The Safeguards Rule's small-business exemption, explained

The exact rule

“Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.”

The four items you can skip

• 314.4(b)(1): writing the risk assessment down with formal criteria. You still assess risk; you just don't have to document it that way.
• 314.4(d)(2): continuous monitoring, or a yearly penetration test plus vulnerability scans every six months. You still test or monitor your safeguards regularly.
• 314.4(h): a written incident response plan.
• 314.4(i): the Qualified Individual's yearly written report to your board or owner.

Everything that still applies

• A written information security program (314.3(a)) and a named Qualified Individual (314.4(a)).
• A risk assessment, even if it isn't written to formal criteria (314.4(b)).
• The safeguards: access controls, an inventory, encryption, multi-factor authentication, secure disposal, change management and monitoring of user activity (314.4(c)).
• Regular testing or monitoring (314.4(d)(1)), training (314.4(e)), oversight of service providers (314.4(f)) and keeping the program current (314.4(g)).
• The FTC notice within 30 days of discovering a notification event involving 500 or more consumers (314.4(j)). Size doesn't change this one.

How to count to 5,000

Count consumers the way 16 CFR 314.6 does: individuals whose customer information you keep, current and past, not just this year's clients. If you're not sure which side of 5,000 you're on, treat everything as required until you've counted.