Compliance
A written information security program, a Qualified Individual, and the safeguards 16 CFR Part 314 describes.
NorthStar helps financial institutions subject to the Federal Trade Commission's Safeguards Rule develop, implement, and maintain a written information security program under 16 CFR Part 314. NorthStar can serve as your designated Qualified Individual. Under 16 CFR 314.4(a), a Qualified Individual may be employed by you, an affiliate, or a service provider. If you use a service provider in that role, you still retain responsibility for compliance with the Rule, you must designate a senior member of your personnel to direct and oversee the Qualified Individual, and you must require that service provider to maintain an information security program that protects you in accordance with the Rule. We are not a certifying body, and this page is not a promise that the FTC or any other authority will find your organization in compliance. The summary below is general information, not legal advice. Your organization remains responsible for its own compliance determinations. For the controlling text, read 16 CFR Part 314 on the electronic Code of Federal Regulations.
This is a plain-language map of the current Safeguards Rule. It is not a substitute for the regulation itself.
16 CFR Part 314 applies to the handling of customer information by financial institutions over which the FTC has jurisdiction under section 501(b) of the Gramm-Leach-Bliley Act, and that are not otherwise subject to another regulator's enforcement authority under section 505 of that Act (16 CFR 314.1(b)). The Rule's examples include, but are not limited to, mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders. The Rule applies to all customer information in your possession, whether it belongs to your customers or to customers of other financial institutions that provided it to you (16 CFR 314.1(b)). Confirm whether you are a financial institution under the Rule; this page does not make that determination for you.
You must develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and that contains administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue (16 CFR 314.3(a)). The program must include the elements in 16 CFR 314.4 and be reasonably designed to insure the security and confidentiality of customer information, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access or use that could result in substantial harm or inconvenience to any customer (16 CFR 314.3(b)).
You must designate a Qualified Individual responsible for overseeing, implementing, and enforcing your information security program (16 CFR 314.4(a)). The Qualified Individual may be employed by you, an affiliate, or a service provider. NorthStar can serve as your designated Qualified Individual. If you meet this requirement using a service provider or an affiliate, you shall: retain responsibility for compliance with Part 314; designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual; and require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of Part 314 (16 CFR 314.4(a)(1) through (3)).
You must base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to customer information and assesses the sufficiency of existing safeguards (16 CFR 314.4(b)). Unless an exception in 16 CFR 314.6 applies, that risk assessment must be written and must include the criteria and risk-treatment requirements in 16 CFR 314.4(b)(1). You must also periodically perform additional risk assessments (16 CFR 314.4(b)(2)). Among the safeguards in 16 CFR 314.4(c), you must protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. If you determine that encryption in transit over external networks or at rest is infeasible, you may instead use effective alternative compensating controls reviewed and approved by your Qualified Individual (16 CFR 314.4(c)(3)). You must implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls (16 CFR 314.4(c)(5)). Other 314.4(c) safeguards include access controls, data and asset inventory, secure development and application assessment, secure disposal, change management, and logging and monitoring of authorized-user activity.
You must regularly test or otherwise monitor the effectiveness of key safeguards (16 CFR 314.4(d)(1)). Unless an exception in 16 CFR 314.6 applies, monitoring and testing of information systems must include continuous monitoring or periodic penetration testing and vulnerability assessments, including annual penetration testing and vulnerability assessments at least every six months, and when material changes or other circumstances may have a material impact, as set out in 16 CFR 314.4(d)(2). You must also provide security awareness training, use qualified information security personnel, oversee service providers by contract and periodic assessment (16 CFR 314.4(e) and (f)), and evaluate and adjust the program as conditions change (16 CFR 314.4(g)). Unless 16 CFR 314.6 applies, you must establish a written incident response plan designed to promptly respond to and recover from any security event materially affecting the confidentiality, integrity, or availability of customer information in your control (16 CFR 314.4(h)), and you must require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body, or to a senior officer if no such board exists (16 CFR 314.4(i)).
Upon discovery of a notification event, if the event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery, on the form the FTC provides at ftc.gov (16 CFR 314.4(j)). A notification event means acquisition of unencrypted customer information without the authorization of the individual to whom the information pertains (16 CFR 314.2(m)). Section 314.4(j) is effective as of May 13, 2024 (16 CFR 314.5). A narrower exception exists for smaller institutions: 16 CFR 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than 5,000 consumers (16 CFR 314.6). That is not an exemption from the rest of the Rule. Designating a Qualified Individual, maintaining a written program, performing a risk assessment, implementing safeguards such as encryption and multi-factor authentication, overseeing service providers, and the FTC notification requirement in 16 CFR 314.4(j) still apply. Confirm eligibility against the Rule, not against this summary.
We help you build, operate, and document a program that tracks 16 CFR 314.4. We do not certify compliance, and we cannot guarantee an examination, enforcement, or insurance outcome.
NorthStar can serve as your designated Qualified Individual. You still retain responsibility for compliance, designate a senior member of your personnel to direct and oversee that role, and require us to maintain an information security program that protects you in accordance with the Rule, as 16 CFR 314.4(a) requires.
Help drafting and maintaining a written information security program and a written risk assessment that address the elements in 16 CFR 314.3 and 314.4(b), then adjusting the program as testing, operations, or risks change.
Implementation of access controls, encryption in transit over external networks and at rest, multi-factor authentication, logging, secure disposal, and the other safeguards listed in 16 CFR 314.4(c), or documented compensating controls where the Rule allows the Qualified Individual to approve them.
Monitoring and testing support, security awareness training, and a process for selecting, contracting with, and periodically assessing service providers under 16 CFR 314.4(d) through (f).
A written incident response plan that addresses the topics in 16 CFR 314.4(h), and written Qualified Individual reporting to your board or senior officer at least annually under 16 CFR 314.4(i), unless a 16 CFR 314.6 exception applies.
Help assembling the facts and documentation a notification event may require under 16 CFR 314.4(j), and aligning program evidence with the controls many cyber insurers ask to see. We do not guarantee coverage, premium, or regulatory outcomes.
FTC Safeguards work sits alongside financial services, security, and insurance support already on this site. Accounting firms and tax preparers are addressed on our financial services page.
This case study is already published on our site. It describes one engagement, not a typical or guaranteed result.
Read the controlling text and official agency guidance. If this page and a source differ, the source controls.
This page is general information about the FTC Safeguards Rule, 16 CFR Part 314. It is not legal advice, does not create an attorney-client relationship, and is not a substitute for counsel or for reading the regulation. Your organization remains responsible for its own compliance determinations, including designation of a senior member of your personnel to direct and oversee a service-provider Qualified Individual. NorthStar helps you design, implement, and operate technical and administrative safeguards and documentation, and can serve as your designated Qualified Individual under 16 CFR 314.4(a). NorthStar is not a regulator or a certifying body and does not guarantee any examination, enforcement, or insurance outcome.
About the author
Ken Satkunam, CISM
President & Founder, NorthStar Technology Group
Ken has spent over 25 years in IT leadership, serving in roles from technical support to CIO for organizations as large as 23,000 employees. He founded NorthStar Technology Group in 2000 to help regulated organizations build secure, compliant, and operationally resilient technology environments. Ken holds the Certified Information Security Manager (CISM) credential from ISACA and is the co-author of the Amazon best-seller "Cyber Attack Prevention." He has been quoted in industry publications including eWeek and DM News, and NorthStar has been recognized on the Inc. 5000 list in both 2024 and 2025.
We can review your written program, risk assessment, and technical safeguards, and we can discuss serving as your designated Qualified Individual. Your organization remains responsible for compliance with 16 CFR Part 314.
