The GLBA Safeguards Rule in Plain English for Small Firms

Who does the Safeguards Rule apply to?

It applies to every “financial institution” the FTC has jurisdiction over. That means businesses doing work that counts as financial under the Bank Holding Company Act, as long as no other regulator (a bank regulator, the SEC) already enforces GLBA against them. The scope section of the rule names mortgage lenders, mortgage brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, and investment advisors that don’t have to register with the SEC.

The definitions in 314.2 spell out a few that surprise people. An accountant or tax service that completes income tax returns is a financial institution. So is a car dealership that, as a usual part of its business, leases cars for longer than 90 days, for that leasing business.

The rule covers “customer information”: any record with nonpublic personal information about a customer, paper or electronic. It also covers customer information other financial institutions hand you. For a mortgage broker, that is the whole loan file. For a CPA, it is every return in the drawer and on the server.

Most of the small firms I talk to already know they are covered. What they don’t know is how specific the rule got after the FTC rewrote it.

What are the required elements?

The FTC’s own guidance counts nine elements in 314.4. Your program has to be written, and it has to be sized to your firm and to how sensitive the data is (314.3). Here are the nine, in plain English:

1. Name a Qualified Individual. One person oversees and enforces the program. They can work for you, an affiliate, or a service provider. If you outsource it, you still own compliance, and a senior person on your side has to oversee them.
2. Do a risk assessment. In writing, with criteria for rating risks and a plan for how each one gets fixed or accepted. Repeat it periodically.
3. Build safeguards for those risks. The rule names them: access controls and least privilege, an inventory of data, devices, and systems, encryption of customer information in transit over external networks and at rest, secure development and vetting of the apps you use, multi-factor authentication for anyone accessing any information system, secure disposal no later than two years after last use (with exceptions), change management, and logging of user activity.
4. Test and monitor the safeguards. Either continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months.
5. Train your people. Security awareness training, updated as your risks change, and qualified security staff (yours or a provider’s) who keep current.
6. Oversee service providers. Pick ones that can protect the data, require it by contract, and reassess them periodically.
7. Keep the program current. Adjust it after testing results, business changes, or new risks.
8. Write an incident response plan. It has to cover goals, roles, decision authority, communications, fixing what broke, documentation, and a review after each event.
9. Report to the board. The Qualified Individual reports in writing at least once a year to the board, or to a senior officer if there’s no board.

The 2021 amendments added most of that detail. The FTC pushed the deadline for the heaviest pieces to June 9, 2023. Encryption, MFA, the Qualified Individual, the written risk assessment, and the incident response plan have been mandatory since then.

If you run a tax practice, the accounting firms page covers how this maps onto a CPA office and its written security plan.

What changed with breach notification?

Since May 13, 2024, you have to tell the FTC about a “notification event” that involves the information of at least 500 consumers. That means as soon as possible, and no later than 30 days after you discover it. The FTC added this in a 2023 amendment, now 314.4(j).

A notification event is someone acquiring unencrypted customer information without authorization. Two details matter:

• If the attacker got the encryption key too, the data counts as unencrypted.
• Unauthorized access to unencrypted data is presumed to be acquisition, unless you have reliable evidence it wasn’t.

The clock starts the first day the event is known to anyone at your firm other than the person who caused it. That includes the employee who noticed something weird and didn’t say anything. The notice goes through a form on the FTC’s website and includes what data was involved, how many consumers, the dates if you know them, and a general description.

Read that definition again from an IT point of view. Encryption decides whether a stolen laptop is a filing or a non-event. Logging decides whether you can show reliable evidence that nothing was taken.

What's exempt for small firms?

If you maintain customer information on fewer than 5,000 consumers, 314.6 drops four requirements:

• the written risk assessment (you still have to base the program on a risk assessment)
• the continuous monitoring or annual pen test and six-month vulnerability scans
• the written incident response plan
• the annual written report to the board

That’s it. You still need a written program, a Qualified Individual, encryption, MFA, access controls, training, vendor oversight, and regular testing of your key controls. The 500-consumer FTC notification still applies to you too.

The count is consumers you hold data on, not active clients. A tax practice with a few hundred returns a year and a decade of old files can pass 5,000 faster than the owner thinks. Count before you claim it.

What IT has to prove

The rule talks about programs and policies. In practice, the question an auditor or examiner asks is “show me.” These are the controls that need evidence behind them, and where that evidence usually comes from:

• Encryption at rest. Every laptop and desktop encrypted, with recovery keys escrowed somewhere you control. We rolled BitLocker out zero-touch across 127 endpoints with escrowed keys when a client’s cyber insurance required it. The escrow was the part that would have failed an audit.
• Data inventory and disposal. You can’t protect or dispose of data you don’t know about. A password-file scan we ran for a compliance audit found 23 files with “password” in the name that held real credentials. A written policy didn’t stop that. A scan found it.
• MFA on every account. Not enrolled. Enforced. The title company inbox takeover we contained happened on an inherited tenant where 2-Step Verification was optional.
• Logging and monitoring. User activity logs and alerting, so a 314.4(j) decision is based on evidence instead of a guess.
• Vendor contracts. Your IT provider, your loan origination system, your tax software, your cloud storage. Each one needs safeguards in the contract.

A mortgage brokerage with all nine elements on paper and no MFA report to show is in worse shape than one with a short program and real evidence behind every line.

Key takeaways

What this looks like when we do it

We map controls to the specific section of the rule, 314.4, and build the documentation auditors actually ask for. For a firm starting from nothing, the first pass is a risk assessment, the written program, and the technical controls. That build is scoped as a project on a call, then folds into month-to-month managed IT so the program stays current instead of going stale in a binder.

From there the evidence comes from the tools that run every day. Encryption status and escrowed keys from the RMM. MFA enforcement in the tenant. Scans for files that shouldn’t exist. Patching and monitoring on every machine. When something does go wrong, I write it up, the same way I wrote every report on this site.

If you broker mortgages, prepare returns, or run another firm the rule names, and you aren’t sure which of the nine elements you can actually prove, book a call. Fifteen minutes is enough to find out where you stand.