FTC Safeguards Rule: No More Grace Period.

01Who this actually applies to

When people hear "FTC Safeguards Rule," they assume it is a banking regulation. It is not. It applies to any business the FTC classifies as a "financial institution" — and that definition is far broader than most owners expect.

In Tennessee, the businesses we most often see caught off guard include:

• Auto dealers — because you arrange financing, you are covered
• Accountants and tax preparers — you handle consumer financial data
• Mortgage brokers and lenders
• Real estate settlement firms
• Finance companies, payday lenders, and check cashers
• Any business that extends credit or arranges financing for consumers

If you collect a Social Security number, bank account, or income information to make a financing decision, assume you are in scope until a qualified advisor tells you otherwise.

02What compliance actually requires

The Rule requires a written information security program with nine core elements. In plain English:

• A designated Qualified Individual responsible for the program (can be internal or outsourced to an MSP)
• A written risk assessment — documented, not just "we think we are fine"
• Access controls — least privilege, who can see what
• Encryption of customer data at rest and in transit
• Multi-factor authentication on systems holding customer data
• Secure disposal of customer information you no longer need
• Change management procedures
• Logging and monitoring of authorized user activity
• A written incident response plan
• Vendor oversight — your service providers must be held to the same standard
• Annual reporting to your board or governing body

03The gaps we find most often

When we run a Safeguards Rule gap assessment for a Tennessee business, the same problems show up over and over:

No documented risk assessment. No designated Qualified Individual on paper. MFA missing on at least one system that touches customer data. No formal vendor due diligence. No written incident response plan. And critically — no documentation proving any of the controls that do exist.

That last point matters most. The penalty when something goes wrong is rarely just the breach. It is that you could not show the auditor the program you were required to maintain.

04What to do this quarter

You do not need to panic, but you do need to start. The practical sequence:

• Confirm whether you are in scope (most businesses arranging consumer financing are)
• Designate a Qualified Individual — internal or via your MSP
• Run a documented risk assessment against the nine required elements
• Close the obvious gaps: MFA, encryption, access controls
• Write the incident response plan and vendor oversight policy
• Keep the documentation — that is what proves compliance

We do this for dealers, accounting firms, and finance businesses across Tennessee. If you want a one-page checklist of the controls to verify, that is a free starting point — no engagement required.