The FTC Safeguards Rule asks for a written security program with a named Qualified Individual, a documented risk assessment, MFA, encryption in transit and at rest, regular testing, vendor oversight and an incident response plan. Engineering owns most of the evidence. This checklist maps each element to work your team can show.
Who owns what
The FTC says a Qualified Individual must be designated to implement and supervise the program. That person can be an employee, an affiliate or a service provider, but the company stays responsible. Engineering rarely holds that title, yet engineers produce the proof: configs, logs, scan results, tickets.
The same person must report in writing to the board or a senior officer at least once a year. Plan the evidence so this report is a summary of things that already exist, not a scramble.
The technical controls
Work through these in order. Each one should end with an artifact you can point to.
- MFA for anyone accessing customer information, using at least two factor types. If you want an equivalent control, the Qualified Individual approves it in writing.
- Encryption of customer information at rest and in transit. If that is infeasible somewhere, the alternative control needs the same written approval.
- Access controls and a data inventory. You cannot protect customer data you cannot locate. List the systems, tables and buckets that hold it.
- Application security evaluation for software you build or buy that touches customer data.
- Change management and activity logging. Pull requests, approvals and audit logs are the natural evidence.
- Secure disposal of customer information no later than two years after last use, subject to exceptions the rule describes.
Testing and monitoring
The rule expects continuous monitoring. Without it, you run penetration testing annually and vulnerability assessments, including system wide scans, every six months. Put both dates in a calendar with an owner. Auditors and examiners tend to ask for the last two cycles, not a promise.
People, vendors and incidents
Security awareness training needs regular refreshers, and staff with hands on security duties need specialised training. For vendors, select providers with suitable skills, write security requirements into contracts, monitor their work and reassess them periodically. Keep a register of which vendor touches which data.
A written incident response plan should cover goals, roles, internal processes, communications, remediation, documentation and a post incident review.
The notification clock
A notification event means unauthorized acquisition of unencrypted customer information involving at least 500 consumers. You report it to the FTC as soon as possible and no later than 30 days after discovery, through the FTC online form. Note the word unencrypted: encryption done well changes what counts as an event.
Safeguard can help with the software side of this list through SBOM and dependency scanning, policies and gates on pull requests, and evidence collection. You can try a free scan at gold.safeguard.sh/scan. Whether your overall program meets the rule is a judgment for your Qualified Individual and counsel.
Quick check
Does the rule require both a pen test and vulnerability scans?
Per the FTC summary, if you do not have continuous monitoring, you need annual penetration testing and vulnerability assessments every six months.
Can a vendor be our Qualified Individual?
Yes, a service provider can fill the role, but your company remains responsible for the program.
Sources
Last reviewed: 19 October 2026.
