The FTC's Safeguards Rule is not just a concern for big financial firms; it's a direct responsibility for many small businesses, especially those handling consumer financial information. If your business touches any financial data, from tax prep to car loans, you may fall under its requirements.
Many small businesses don't realize they're subject to the Gramm-Leach-Bliley Act (GLBA). Under the FTC's 2021 amendments, the rule requires much stricter cybersecurity controls, and a 2023 amendment added a requirement to report certain data breaches to the FTC. Failure to comply could mean enforcement action, lawsuits, and reputational damage.
If you're in auto sales, tax preparation, financial advising, mortgage services, or even some manufacturing scenarios with embedded financing, read on. Your business likely needs to act now.
The FTC Safeguards Rule is part of the GLBA, which mandates that covered businesses must protect the confidentiality and integrity of customer financial data. The rule took effect in 2003, and the FTC amended it in 2021 to reflect the reality of today's cybersecurity landscape: more sophisticated threats, and more at stake.
The most recent change to the rule is a breach notification requirement, which took effect in May 2024. Here's what it requires:
Source: FTC, October 2023. Thirty days goes fast during an incident, which is one more reason to have a tested incident response plan in place before you need it.
You may be subject to the rule if your business falls under the FTC's broad definition of "financial institution." The FTC's examples include:
Institutions that maintain customer information for fewer than 5,000 consumers are exempt from some of the rule's provisions, but not all of them. If you're unsure where your business stands, it's best to consult a cybersecurity partner that understands compliance in your industry.
You're required to implement a written information security program (WISP) with specific controls. These aren't vague suggestions; they're mandatory components.
Managed IT services tip: Even small businesses need a formal, written plan. An informal approach won't meet the rule's requirements.
Attackers continue targeting smaller, locally operated firms with ransomware and phishing scams. Too often, SMBs believe they're "too small" to be worth a hacker's time.
That's not true, and a breach at a small firm can also put its customers and business partners at risk.
At Tomorrow's Technology Today, we've seen firsthand how overwhelmed small businesses can get trying to interpret compliance rules. That's why we help companies in Ohio, Indiana, and beyond create realistic roadmaps to stay compliant without breaking their budget.
The consequences of non-compliance can be severe, especially if a breach exposes the gaps.
In some cases, a single breach could be enough to shutter a small company.
You don't need a Fortune 500 IT budget to meet the rule's standards. Here's where to start:
Working with a managed IT partner like Tomorrow's Technology Today helps ensure these steps are done right without overcomplicating your operations.
Compliance is only one piece of the puzzle. At Tomorrow's Technology Today, we combine local expertise, CJIS security-trained and background-checked technicians, and a deep understanding of regulated industries to deliver IT solutions that are secure, clear, and cost-effective.
Whether you need help building your WISP, implementing MFA, or conducting a risk assessment, we're here to help with no confusing jargon or surprise fees.
Why Businesses Choose Us:
Don't leave your business exposed to fines, breaches, or reputational harm.
Give us a call at 419-678-2083 to Book a FREE 10-Minute Discovery Call and find out where your vulnerabilities are and how to fix them before it's too late.