The FTC Safeguards Rule is the part of the Gramm-Leach-Bliley Act (GLBA) framework that tells non-bank financial institutions how to protect customer information. Amendments to the rule added specific technical requirements, including a clear choice between continuous monitoring and periodic penetration testing. This guide explains who the rule covers, what its testing section actually says, and how to meet it without over-buying.
Who the rule applies to
The Safeguards Rule covers financial institutions under the FTC's jurisdiction that aren't regulated by a banking agency. In practice that includes a wide range of businesses that may not think of themselves as "financial":
- Mortgage brokers, lenders and servicers that aren't banks
- Auto dealers that arrange or offer financing or leasing
- Tax preparation firms
- Payday lenders and consumer finance companies
- Fintech lenders and other non-bank financial technology firms
Banks and credit unions follow their own regulators' safeguards rules instead. Firms licensed in New York may also fall under NYDFS Part 500, which has its own annual penetration testing requirement. If you aren't sure which rules apply, ask counsel before scoping.
What the rule says about testing
Section 314.4(d)(2) requires you to regularly test or otherwise monitor the effectiveness of your safeguards. For information systems, that means one of two routes:
| Route | What it requires | Suits |
|---|---|---|
| Continuous monitoring | Effective continuous monitoring of your information systems, able to show on an ongoing basis whether safeguards are working and when new vulnerabilities appear | Organizations with mature monitoring, configuration and vulnerability tooling across all relevant systems |
| Periodic testing | Annual penetration testing, with scope based on your risk assessment, plus vulnerability assessments at least every six months and after material changes | Most small and mid-sized institutions |
The FTC has described this as "one, not both". You don't need continuous monitoring and periodic testing. But if you choose continuous monitoring, you need to be able to show that it really is effective and covers the systems that hold customer information. For many organizations, periodic testing is easier to evidence.
What counts as a penetration test
Section 314.2 defines penetration testing, in essence, as attempting to circumvent the security features of an information system from outside or inside it. Two points follow from that definition:
- A vulnerability scan is not a penetration test. Scans identify known weaknesses; a penetration test attempts to exploit them. The rule asks for both, on different schedules.
- Both outside and inside matter. Scope should follow your risk assessment, which for most institutions means internet-facing systems, customer portals and the internal network that holds customer data.
See vulnerability assessment vs penetration testing for how the two fit together.
The 5,000-consumer exemption
Section 314.6 exempts financial institutions that maintain customer information concerning fewer than 5,000 consumers from certain requirements, including the penetration testing and vulnerability assessment requirements in 314.4(d)(2). The exemption is partial. Other duties under the rule, such as designing and maintaining appropriate safeguards, still apply. And even when testing isn't required, a test is often the cheapest way to show that your safeguards work.
Breach notification to the FTC
Amendments effective May 13, 2024 added a notification duty under 314.4(j). If a "notification event" occurs, meaning unauthorized acquisition of unencrypted customer information involving at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery. State breach notification laws may also require notices to affected individuals and state authorities. Monitoring and incident readiness therefore belong in the same program as testing.
A practical testing calendar
For an institution that chooses periodic testing, a simple annual cycle looks like this:
- Update the risk assessment and use it to define the penetration test scope: external perimeter, customer-facing applications and APIs, and internal systems holding customer information.
- Vulnerability assessment, month 1: authenticated internal and external scanning, triaged by a person, with findings assigned to owners.
- Annual penetration test: manual testing of the agreed scope, with critical findings reported immediately.
- Remediate and retest within an agreed window, and record any accepted risks.
- Vulnerability assessment, month 7: the second scheduled assessment, plus extra assessments after any material change, such as a new loan platform or a merger.
- Report to leadership: as good practice, summarize results and remediation status for your board or senior management.
What it typically costs
Costs depend on scope. Published 2026 US price guides put external network tests at roughly $4,000 to $12,000, internal network tests at $5,000 to $35,000 and web application tests at $5,000 to $30,000. Small institutions with one customer portal and a modest office network are usually toward the lower end. See our US pricing guide for more detail.
How we help
We run penetration tests and six-monthly vulnerability assessments that map to the Safeguards Rule's testing section, with reports that document scope, methodology, findings and remediation for your records. We deliver remotely from India, agree testing windows around your US time zone and quote fixed prices in USD. We don't provide legal advice on whether the rule applies to you, and the decision to notify the FTC stays with you and your counsel.
Frequently asked questions
Who does the FTC Safeguards Rule apply to?
Non-bank financial institutions under FTC jurisdiction, such as mortgage brokers, auto dealers that offer financing, tax preparers, payday lenders and many fintech lenders. Banks are covered by other regulators' rules. If you're unsure whether you're covered, ask counsel.
Do we need both continuous monitoring and penetration testing?
No. The rule requires one or the other: effective continuous monitoring, or periodic testing made up of an annual penetration test and vulnerability assessments at least every six months and after material changes. The FTC has described it as one, not both.
Are small companies exempt?
Partly. Under 314.6, institutions that maintain customer information on fewer than 5,000 consumers are exempt from certain requirements, including the penetration testing and vulnerability assessment requirements. Other duties in the rule still apply.
Need a Safeguards Rule testing plan? Request a fixed-price proposal or see our network penetration testing and vulnerability management services.