The FTC Safeguards Rule: A Plain-English Overview for Small Firms Using Assistants

Many small businesses don't think of themselves as "financial institutions." But under the Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission's Standards for Safeguarding Customer Information — commonly called the Safeguards Rule — applies to a wide range of non-bank businesses that handle customer financial information. The FTC amended the rule in 2021, with most new requirements taking effect in 2023, and added a breach-notification requirement that took effect in 2024.

If your firm uses remote assistants who touch customer information, the Safeguards Rule shapes how you should set that up. This guide is a plain-English overview, not legal advice. Consult your own counsel or compliance advisor about how the rule applies to you.

Who the rule covers

The FTC's guidance describes covered "financial institutions" broadly. Examples the FTC has cited in its business guidance include mortgage brokers, motor vehicle dealers that provide financing, payday lenders, tax preparation firms, certain investment advisers not registered with the SEC, and others significantly engaged in financial activities. Banks and some other institutions are covered by their own regulators' versions of similar rules.

If you're unsure whether you're covered, the FTC's publication FTC Safeguards Rule: What Your Business Needs to Know is a good starting point.

What the rule requires — the main elements

The rule requires a written information security program with administrative, technical and physical safeguards appropriate to your size and the sensitivity of the information. Key elements include:

1. A Qualified Individual responsible for overseeing the program. This can be an employee or a service provider.
2. A written risk assessment identifying reasonably foreseeable risks to customer information.
3. Safeguards to control the risks identified, including:
4. Access controls, limiting access to authorized users and only to what they need.
5. Knowing what data you have and where it is.
6. Encryption of customer information in transit and at rest.
7. Secure development practices for in-house applications.
8. Multi-factor authentication for anyone accessing customer information on your systems.
9. Secure disposal of customer information within set timeframes.
10. Change-management procedures.
11. Monitoring and logging of authorized users' activity.
12. Regular testing or monitoring of safeguards.
13. Staff training on security awareness.
14. Oversight of service providers: selecting providers capable of maintaining appropriate safeguards, requiring them by contract to do so, and periodically assessing them.
15. Keeping the program current as your business changes.
16. A written incident response plan.
17. Regular reporting by the Qualified Individual to your board or senior leadership.
18. Notification to the FTC of certain security events involving unencrypted information of at least 500 consumers, under the 2024 amendment.

The FTC has provided some exemptions for smaller institutions (based on the number of consumers whose information they maintain) from certain written-program requirements; check the current rule for specifics.

What this means when you use a remote assistant

A remote assistant who handles customer information is part of your security program, and a provider like ExecWing is a service provider under the rule. Practical implications:

Service-provider oversight

• Choose providers that can describe their safeguards clearly.
• Include security obligations in your agreement.
• Periodically review the provider's practices.

Access controls

• Give the assistant only the access their tasks require. See the least-privilege access checklist.
• Use named accounts rather than shared logins, so access is attributable.

MFA

• Require MFA on every system the assistant uses to access customer information. The rule specifically calls for MFA.

Data location

• Keep customer information in your systems. Assistants should work inside your tools, not download data to personal devices or storage.

Monitoring

• Use the logging your systems provide to monitor access.

Training

• Include your assistant in your security-awareness training, including phishing and payment fraud. See payment fraud controls.

Disposal

• Make sure assistants don't retain customer information after tasks are done or when they leave. See offboarding a remote assistant securely.

Incident response

• Your incident response plan should cover what the assistant does if they suspect a compromise — who to contact and how fast.

Industry-specific notes

• Tax preparers: The IRS also publishes guidance for tax professionals, including Publication 4557, Safeguarding Taxpayer Data, and requires certain preparers to have a written information security plan. See our CPA firm playbook.
• Mortgage brokers and lenders: Investor, warehouse and state requirements may add further rules on vendor and offshore access. See mortgage condition tracking.
• Auto dealers: Dealers that arrange financing are among the examples the FTC cites. See automotive dealerships.
• Insurance agencies: State insurance data security laws, many modeled on the NAIC Insurance Data Security Model Law, may also apply.

How ExecWing supports clients' programs

ExecWing assistants:

• Work only in client systems, under client access policies.
• Use MFA and password managers.
• Sign confidentiality agreements.
• Follow the controls described on our security page.

We can provide information about our practices to support your service-provider oversight. We don't provide legal or compliance advice; your Qualified Individual and advisors determine what your program requires.

A starter checklist

• [ ] Determine whether the Safeguards Rule applies to your business
• [ ] Designate a Qualified Individual
• [ ] Complete and document a risk assessment
• [ ] Implement access controls, MFA and encryption
• [ ] Document service-provider oversight, including assistant providers
• [ ] Train all staff, including remote assistants
• [ ] Write an incident response plan
• [ ] Understand FTC notification requirements
• [ ] Schedule periodic review

Questions to ask a service provider

When documenting oversight of an assistant provider, useful questions include:

• What background checks and confidentiality agreements apply to assistants?
• Do assistants work only within client systems, or do they store data elsewhere?
• What device and network standards apply?
• How are credentials handled, and is MFA required?
• How quickly will the provider notify you of a suspected security event?
• What happens to access when an assistant leaves?

Record the answers and revisit them periodically as part of your program review.

Quick answers

Does using ExecWing make us compliant? No provider can make you compliant on its own. Your program, risk assessment and oversight determine compliance; we support it with our controls.

Who should be our Qualified Individual? That's your decision. Many small firms designate an owner or operations leader, sometimes supported by an outside IT or security adviser.

Key takeaways

• The rule covers many non-bank businesses that handle customer financial information.
• It requires a written program, a Qualified Individual, a risk assessment and specific safeguards including MFA.
• Service-provider oversight applies to assistant providers.
• Start with the FTC's own business guidance and confirm details with your advisors.

The bottom line

The FTC Safeguards Rule covers more small businesses than many realize. If you're covered and you use remote assistants, treat them as part of your information security program: limited access, MFA, data in your systems, training, provider oversight and a response plan. Start with the FTC's own business guidance and talk to your advisors.