Confirm the rule applies
Non-bank financial institutions: if you prepare returns, keep books, arrange financing or hold customer financial data for those activities, it applies. Size matters only for a few elements.
Financial · Federal Trade Commission
GLBA Safeguards Rule (16 CFR 314)
A written information security program, a qualified individual, MFA and encryption. CPA and tax firms are financial institutions under it.
Rather skip the call? Get a fixed-fee FTC Safeguards quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry FTC Safeguards, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Financial ServicesAccounting & Tax FirmsReal Estate Brokerages & TitleAuto Repair & Skilled TradesPrivate Schools & TutoringAgencies, Staffing & Consultancies
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no FTC Safeguards package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the FTC Safeguards-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what FTC Safeguards expects you to have in place.
- A written information security programScoped to the customer information you hold, owned by a named individual.
- Risk assessmentDocumented, repeated on a schedule, and driving what you actually implement.
- Core controlsMFA, encryption in transit and at rest, access reviews, secure configurations, patching and logging.
- Third-party oversightService providers assessed, contracted and monitored for how they protect the data you give them.
- Incident response and noticeA written plan, rehearsed, that meets the notification windows your regulator sets.
- Testing and reportingPeriodic testing of the controls and a report to leadership or the board.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for the FTC Safeguards Rule
The rule names nine elements, and the one most small firms are missing is the first: a written information security program someone actually owns.
The Safeguards Rule applies to non-bank financial institutions: tax preparers, accountants, mortgage brokers, auto dealers that arrange financing, and more. It asks for a written program, a qualified individual to run it, a risk assessment, access controls, encryption, MFA, training, vendor oversight, an incident plan and, since May 2024, notice to the FTC of breaches affecting 500 or more people.
Most templates give you a 40-page WISP nobody reads. We write one that fits the firm, name the qualified individual with you, fix the gaps and keep the evidence the FTC would ask for.
Open the safe: tick what is true for you
Tick what applies and we show which elements you need to evidence. The written program and the qualified individual apply to every covered firm.
The steps
Seven steps from "are we covered?" to a program the FTC would accept
The whole Safeguards journey, short version. We handle every step with you.
Appoint the qualified individual
One named person is responsible for the program. It can be an employee, a service provider or a fractional CISO, as long as the firm keeps oversight.
With AccuSights: we coach the person you name and write the role into the program, with the oversight the rule asks the firm to keep.
Run the risk assessment
Where customer financial data lives, who can reach it, what threatens it. Written down, with the controls you chose in response.
With AccuSights: your engineer runs it with you and writes it in the shape the rule describes.
Write the WISP
The written information security program: scope, the nine elements, who does what, how often. Short enough to be followed.
With AccuSights: we write it to fit the firm, not a template, and the staff sign it.
Fix the controls
MFA on every system with customer data, encryption at rest and in transit, access reviews, secure disposal, training, vendor agreements.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Monitor, test and train
Continuous monitoring or annual penetration testing with twice-yearly vulnerability scans; training that repeats; vendors reviewed.
- MFA on every systemPassing
- Laptops encryptedPassing
- Training completed this yearPassing
- Vendor reviews currentPassing
With AccuSights: Protect covers the monitoring element, AI-powered day and night, with an engineer confirming what it contains.
Report and notify
An annual written report to the board or owner from the qualified individual, and notice to the FTC within 30 days of discovering a breach affecting 500 or more consumers.
With AccuSights: we draft the annual report and keep the breach plan rehearsed.
Why AccuSights
Why small firms pick AccuSights for Safeguards
Template WISPs assume the firm will run them. We assume the partners are busy from January to April.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
One safe, many keys
The Safeguards controls map to the IRS Security Six, the cyber insurance form and PCI for firms that take cards, so the work counts more than once.
What it costs
What Safeguards compliance costs, in plain numbers
The FTC does not charge and does not certify. The figures below are what commenters told the FTC it would cost, quoted in the rule itself.
$199 to $15,000 a monthThe range one commenter gave the FTC for in-house, outsourced and hybrid compliance models, as quoted in the final rule.Source: FTC Safeguards Rule final rule, commenter estimates quoted by the FTC, 9 December 2021
$4,800The average penetration test cost one commenter cited to the FTC, as quoted in the final rule.Source: FTC Safeguards Rule final rule, commenter estimates quoted by the FTC, 9 December 2021
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on FTC Safeguards, in plain words.
Questions
Safeguards questions we get every week
Who does the FTC Safeguards Rule apply to?
Non-bank financial institutions under FTC jurisdiction, including mortgage brokers, auto dealers that arrange financing, tax preparers, many accounting firms, payday lenders, finance companies and colleges in federal aid programs. If you handle customer financial information in one of these roles, assume it applies and confirm with counsel. We help covered firms build a right-sized program.Source: FTC, Safeguards Rule: what your business needs to know
What does the Safeguards Rule require?
A Qualified Individual to run the program, a written risk assessment, safeguards such as access controls, encryption and MFA, monitoring or annual penetration testing with twice-yearly vulnerability scans, staff training, service-provider oversight, a written incident response plan, and a yearly written report to your board or senior officer. Each item can be short for a small firm.Source: FTC, Safeguards Rule: what your business needs to know
What is a Qualified Individual?
The person responsible for overseeing and enforcing your information security program. It can be an employee, or someone at an affiliate or service provider, but your firm keeps responsibility and must supervise them. Many small firms name an owner and use an outside partner for expertise. We coach the person you name and write the role into the program.Source: FTC, Safeguards Rule: what your business needs to know
When must we notify the FTC of a breach?
Since May 2024, you must notify the FTC as soon as possible and no later than 30 days after discovering a "notification event": unauthorized acquisition of unencrypted customer information involving 500 or more consumers. The FTC provides an online form. State breach laws may require separate notices to customers and attorneys general.Source: FTC, Safeguards Rule: what your business needs to know
Are small firms exempt from any requirements?
Partly. Financial institutions that maintain customer information on fewer than 5,000 consumers are exempt from a few elements, such as the written risk assessment, incident response plan and annual board report. The core safeguards, including MFA and encryption, still apply. We confirm which elements apply to you so you do not overbuild.Source: FTC, Safeguards Rule: what your business needs to know
Is MFA required under the Safeguards Rule?
Yes. The rule requires multi-factor authentication for anyone accessing any information system, unless your Qualified Individual approves an equivalent control in writing. The IRS has reminded tax professionals of this in 2026. Turn it on for email, remote access, client portals and line-of-business software first. We check every account during the assessment.Source: FTC, Safeguards Rule: what your business needs to know
Do you certify FTC Safeguards compliance?
No. We do not certify, and the regulator, examiner or independent auditor for FTC Safeguards has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with FTC Safeguards?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do FTC Safeguards separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Financial: PCI DSS · SEC Reg S-P · NYDFS 500 · FINRA · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for FTC Safeguards.
Book the demo and see how one control set carries FTC Safeguards and everything else you owe. Or leave your details and an engineer replies within one business day.