FTC Safeguards Rule checklist
Every task for 16 CFR 314.4, (a) through (j). Under 5,000 consumers, items marked “5,000+ only” aren't required (16 CFR 314.6). FTC notice: unencrypted information on 500+ consumers taken? Report within 30 days of discovery.
(a) Qualified Individual 16 CFR 314.4(a)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Name a Qualified Individual to run your security program 16 CFR 314.4(a) | One-time setup | A signed and dated memo naming your Qualified Individual and their duties. |
| ☐ | If your QI is outside help, name a senior person to oversee them 16 CFR 314.4(a)(1)-(3) | One-time setup | The contract clause plus a memo naming the senior person who oversees your outside Qualified Individual. |
| ☐ | Write down your information security program 16 CFR 314.3(a) | One-time setup | Your current written information security program showing the date it was last updated. |
(b) Risk assessment 16 CFR 314.4(b)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Do a risk assessment of your customer information 16 CFR 314.4(b) | One-time setup | Your dated risk assessment notes or worksheet listing the risks and planned fixes. |
| ☐ | Put your risk assessment in writing with formal criteria (5,000+ only) 16 CFR 314.4(b)(1) | One-time setup | A signed, dated written risk assessment that includes your rating criteria and a decision for each risk. |
| ☐ | Redo your risk assessment every year and after big changes 16 CFR 314.4(b)(2) | Every year | The dated, updated risk assessment showing what changed since the last one. |
(c) Safeguards 16 CFR 314.4(c)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Give each person their own login and only the access they need 16 CFR 314.4(c)(1) | Ongoing (review yearly) | A list of users and their access level for each system that holds customer information. |
| ☐ | Review who has access to customer information 16 CFR 314.4(c)(1) | Every 3 months | A dated access review record listing each system checked and the changes made. |
| ☐ | Remove access the same day someone leaves 16 CFR 314.4(c)(1) | Ongoing (review yearly) | A completed, dated offboarding checklist for each person who left. |
| ☐ | Lock up paper files and limit who can enter work areas 16 CFR 314.4(c)(1) | Ongoing (review yearly) | A short written description of your physical security practices and a current key and alarm-code list. |
| ☐ | List your data, people, devices, systems, and locations 16 CFR 314.4(c)(2) | Every year | A dated inventory spreadsheet of data, people, devices, systems, and locations with an importance rating. |
| ☐ | Encrypt client data sent over the internet 16 CFR 314.4(c)(3) | Ongoing (review yearly) | A note of the tools you use to send data securely, plus any signed Qualified Individual approvals for exceptions. |
| ☐ | Encrypt laptops, phones, servers, and backups 16 CFR 314.4(c)(3) | Ongoing (review yearly) | A device list showing encryption is on for each device, plus any Qualified Individual approvals for exceptions. |
| ☐ | Check the security of software you use with client data 16 CFR 314.4(c)(4) | Every year | A dated app security checklist showing each app, what you checked, and your decision. |
| ☐ | Follow secure coding practices for anything you build in-house 16 CFR 314.4(c)(4) | Ongoing (review yearly) | A note listing your in-house tools (or stating there are none) and the secure development practices you follow. |
| ☐ | Turn on multi-factor authentication for every system 16 CFR 314.4(c)(5) | Ongoing (review yearly) | A list of systems with MFA status for each, plus any written Qualified Individual approvals for exceptions. |
| ☐ | Securely destroy client data within 2 years after last use 16 CFR 314.4(c)(6)(i) | Ongoing (review yearly) | Shredding or device destruction certificates and a dated log of each data cleanup. |
| ☐ | Review your data retention policy every year 16 CFR 314.4(c)(6)(ii) | Every year | Your dated data retention policy with notes from the latest review. |
| ☐ | Check the security impact before you change systems 16 CFR 314.4(c)(7) | Ongoing (review yearly) | A change log showing approved changes and their security review. |
| ☐ | Log user activity and review alerts for misuse 16 CFR 314.4(c)(8) | Every month | Screenshots of your audit logging settings and a monthly log review record. |
(d) Testing and monitoring 16 CFR 314.4(d)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Test that your key safeguards actually work 16 CFR 314.4(d)(1) | Every 3 months | A dated test checklist with results and fixes. |
| ☐ | Choose continuous monitoring or a yearly test-and-scan schedule (5,000+ only) 16 CFR 314.4(d)(2) | One-time setup | A signed memo stating your chosen approach and the tools or vendors that provide it. |
| ☐ | Get a penetration test every year (5,000+ only) 16 CFR 314.4(d)(2)(i) | Every year | The penetration test report and a record of how each finding was fixed. |
| ☐ | Run vulnerability scans every six months and after big changes (5,000+ only) 16 CFR 314.4(d)(2)(ii) | Every 6 months | Dated scan reports and a record of the fixes made. |
(e) Staff and training 16 CFR 314.4(e)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Give every staff member security awareness training 16 CFR 314.4(e)(1) | Every year | Training materials plus dated attendance records or certificates for every staff member. |
| ☐ | Make sure qualified people manage your security 16 CFR 314.4(e)(2) | Ongoing (review yearly) | A list of the people or provider managing your security, with their qualifications. |
| ☐ | Keep your security people trained on current risks 16 CFR 314.4(e)(3) | Every year | Certificates or a dated log of security training completed by your security personnel. |
| ☐ | Verify key security staff keep up with new threats 16 CFR 314.4(e)(4) | Every year | A dated note or email confirming how your key security staff stayed current this year. |
(f) Service providers 16 CFR 314.4(f)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Vet service providers before giving them client data 16 CFR 314.4(f)(1) | Ongoing (review yearly) | A vendor list with dated security due-diligence notes for each provider. |
| ☐ | Require security safeguards in every vendor contract 16 CFR 314.4(f)(2) | Ongoing (review yearly) | Signed contracts or accepted terms for each vendor showing the security clause. |
| ☐ | Review each service provider's security every year 16 CFR 314.4(f)(3) | Every year | Dated vendor review notes or questionnaires with your conclusion for each vendor. |
(g) Evaluate and adjust 16 CFR 314.4(g)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Review and update your security program 16 CFR 314.4(g) | Every year | The updated written program with a dated summary of changes. |
(h) Incident response plan 16 CFR 314.4(h)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Write an incident response plan (5,000+ only) 16 CFR 314.4(h) | One-time setup | Your written, dated incident response plan covering all seven required areas. |
| ☐ | Test and update your incident response plan (5,000+ only) 16 CFR 314.4(h)(7) | Every year | Dated notes from each exercise or post-event review and the revised plan. |
(i) Annual report to the board 16 CFR 314.4(i)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Have your Qualified Individual report in writing every year (5,000+ only) 16 CFR 314.4(i) | Every year | The signed, dated written report and a record of when it was presented. |
(j) Notify the FTC 16 CFR 314.4(j)
| Done | Task | How often | Keep on file |
|---|---|---|---|
| ☐ | Know how to report a notification event to the FTC within 30 days 16 CFR 314.4(j) | Ongoing (review yearly) | A saved link to the FTC form, your written reporting steps, and copies of any reports you filed. |
From Safeguards Tracker by Golden Rock (safeguards.goldenrockadvancements.com). Plain-language guidance from the rule text, not legal advice.