Many small business owners have never heard of the FTC Safeguards Rule.
Unfortunately, ignorance doesn’t exempt you from compliance.
If your business handles customer financial information — even indirectly — you may be required to comply with the Federal Trade Commission’s Safeguards Rule.
And in recent years, the requirements have become significantly more demanding.
What Is the FTC Safeguards Rule?
The FTC Safeguards Rule is a federal regulation designed to protect customer information from unauthorized access, misuse, and cyberattacks.
The rule requires covered businesses to develop, implement, and maintain a comprehensive, written information security program.
In plain English: the government expects you to take reasonable, documented steps to protect sensitive customer data.
The rule has been around for years, but it changed substantially in 2021, when the FTC significantly strengthened it. Most of those strengthened requirements carried a compliance deadline of June 9, 2023. Then, in late 2023, the FTC added a breach-notification requirement that took effect May 13, 2024.
Here’s the part that catches businesses off guard in 2026: there are no new Safeguards Rule changes scheduled this year. The rules aren’t new. What’s changed is the expectation. Regulators now assume you’ve fully adapted — and that you can prove it with evidence. The era of “we’re working on it” is over.
Does My Business Need to Comply?
Many business owners assume the rule only applies to banks.
That’s not true.
The FTC’s definition of a “financial institution” is broad — Section 314.2(h) of the rule lists 13 examples of covered entity types. The Safeguards Rule may apply to:
- Auto dealerships
- Mortgage lenders and brokers
- Tax preparation firms
- Accountants and financial advisors
- Payday and finance companies
- Collection agencies
- Insurance agencies and finders
- Non-federally-insured credit unions
- Any business that offers or arranges financing
This is a big deal in our part of the country. An auto dealership financing trucks, a tax preparer down on Main Street, a small finance company — these are exactly the kinds of Northern Plains businesses that are covered and frequently don’t realize it. (Auto dealers in particular are squarely in scope, which is why the National Automobile Dealers Association has been raising the alarm for years.)
If you’re unsure whether your organization falls under the rule, consult qualified legal counsel.
What Does Compliance Actually Require?
The FTC doesn’t simply say “try your best.”
The Safeguards Rule requires organizations to implement specific administrative, technical, and physical safeguards — and to put one person in charge. Covered businesses must designate a Qualified Individual to oversee the information security program, and that person must report in writing to leadership at least once a year.
The core elements include:
Risk Assessments
Businesses must conduct a written risk assessment that identifies:
- Threats
- Vulnerabilities
- Likely attack scenarios
- Potential business impacts
You cannot protect against risks you haven’t identified.
Access Controls
Employees should only have access to the information necessary to perform their jobs.
Not everyone needs access to everything. This principle — least privilege — also pairs naturally with network segmentation, which limits how far a compromised account can reach.
Multi-Factor Authentication
The rule specifically requires MFA for anyone accessing customer information.
It has become one of the most important security controls available. Many organizations can eliminate a large percentage of account-compromise risk simply by implementing MFA consistently — which is also why it sits at the top of every cyber insurance questionnaire.
Encryption
Customer information must be encrypted, both in transit and at rest.
Security Awareness Training
Technology alone cannot solve human problems.
Employees must understand:
- Phishing
- Social engineering
- Password security
- Safe data handling practices
Monitoring and Logging
Businesses should be able to answer questions such as:
- Who accessed sensitive information?
- When was it accessed?
- Was anything unusual detected?
If you cannot answer those questions, your visibility is limited.
Incident Response Planning
When a security incident occurs — and eventually one will — your organization should already know:
- Who responds
- What systems are affected
- How communication occurs
- How recovery happens
A crisis is a terrible time to create a plan. And under the 2024 amendment, the clock matters: covered businesses must notify the FTC of a qualifying security event — one involving the unencrypted information of 500 or more consumers acquired without authorization — as soon as possible, and no later than 30 days after discovery.
Common Compliance Gaps We See
Many small businesses struggle with:
- Shared user accounts
- Weak password practices
- No MFA
- No security awareness training
- Poor documentation
- Missing risk assessments
- Inadequate backups
- Unmanaged vendor access
Most of these problems are fixable.
The challenge is knowing they exist in the first place. And notice how many of them are documentation gaps rather than missing technology — which is why a well-maintained Continuity Binder does double duty as compliance evidence.
Why Compliance Matters
The Safeguards Rule isn’t just about avoiding penalties.
It’s about protecting:
- Customers
- Revenue
- Reputation
- Operations
Cybersecurity failures are expensive.
Regulatory failures often make them worse. And remember — under the Safeguards Rule, responsibility for customer data doesn’t disappear when you hand it to a vendor. If a service provider contributes to a breach, the organization that owns the data remains accountable. That makes vendor oversight a compliance obligation, not an afterthought.
The Bottom Line
The FTC Safeguards Rule isn’t a technology project.
It’s a business risk management framework.
Organizations that treat compliance as a strategic initiative are typically more secure, more resilient, and better prepared for future challenges than those that treat it as a checkbox exercise. Being able to navigate requirements like this is also one of the clearest tests of a good technology partner — it’s Red Flag #7 in How to Evaluate Your IT Provider in 2026.
The goal isn’t perfect security.
The goal is demonstrating that you’ve taken reasonable, documented steps to protect the people who trust you with their information.
Schedule a Cybersecurity Assessment
Not sure whether the FTC Safeguards Rule applies to you — or whether you’d pass if the FTC came knocking?
Cybertek Systems helps auto dealers, tax and accounting firms, credit unions, insurance agencies, and other covered businesses across South Dakota and Nebraska build and document compliant security programs — risk assessments, access controls, MFA, encryption, monitoring, training, and incident response — and the evidence to prove it.
Schedule a free Cybersecurity Assessment and we’ll show you exactly where you stand against the Safeguards Rule and what it takes to close the gaps.
Call us at (605) 842-TECH (8324) Or join us at Tech Tuesday, held the 2nd and 4th Tuesday of every month.
Cole Nicholas is the owner of Cybertek Systems, a managed IT, cybersecurity, surveillance, and VoIP provider based in Winner, South Dakota, serving rural and regional businesses across the Northern Plains.
This article is general information, not legal advice. Whether the FTC Safeguards Rule applies to your business — and what compliance requires in your situation — should be confirmed with qualified legal counsel.