plan for these in your incident response plan.
A compliant program is one you can demonstrate. This table lists the records we help you keep for each element. Cyber insurers and enterprise clients often ask for the same records.
| Element | Evidence to keep |
|---|---|
| Qualified Individual | Written designation, role description, and the service provider agreement if the role is outsourced |
| Risk assessment | The written assessment, the date it was performed, and the remediation plan with owners and status |
| Access and inventory | Device and system inventory, data map, access review records, and offboarding checklists |
| Encryption and MFA | Encryption status reports for devices and backups, MFA enrollment reports, and any written exception approvals |
| Monitoring and testing | Monitoring coverage reports, vulnerability scan results at least every six months if you are not monitoring continuously, and penetration test reports if used |
| Logging and change management | Log retention settings, alert history, patch reports, and change records |
| Training | Training schedule, completion records, and phishing simulation results |
| Service providers | Vendor list, contracts or security terms, and review records |
| Incident response | The written plan, tabletop notes, and incident records |
| Annual report | The Qualified Individual’s annual written report to the board or senior officer |
We review your systems, data, and current safeguards against each rule element and document the gaps.
We put the technical controls in place and write the policies and records that support them.
We monitor your systems 24/7, scan for vulnerabilities, keep documentation current, and support your annual report.
Policies and procedures aligned to the rule elements, ready for your Qualified Individual to approve.
A written assessment with prioritized fixes, owners, and status tracking.
A current list of the devices, systems, and cloud services that hold customer information.
Evidence of MFA, encryption, logging, and monitoring configuration.
A schedule of awareness training and phishing simulations with completion reports.
A list of service providers that touch customer information, with review notes.
A written plan with roles, steps, and contact lists, including the FTC notification path.
A summary for your board or senior officer covering the items the rule requires.
Support requests follow our standard help desk response times: 1 business hour for critical issues, 2 hours for high, 4 hours for medium, and 8 hours for low priority requests.
These are patterns that commonly show up when a small financial or tax firm compares its environment to the rule. They are good first questions to ask about your own firm.
Security practices exist informally, but nothing is written down, approved, or assigned to a named Qualified Individual.
Email has MFA, but tax software, file sharing, remote access, or administrative accounts do not.
Laptops, removable drives, or backup copies that hold customer information are not encrypted.
Customer documents live in email attachments, downloads folders, personal cloud storage, and scanners, and no one has mapped them.
Customer records are kept long after the last use, with no retention or disposal schedule.
Software and cloud providers that handle customer data have never been assessed, and contracts say nothing about security.
Financial institutions under FTC jurisdiction that handle customer financial information, including tax preparers and accounting and CPA firms, mortgage brokers and lenders, investment advisory companies, credit counselors, and auto dealers that lease vehicles. Have an in-house IT team? See co-managed IT. Need ongoing security leadership? See our vCISO packages.
Risk assessments and security program documentation are quoted as projects. Ongoing safeguards and support can be added to a managed IT or co-managed IT plan.
It applies to financial institutions under FTC jurisdiction, which the rule defines as businesses engaged in activities that are financial in nature. The examples in the rule include accountants and tax preparation services, mortgage brokers, real estate settlement services, investment advisory companies, credit counseling services, check cashers, and auto dealerships that lease vehicles for longer than 90 days. Banks follow rules from their own regulators. If you are unsure, confirm with your attorney.
Yes. IRS Publication 5708 states that tax and accounting professionals are considered financial institutions under the rule regardless of size, and that they must maintain a written information security plan. The FTC enforces the rule, but the IRS publishes the guidance and a sample plan for tax professionals.
Customer information is any record containing nonpublic personal information about a customer of a financial institution, whether it is on paper, electronic, or in another form. That includes tax returns, account statements, signed engagement letters, and scanned documents sitting in email or a shared drive.
The Qualified Individual is the person you designate to oversee and enforce your security program. The rule allows an employee, an affiliate, or a service provider to serve, but your firm remains responsible for compliance. BlueKey IT can support that role through our vCISO packages while you keep oversight.
Yes. The rule requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves in writing an equivalent or more secure control. It is not limited to administrators or remote access.
The rule requires encryption of customer information both in transit over external networks and at rest. If encryption is infeasible for a specific system, your Qualified Individual may approve an alternative compensating control in writing.
The rule requires secure disposal of customer information no later than two years after the last date it is used in connection with the product or service you provide to the customer. Exceptions apply when you have a legitimate business need or a legal requirement to keep it, or when targeted disposal is not feasible. You are expected to review your retention policy periodically.
Not if you use continuous monitoring. Otherwise the rule calls for annual penetration testing plus vulnerability assessments at least every six months and whenever material changes to your operations or circumstances could affect your security program.
The FTC states that firms with customer information on fewer than 5,000 consumers are exempt from some of the rule’s requirements, including the written risk assessment, the written incident response plan, the board report, and the formal testing cadence. Confirm the exact scope with your attorney. You must still maintain a security program with a Qualified Individual, MFA, encryption, and the other core safeguards, and the FTC notification requirement still applies.
If unencrypted customer information of 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. Unauthorized access is presumed to be acquisition unless you have reliable evidence that the information was not acquired. State breach laws may add separate notice duties to your customers.
No. There is no certification for the Safeguards Rule, and the FTC enforces it. We implement and document the controls, and we keep evidence current so you can show a regulator, insurer, or client an organized, working program.
Yes. Many firms add Safeguards Rule support to a managed or co-managed IT plan so monitoring, patching, backups, MFA, access reviews, and documentation are handled in one place.
Tell us about your firm and how you handle customer information. We will explain what the Safeguards Rule means for your environment and put together a clear plan and quote.
Related compliance frameworks: CMMC compliance, HIPAA IT compliance, PCI DSS compliance, SOC 2 readiness, and ISO 27001 readiness. See also cybersecurity insurance readiness, cybersecurity and compliance, endpoint security, backup and disaster recovery, and accounting firm IT services.
Last updated: October 2026. Sources include 16 CFR Part 314, FTC business guidance, and IRS Publications 4557 and 5708.
