Many Iowa business owners assume federal data security rules are for banks. But the FTC Safeguards Rule reaches a much wider group of businesses, including tax preparers, auto dealers that arrange financing, mortgage brokers, and other companies that handle customers’ financial information. If that describes your business, the rule may already apply to you.
This guide explains who the rule covers, what it requires, how its breach notification requirement works, and practical steps for a small firm without in-house IT or legal staff.
What the FTC Safeguards Rule Is
The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It requires covered businesses to develop, implement, and maintain a written information security program to protect customer information. Banks and credit unions answer to their own regulators. The FTC enforces this rule for non-bank businesses that engage in financial activities.
The rule was significantly updated, with most new requirements taking effect in June 2023. Those updates added specific expectations like multi-factor authentication and encryption. Programs written before then may be out of date.
Who the Rule Covers
The FTC’s definition of “financial institution” is broad. Businesses commonly covered include:
- Tax preparation firms, including accounting firms that prepare returns
- Auto dealers that arrange, broker, or offer financing or leasing
- Mortgage brokers and non-bank lenders
- Investment advisors that aren’t required to register with the SEC
- Other businesses significantly engaged in financial activities, such as finance companies and collection agencies
The rule applies to customer information: nonpublic personal information about people who get a financial product or service from you. Social Security numbers, income details, bank account numbers, credit applications, and tax returns all fall into this category.
If you’re not sure whether your business is covered, that’s a question for your attorney. The cost of assuming you’re not covered can be significant.
What Your Program Must Include
A compliant written information security program addresses several required elements:
- A qualified individual. Designate one person to oversee the program. This can be an employee or someone from an outside provider, but your business remains responsible.
- A written risk assessment. Identify where customer information is stored, who can access it, and the realistic threats to it.
- Safeguards based on that assessment. These include access controls, a current inventory of systems and data, encryption of customer information in storage and in transit, multi-factor authentication for anyone accessing customer information, secure disposal of data you no longer need, and monitoring of user activity.
- Regular monitoring and testing. Either continuous monitoring or periodic penetration testing and vulnerability assessments.
- Staff training. Security awareness training so your people can carry out the program.
- Service provider oversight. Choose vendors that can protect customer information, require safeguards in your contracts, and check on them periodically.
- Keeping the program current. Update it when your business, systems, or risks change.
- A written incident response plan. Define who does what if customer information is compromised.
- Reporting to leadership. The qualified individual reports to your owners or board at least once a year.
A Note for Smaller Firms
The rule includes a limited exemption for businesses that maintain customer information on fewer than 5,000 consumers. Those businesses are exempt from a few requirements, including the written risk assessment, the incident response plan, the annual report, and certain testing requirements. They still need a written information security program and the other safeguards. Confirm with your attorney whether the exemption applies to you before relying on it.
The Breach Notification Requirement
Since May 13, 2024, covered businesses must notify the FTC within 30 days of discovering a “notification event” involving the unencrypted customer information of at least 500 consumers. The notice goes through a form on the FTC’s website.
Iowa has its own requirements too. Under Iowa Code Chapter 715C, businesses must notify affected Iowa residents when certain personal information is compromised, and if more than 500 Iowa residents are notified, the Iowa Attorney General’s office must be told within five business days. A single incident response plan that covers both federal and state requirements is easier to follow under pressure than two separate documents.
What Enforcement Looks Like
The FTC can bring enforcement actions against businesses that fail to comply. Settlements often include consent orders that require years of compliance reporting and independent assessments at the company’s expense. A breach at a business with no written program is especially difficult to defend, because the missing program itself shows the rule wasn’t followed.
A Practical Roadmap for Small Iowa Firms
Step 1: Confirm coverage. Work with your attorney to determine whether the rule applies and whether any exemptions do.
Step 2: Name your qualified individual. Put the designation in writing.
Step 3: Inventory customer information. List every place it lives: tax or accounting software, dealer management systems, email, cloud storage, paper files, and anything a vendor can access.
Step 4: Assess your risks. Document realistic threats, such as phishing, ransomware, lost devices, and vendor compromise.
Step 5: Put the required controls in place. Turn on multi-factor authentication, verify encryption is actually active, limit access to people who need it, and set up monitoring.
Step 6: Write the program. Pull your findings and controls into one document with a review date.
Step 7: Review vendor contracts. Make sure agreements with anyone who touches customer information include security requirements.
Step 8: Build and practice your incident response plan. Cover FTC notification and Iowa’s requirements, and walk through it with your team.
Your IT Provider Is Part of Your Compliance
The rule requires you to oversee service providers with access to customer information, which includes your IT provider. Ask whether they can document the controls on your systems, show evidence that multi-factor authentication and encryption are in place, and help you maintain your written program.
CyberCore Technologies builds security into every service plan. For businesses that need hands-on compliance support, our Compliance service tier includes risk assessments and help developing and maintaining a written information security program. We work with accounting firms, financial businesses, and other compliance-sensitive organizations across Des Moines and central Iowa. If you’d like to see where you stand against the rule, we offer a free assessment and are glad to talk whenever it’s helpful.
This post is general information, not legal advice. Consult your attorney about your specific obligations.
