PressmarkWhy does a customer send you a security questionnaire under the FTC Safeguards Rule?
As of Nov 8, 2026. Some customers send a security questionnaire because a federal rule tells them to check their service providers. This page quotes that rule as written. It does not say whether the rule covers you or your customer, and it is not legal advice.
What 16 CFR 314.4(f) says
The FTC Safeguards Rule is 16 CFR Part 314. Section 314.4 lists the elements of the information security program a covered financial institution must maintain. Paragraph (f) is about vendors:
“Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.”
eCFR, 16 CFR 314.4(f), text as of Nov 1, 2026. Read section 314.4 on eCFR
Who counts as a service provider
Section 314.2 defines the term:
“Service provider means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this part.”
eCFR, 16 CFR 314.2, text as of Nov 1, 2026. Read section 314.2 on eCFR
A SaaS or MSP vendor whose service touches a covered customer’s customer information can fall under that wording. Whether yours does depends on the customer and the data, which this page cannot judge.
Where the questionnaire fits
The rule asks the institution to assess its providers “periodically” and “based on the risk they present”. It does not name a questionnaire. A questionnaire is one way a customer may choose to gather that information; the rule text above does not require any particular format.
| Rule text | What a vendor can keep ready |
|---|---|
| (f)(1) select and retain capable providers | Accurate answers about your real safeguards, each with an owner |
| (f)(2) require safeguards by contract | Contract terms your counsel has reviewed; this page gives no advice on them |
| (f)(3) periodically assess | Answers with review dates, so a repeat questionnaire gets a current response |
What to do when one arrives
Answer only what is true and cite evidence you hold. Keep each answer in a reusable answer library with an owner and a review date, because paragraph (f)(3) points to repeat assessments. If you hold no attestation report, see answering without one, and start from the questionnaire guide.
Source: eCFR, Title 16, Part 314, current text as of Nov 1, 2026. Check the live eCFR text before relying on it.
See the concept
Early concept in validation. The call is a 20-minute conversation, not a software demo.