What changed with the 2023 Safeguards Rule updates?

The FTC replaced loose principles with specific requirements: a designated Qualified Individual, written risk assessments, MFA, encryption, continuous monitoring or regular testing, a written incident response plan and an annual written report to the board.

Is there a small business exemption?

Institutions holding customer information on fewer than 5,000 consumers are excused from some requirements, including the written risk assessment, the incident response plan and the annual board report. They still need an information security program with appropriate safeguards.

Can we outsource the qualified individual role?

Yes. The Qualified Individual can work for an affiliate or a service provider. Your institution still owns compliance, so you must oversee that person and make sure they have the authority and resources to do the job, and a named senior employee should supervise them.

How does GLBA interact with state privacy laws?

GLBA overrides state laws only where they conflict with it; states can add stricter requirements. Some state regulators have their own cybersecurity rules that apply on top, the New York DFS cybersecurity regulation being the best known, and state breach notification laws still apply when customer financial data is exposed.

What security testing is required?

Either continuous monitoring of your information systems, or annual penetration testing plus semi-annual vulnerability assessments. Continuous monitoring gives better coverage, because a misconfigured server found the week it appears is cheaper than one found at the next scan. The testing route exists for organizations that cannot run real-time monitoring yet.

GLBA Safeguards Rule Checklist

Overview

The FTC enforces the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. The original version was short and vague: have an information security program, develop it, implement it, maintain it. The amendments that took effect in 2023 spelled out what the program must contain, down to who runs it (a Qualified Individual) and what that person tells the board each year in writing. MFA, encryption, a written risk assessment and regular testing are now explicit. A later amendment made certain security incidents reportable to the FTC itself.

Banks mostly answer to their own regulators, so the rule really bites on mortgage brokers, auto dealers, tax preparers and the like. Many of them have no security staff at all, which is exactly why the FTC wrote the requirements down.

Who Must Comply

The FTC reads "financial institution" broadly. If you are on this list, the rule applies:
Mortgage lenders and brokers
Payday lenders, finance companies
Account servicers, check cashers
Financial or investment advisors; tax preparation firms, including seasonal storefront preparers
Insurance companies, and travel agencies acting in a financial capacity
Real estate settlement services
Car dealerships that arrange financing
Colleges and universities in federal student loan programs
Retailers with their own store credit card

Key Requirements Under the 2023 Updates

Requirement	Description
Qualified Individual	A named person who oversees and runs the information security program
Written Risk Assessment	Periodic, written assessment of foreseeable threats and of how well current safeguards hold up
Access Controls	Access to customer information limited to people who need it, and reviewed periodically
Data Inventory	A list of the systems, devices and data stores that hold or process customer data
Encryption	Customer information encrypted in transit and at rest
MFA	Multi-factor authentication for anyone accessing customer information
Disposal Procedures	Customer information no longer needed is securely disposed of within two years
Change Management	The program is re-evaluated and adjusted when operations or systems change
Monitoring	Continuous monitoring, or annual penetration testing plus semi-annual vulnerability assessments
Incident Response	A written incident response plan, kept current
Board Reporting	The Qualified Individual reports in writing to the board at least annually

Building Your Information Security Program

Name your Qualified Individual first. No particular certification is required, but the person needs the knowledge to run the program and the authority to make people fix things. It can be an employee, someone at an affiliate or a service provider, and the institution stays responsible either way.

Then write the GLBA risk assessment. List the foreseeable internal and external threats (a stolen laptop, a phished loan officer, a vendor with standing VPN access, a former employee whose login still works), rate how sensitive each category of customer information is, and judge whether today's safeguards are enough. Be specific. Everything else in the program, from which systems get MFA first to what goes in the board report, should trace back to this document, and examiners or FTC staff will read it before anything else.

Implementation Priorities

Finish the data inventory, so you know which customer information you hold and where; include the shared drive full of scanned loan applications
Turn on MFA for every system that touches customer information, starting with email and remote access
Encrypt customer data at rest and in transit
Write access control rules on least privilege and run the first review
Choose continuous monitoring, or book the penetration test and vulnerability scans
Write the incident response plan with named roles, a call tree and the notification steps, including notice to the FTC where required
Set up service provider oversight, with security requirements written into contracts
Train staff at onboarding and annually, and keep the attendance records
Schedule the annual written report to the board and keep a copy

Enforcement and Consequences

The FTC enforces the Safeguards Rule through investigations, consent orders and public enforcement actions, and state attorneys general can act as well. FTC consent orders commonly run for 20 years and impose ongoing compliance monitoring and assessments, which is a long time to have a regulator reading your security reports. A breach of customer financial data also triggers state breach notification laws, invites class action litigation, and costs trust that a financial services firm does not easily win back.