GLBA & the FTC Safeguards Rule: What Financial Firms Must Do

What does the FTC Safeguards Rule require financial firms to do?

The FTC Safeguards Rule requires every financial firm covered by the Gramm-Leach-Bliley Act (GLBA) to build and maintain a written information security program. That program must include a named Qualified Individual, a documented risk assessment, multi-factor authentication, encryption of customer data at rest and in transit, access controls, vendor oversight, and regular testing. Enforcement is active today.

Who has to comply with GLBA and the Safeguards Rule?

The FTC Safeguards Rule requirements reach far more businesses than most owners assume. The rule applies to any "financial institution" that is significantly engaged in activities that are financial in nature, and the definition is broad. If you handle nonpublic personal information about customers, you are likely covered even if you would never call yourself a bank.

• Registered investment advisers, broker-dealers, and wealth managers
• Mortgage brokers, lenders, and loan servicers
• Tax preparers, accountants, and CPA firms that offer financial services
• Auto dealers that arrange financing, and check-cashing or payday services
• Collection agencies, financial advisers, and "finders" who bring parties together in financial transactions

The 2021 amendments, which took full effect in June 2023, moved the rule from a set of loose principles to a checklist of specific technical controls. That shift is why so many firms that were technically "compliant" for years are now out of step. If you operate in this space, our overview of managed IT for financial services firms maps these obligations to real infrastructure.

What is GLBA and how does the Safeguards Rule fit in?

GLBA, the Gramm-Leach-Bliley Act, is the 1999 federal law that governs how financial institutions collect, share, and protect consumer financial information. It has two operational pieces: the Privacy Rule, which controls how you disclose data-sharing practices, and the Safeguards Rule, which controls how you actually secure the data. The Safeguards Rule is the security backbone, and the FTC is the agency that writes and enforces it for non-bank financial firms.

The practical takeaway: GLBA sets the mandate, and the Safeguards Rule tells you exactly what a defensible security program looks like. You cannot satisfy one without the other.

What are the core controls the rule demands?

The amended rule names specific safeguards. These are not suggestions, and "we use a firewall" is not an answer. A compliant program has to demonstrably include the following elements.

• A written information security program. The plan must be documented, not informal. It has to reflect your firm's size, complexity, and the sensitivity of the data you hold. An undocumented program is treated as no program at all.
• A Qualified Individual. You must designate a single person responsible for overseeing, implementing, and enforcing the program. This role can be filled internally or through a qualified third party, but accountability sits with one named individual who reports to your board or senior leadership.
• A written risk assessment. You have to identify reasonably foreseeable internal and external risks to customer information and document how each safeguard addresses them.
• Multi-factor authentication. MFA is mandatory for anyone accessing systems that hold customer information. Passwords alone no longer satisfy the rule.
• Encryption. Customer data must be encrypted both at rest and in transit. If encryption is infeasible for a specific system, the Qualified Individual must approve a documented equivalent control.
• Access controls and monitoring. Limit access to customer data on a need-to-know basis and log who touches what.
• Vendor and service-provider oversight. You are responsible for the security practices of the third parties who touch your data, by contract and by periodic review.
• Continuous monitoring or annual testing. Either continuous monitoring or annual penetration testing plus twice-yearly vulnerability assessments.
• An incident response plan. A written plan for detecting, responding to, and recovering from a security event.

Most of these controls sit squarely in the realm of day-to-day IT operations, which is why firms increasingly hand them to a provider through compliance-focused managed IT services rather than trying to staff every function in-house.

What happens if a firm ignores the rule?

The FTC has moved from guidance to enforcement. Since the amendments took effect, the agency has pursued financial firms for weak MFA, unencrypted data, and missing security programs, and it added a breach-notification requirement in 2024 for events affecting 500 or more consumers. Beyond direct penalties, the real cost is the incident itself: a breach of customer financial data typically costs far more than a full year of doing the security program correctly, once you count forensics, notification, legal exposure, and lost clients. Spending on prevention is almost always less than one incident.

There is also a reputational dimension unique to financial services. Clients hand you their money and their most sensitive records on the assumption you can protect both. A public data breach undermines the one thing your business runs on: trust.

How do financial firms actually get compliant?

The gap between reading the rule and satisfying it is where most firms stall. A workable path looks like this:

• Designate your Qualified Individual and give them real authority and a reporting line to leadership.
• Run and document a formal risk assessment against every system that touches customer data.
• Deploy MFA everywhere and confirm encryption at rest and in transit across endpoints, servers, and cloud services.
• Write the information security program, the incident response plan, and the vendor-oversight process down, and keep them current.
• Establish the testing cadence and a schedule to review the whole program at least annually.

Financial firms are not the only regulated businesses facing this pattern. If you also serve healthcare or government clients, the discipline overlaps heavily with frameworks like HIPAA and CMMC, and the parallels are worth understanding before you build. For advisory firms specifically, our companion guide on RIA cybersecurity and compliance goes deeper on SEC expectations that stack on top of GLBA.

Frequently asked questions

Does the FTC Safeguards Rule apply to small firms?

Yes, though firms holding customer information on fewer than 5,000 consumers are exempt from a few specific requirements, such as the written risk assessment, continuous monitoring, and incident response plan. Every covered firm, regardless of size, still needs a security program, a Qualified Individual, MFA, and encryption.

Can we outsource the Qualified Individual role?

Yes. The rule expressly allows you to use a qualified third party, such as a managed IT or managed security provider, to serve as or support the Qualified Individual. You retain ultimate responsibility and must designate a senior member of your firm to oversee that provider.

Is MFA really mandatory, or just recommended?

It is mandatory. The amended rule requires multi-factor authentication for any individual accessing information systems that contain customer information, unless the Qualified Individual approves a documented, reasonably equivalent control.

Ready to close the gap? Compare vetted MSPs and MSSPs that handle GLBA and FTC Safeguards compliance — free.