Does the FTC Safeguards Rule require security awareness training?

The Safeguards Rule, at 16 CFR Part 314, requires covered businesses to develop, implement and maintain a written information security program. Section 314.4 lists the elements that program must include.

Paragraph (e) requires policies and procedures to ensure personnel are able to enact the security program. Its first item is "providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment."

The rest of paragraph (e) deals with the people who run security, not general staff.

The rule applies to financial institutions under the FTC's jurisdiction, as defined through the Gramm-Leach-Bliley Act. A financial institution is any business significantly engaged in financial activities, which covers far more than banks.

The FTC's business guidance lists examples including mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counsellors and other financial advisors, tax preparation firms, non-federally insured credit unions and certain investment advisors.

The FTC's auto dealer FAQs say the rule applies to most automobile dealers who finance or lease automobiles. A dealer that arranges financing for customers, or leases vehicles for longer than 90 days, is treated as a financial institution for the rule.

Yes. Section 314.6 exempts financial institutions that maintain customer information concerning fewer than 5,000 consumers from four specific provisions: 314.4(b)(1), (d)(2), (h) and (i).

Those exempt provisions are the written risk assessment, continuous monitoring or annual penetration testing with vulnerability scans, the written incident response plan, and the annual written report to the board. The training requirement in 314.4(e) is not on that list, so a small tax office or used car dealer that finances vehicles still has to train its staff.

The rule ties training to the risk assessment, so content should reflect the threats your business actually faces. The FTC's guidance says employees need security awareness training with regular refreshers, and that people with hands-on security duties need more specialized training.

For a small financial business, the common risks are phishing emails, stolen passwords, fake invoices and fraudulent requests to change payment or wiring details.

Since May 2024, covered businesses must notify the FTC of a notification event involving the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information.

The notice must be filed electronically on the FTC's website as soon as possible, and no later than 30 days after discovery. An event counts as discovered on the first day it is known to anyone at the business other than the person committing the breach, so staff who report suspicious activity promptly matter.

The rule requires a written information security program, and training is one of its elements. Keeping dated records of who completed training and when gives the business evidence to put alongside that program, and something to show an examiner, auditor or insurer.

NetMinder is a phishing simulation and awareness training platform that MSPs provide to their clients under their own brand. It sends monthly practice phishing emails, gives a two minute lesson when someone clicks, and produces per-employee certificates and a training report for any date range. These records can help a business document its training. They do not by themselves make a business compliant with the Safeguards Rule.