You are a non-bank financial institution
Mortgage lenders and brokers, consumer lenders, auto dealers that arrange financing, tax preparers, and many fintechs fall under the FTC’s Safeguards Rule rather than the banking regulators.
- Home
- Frameworks
- GLBA / FTC Safeguards
The FTC Safeguards Rule, built into a program that holds up.
Under the Gramm-Leach-Bliley Act, non-bank financial institutions must run a written information security program with specific safeguards. I build it and can serve as your Qualified Individual.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — When it comes up
Why companies call me about GLBA and the FTC Safeguards Rule
The amended Safeguards Rule turned general expectations into specific requirements, and many firms have not caught up.
A bank partner or investor is doing due diligence
Warehouse lenders, bank partners, and investors ask for your written program, risk assessment, and board reporting before they extend credit or close a deal.
No one is named as your Qualified Individual
The rule requires one person to oversee the program and report to the board. That person can be an employee or work for a service provider, provided you keep oversight.
02 — How the work runs
How I build it
The rule lists what the program must contain. I build each element so it works in your environment and leaves a record.
01
Qualified Individual
Designate the person accountable for the program. A virtual CISO can fill this role, with the oversight the rule requires.
02
Written risk assessment
Identify reasonably foreseeable risks to customer information and evaluate your existing safeguards against them.
03
Required safeguards
Access controls, a data inventory, encryption, multi-factor authentication, secure disposal, change management, and monitoring of user activity.
04
Testing, training, and vendors
Annual penetration testing and vulnerability scans at least every six months, or continuous monitoring, plus staff training and oversight of service providers.
05
Incident response and board reporting
A written incident response plan, notification to the FTC within 30 days for events affecting 500 or more consumers, and a written report to your board at least annually.
03 — Fixed fees
What it costs
Fixed fees, agreed in writing before work starts.
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Gap report against each Safeguards Rule element
- Written risk assessment summary
- 90-day roadmap
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentVirtual CISO retainer
From $2,000 / month
Someone accountable for running the program after it is built.
- Can serve as your Qualified Individual
- Prepares the annual board report
- Oversees testing, vendors, and incidents
Implementation: once the assessment defines the scope, building the program is quoted as a fixed fee, never hourly. See also financial services for NYDFS Part 500 and bank-partner requirements.
04 — Questions
Common questions
Straight answers to what clients usually ask first. Anything else, bring it to the call.
Are small firms exempt?
Partly. Institutions that maintain customer information on fewer than 5,000 consumers are exempt from a few requirements, including the written risk assessment, incident response plan, and annual board report, but not from the rest of the rule.
Who enforces the Safeguards Rule?
The Federal Trade Commission, for financial institutions not supervised by a federal banking agency. Banks and credit unions follow the interagency guidelines enforced by their own regulators.
Can you be our Qualified Individual?
Yes, as part of a retainer. The rule allows a service provider to fill the role, as long as your company retains responsibility, designates a senior person to oversee the provider, and requires the provider to maintain an appropriate program.
Does this cover NYDFS Part 500?
Not by itself. New York’s cybersecurity regulation has additional requirements, including a CISO, annual certification, and specific notification timelines. The financial services page covers both.
Next step
Book a discovery call
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com