FTC Safeguards Rule guides

Plain-English answers, quoted from the rule itself. Not legal advice.

• WISP template: what your written information security plan must include

  What the FTC Safeguards Rule requires in a written information security plan (WISP), element by element, with a free builder and checklist.

• The Safeguards Rule's small-business exemption, explained

  The FTC Safeguards Rule's small-business exemption (16 CFR 314.6): the four requirements firms with fewer than 5,000 consumers can skip, and everything that still applies.

• The FTC's 30-day breach notice, explained

  When the FTC Safeguards Rule requires you to notify the FTC of a breach (16 CFR 314.4(j)): what counts as a notification event, the 30-day deadline, and what the form asks.

• Who can be your Qualified Individual?

  Who can be your Qualified Individual under the FTC Safeguards Rule (16 CFR 314.4(a)), including an outside IT provider, and what they're responsible for.

See the full checklist