PressmarkFTC Safeguards Rule requirements, in one table
All elements of 16 CFR 314.4, as of Nov 8, 2026 (eCFR text as of Nov 1, 2026). Plain summaries next to the rule’s own words. It does not say whether the rule covers you, and it is not legal advice.
Customers covered by the rule must run an information security program with these elements, and paragraph (f) tells them to oversee their service providers. That is one reason a vendor receives a security questionnaire. See why paragraph (f) leads to questionnaires.
| Section | Topic | What it asks | Rule text excerpt |
|---|---|---|---|
| 314.4(a) | Qualified Individual | Name one person responsible for the information security program. | “Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program” |
| 314.4(b) | Written risk assessment | Base the program on a written risk assessment, and repeat it periodically. | “Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks” |
| 314.4(c)(1) | Access controls | Limit access to authorized users, and to what they need for their duties. | “Implementing and periodically reviewing access controls” |
| 314.4(c)(2) | Inventory | Identify and manage data, personnel, devices, systems and facilities by importance. | “Identify and manage the data, personnel, devices, systems, and facilities” |
| 314.4(c)(3) | Encryption | Encrypt customer information in transit over external networks and at rest, or use approved compensating controls. | “Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest” |
| 314.4(c)(4) | Secure development | Secure development practices for in-house apps; evaluate external apps. | “Adopt secure development practices for in-house developed applications” |
| 314.4(c)(5) | Multi-factor authentication | MFA for anyone accessing any information system, unless the Qualified Individual approves an equivalent control in writing. | “Implement multi-factor authentication for any individual accessing any information system” |
| 314.4(c)(6) | Data disposal | Secure disposal procedures, generally within two years of last use, with exceptions; review retention periodically. | “Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used” |
| 314.4(c)(7) | Change management | Procedures for change management. | “Adopt procedures for change management” |
| 314.4(c)(8) | Activity logging | Monitor and log authorized users' activity to detect unauthorized access or tampering. | “Implement policies, procedures, and controls designed to monitor and log the activity of authorized users” |
| 314.4(d)(1) | Testing and monitoring | Regularly test or monitor the effectiveness of key controls. | “Regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures” |
| 314.4(d)(2) | Continuous monitoring or testing | Continuous monitoring, or else annual penetration testing and vulnerability assessments at least every six months. | “Annual penetration testing of your information systems” |
| 314.4(e) | Personnel and training | Security awareness training, qualified security staff, updates and training for them. | “Providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment” |
| 314.4(f) | Service providers | Select capable providers, require safeguards by contract, assess them periodically. | “Oversee service providers” |
| 314.4(g) | Evaluate and adjust | Adjust the program after testing, material changes or new risk assessments. | “Evaluate and adjust your information security program” |
| 314.4(h) | Incident response plan | A written incident response plan covering seven listed areas. | “Establish a written incident response plan designed to promptly respond to, and recover from, any security event” |
| 314.4(i) | Board reporting | Qualified Individual reports in writing to the board or a senior officer at least annually. | “Require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body” |
| 314.4(j) | FTC notification | Notify the FTC of a notification event involving 500 or more consumers, within 30 days of discovery. | “if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event” |
| 314.6 | Exception for small institutions | Paragraphs 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. | “Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.” |
Data
The same 19 rows with source links: ftc-safeguards-rule-requirements.csv. Licence: CC BY 4.0; please link back to this page.
Summaries are Pressmark’s own shorthand; the excerpts are verbatim. The wording of any paragraph may be amended after Nov 1, 2026. Source: eCFR, 16 CFR 314.4 and 314.6. Check the live text before relying on it.
See the concept
Early concept in validation. The call is a 20-minute conversation, not a software demo.