The Safeguards Rule, issued by the Federal Trade Commission under the Gramm-Leach-Bliley Act, requires covered financial institutions to develop, implement, and maintain an information security program. The FTC's definition of financial institution is broad and includes tax preparers, many accountants, mortgage brokers, and other businesses that handle consumer financial information.
The amended rule sets out specific elements, including a designated qualified individual, a written risk assessment, access controls, encryption, multi-factor authentication, monitoring, staff training, oversight of service providers, an incident response plan, and periodic reporting to leadership. Covered businesses must also notify the FTC of certain security events. Smaller institutions are exempt from some requirements, but the core program still applies.