The FTC Safeguards Rule expects you to select service providers with appropriate skills, put security requirements in the contract, monitor their work and reassess them periodically. In practice that means a vendor register, a short questionnaire, contract language and a review calendar, kept for every provider that touches customer information.
Start with a register
List every vendor and mark the ones that store, process or can see customer information. Cloud hosting, support desks, analytics tools, email senders and code hosting often qualify. Record the data type, the owner on your side and the renewal date.
The register is the evidence that you chose providers on purpose. An unmaintained spreadsheet is better than nothing, but a dated one with owners is much better.
Questions worth asking
Keep the questionnaire short enough that vendors answer it honestly.
- Where is our data stored and who can access it?
- Is it encrypted in transit and at rest?
- Do you require MFA for staff who can reach customer data?
- How and when will you tell us about an incident?
- Which subprocessors do you use?
- How do you test your own software, and how do you handle vulnerabilities?
Ask for documents where they exist, but do not accept a logo on a web page as an answer.
Contract terms that matter
The FTC guidance says security requirements belong in the contract. Cover incident notice timing (your own clock to the FTC is 30 days from discovery for events of 500 or more consumers, so a vendor that tells you late eats into it), data return and deletion, and subprocessor changes.
Monitoring and reassessment
Monitoring does not have to be heavy. Review incident notices, re-ask the questionnaire annually for higher risk vendors, and check for changes in ownership or hosting. Write down the decision each time, including when you accept a gap.
The software supply chain angle
Vendors are not only SaaS. Open source libraries and build tools are providers too. An SBOM for your own product shows which components you depend on, and dependency scanning shows which have known flaws. Safeguard offers SBOM and dependency scanning and policy gates for this, and you can try the free scan at gold.safeguard.sh/scan.
A simple review rhythm
Tier your vendors by what they can see. High tier vendors, those holding or processing customer information at scale, get a full review at signing and every year. Medium tier get a lighter check every year or two. Low tier get a register entry only. Write the tiering rule down once so each decision is not a debate. When a vendor fails to answer, record that fact and the follow up. A documented chase is better evidence than silence, and it shows the oversight was real. Keep the register where the Qualified Individual can find it, since that person must report to leadership at least annually.
Quick check
Do we have to audit every vendor?
The FTC summary asks for selection, contract terms, monitoring and periodic reassessment. It does not call for the same depth for every vendor, so scale effort to the data they touch.
Sources
Last reviewed: 19 October 2026.
