FTC Safeguards Rule security checks for financial businesses
The FTC Safeguards Rule covers far more than banks. If your business handles customer financial information, it likely applies to you, and it expects ongoing monitoring of your systems. Torva checks your website, email and internal network every day and maps each finding to the rule.
Who the rule covers
The FTC treats a wide range of businesses as financial institutions, including:
- Accountants, CPA firms and tax preparers
- Mortgage lenders and brokers
- Auto dealers that arrange financing or leasing
- Collection agencies and payday lenders
- Financial and investment advisers not regulated by the SEC
- Real estate appraisers, check cashers and other non-bank lenders
Coverage depends on your activities, so confirm with your compliance adviser if you're unsure.
What Torva checks
Edge checks your website and email every day: HTTPS and encryption, security headers, exposed services and whether someone could send email that looks like it came from you. Core adds checks inside your office network. See exactly what Torva checks.
Findings mapped to the rule
Turn on the FTC Safeguards Rule profile in Account and every finding shows the safeguard it relates to, such as encryption of customer information, access controls and continuous monitoring. Your scan history and fix records become dated evidence for your written information security program and your yearly report to leadership.
A fit for MSPs serving financial clients
If you support several accounting, lending or dealership clients, the Torva Partner plan lets you monitor them all from one login, with your logo on every client report.
Your written risk assessment, built in
With Complete, Torva’s compliance workspace walks through every element of §314.4: Qualified Individual, written risk assessment, access controls, inventory, encryption, MFA, disposal, change management, monitoring, testing, training, service providers, incident response, annual reporting and FTC breach notification. Torva’s scans fill in your systems and risks automatically, elements covered by the small-business exemption in §314.6 are marked, and you finalize a dated, signed risk assessment to keep on file. It supports your Safeguards Rule program; it doesn’t certify compliance.