SOC 2
Type II
Achieved
2023
Amendments significantly expanded scope
Non-bank
Financial institutions now included
Written
Security program required
Qualified
Individual must be designated
Safeguards Rule Scope Assessment
The FTC Safeguards Rule applies to any business that is significantly engaged in providing financial products or services. We assess whether your organization is covered, define which systems and data fall within scope, and establish the boundary for your information security program.
Risk Assessment & Information Security Program
The Safeguards Rule requires a written risk assessment identifying the foreseeable risks to customer information and a written information security program that addresses those risks. We conduct the required risk assessment and draft the information security program document that satisfies FTC requirements.
Technical Safeguards Implementation
The 2023 Safeguards Rule amendments require specific technical controls: encryption of customer information in transit and at rest, MFA for any employee accessing customer information, penetration testing and vulnerability assessments, and monitoring for unauthorized access. We implement each required control and document compliance.
Vendor & Service Provider Oversight
The Safeguards Rule requires oversight of service providers that access customer information: written contracts requiring appropriate safeguards and periodic review of their security practices. We build the vendor management program required by the Rule.
Qualified Individual Designation
The 2023 amendments require designation of a Qualified Individual responsible for overseeing the information security program and reporting to the board annually. garrisonOne can serve as your Qualified Individual or advise on internal designation and the required annual report.
Safeguards Rule Documentation & Board Reporting
The Rule requires written documentation of the information security program, risk assessment, and annual board report. We produce all required documentation and prepare the board report template that satisfies FTC requirements.
What Makes Us Different From Others
- 2023 Amendment Coverage The 2023 Safeguards Rule amendments added significant new requirements including MFA, encryption, penetration testing, and the Qualified Individual role. We implement against the current rule, not the outdated 2003 version.
- Qualified Individual Services We can serve as your designated Qualified Individual, handling program oversight and the required annual board report for organizations without internal security leadership.
- Auto Dealer Expertise Auto dealers became subject to the Safeguards Rule under the 2023 amendments. We have specific experience helping dealerships build their information security programs.
- Complete Documentation Package We deliver every written document the Rule requires: risk assessment, information security program, vendor contracts addendum, and board report: in formats that satisfy FTC examination.
- Penetration Testing Included The Rule requires annual penetration testing or vulnerability assessments with biannual scanning. We provide these as part of the Safeguards compliance program.
garrisonOne walked us through our first security assessment and built a remediation roadmap that mapped directly to our compliance goals. We hit our SOC 2 Type II milestone on schedule and the auditor said it was one of the cleaner first-time audits they had seen.
Client results
See how we have helped
Retail
E-Commerce — PCI DSS Penetration Test
Pre-PCI DSS audit penetration test uncovered critical vulnerabilities in the payment processing environment. All findings remediated before the QSA assessment.
Critical
Findings remediated
PCI DSS
Audit passed
0
Post-test failures
Industry focus
Industries we serve
Related Services: All Compliance | HIPAA Compliance | PCI DSS | vCISO Services
Frequently asked questions
Who is covered by the FTC Safeguards Rule?
The FTC Safeguards Rule covers financial institutions under FTC jurisdiction: non-bank financial services companies including auto dealers, mortgage brokers, payday lenders, tax preparers, financial advisors, debt collectors, and others that are significantly engaged in providing financial products or services. Banks and credit unions are covered by separate federal banking regulator requirements.
What changed in the 2023 FTC Safeguards Rule amendments?
The 2023 amendments added specific technical requirements previously absent from the Rule: encryption of customer information in transit and at rest, MFA for employees accessing customer information, annual penetration testing or vulnerability assessment with biannual scanning, access controls, monitoring for unauthorized access, secure development practices, and designation of a Qualified Individual responsible for the information security program.
What is a Qualified Individual under the Safeguards Rule?
The Safeguards Rule requires designation of a Qualified Individual responsible for overseeing, implementing, and enforcing the information security program. This can be an employee, officer, or a service provider. The Qualified Individual must report to the board or governing body annually on the status of the information security program.
Does the Safeguards Rule apply to auto dealers?
Yes. The 2023 amendments explicitly extended Safeguards Rule requirements to auto dealers, which the FTC determined are financial institutions under the Gramm-Leach-Bliley Act because they frequently arrange financing for vehicle purchases. Auto dealers had a compliance deadline that passed in 2023.
What are the penalties for FTC Safeguards Rule violations?
The FTC can seek civil penalties and injunctive relief for Safeguards Rule violations. Civil penalties can reach $50,120 per violation per day. More significantly, a data breach involving customer financial information can trigger FTC enforcement action, state attorney general investigations, and private litigation.
How long does FTC Safeguards Rule compliance take?
For a smaller financial institution with no existing information security program, initial compliance typically takes eight to twelve weeks. Organizations with existing security controls that need documentation and gap remediation can achieve compliance in four to six weeks.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
