The rule is prescriptive.
The notification clock is 30 days. The Qualified Individual signs the board report.

Probably yes. The Safeguards Rule definition of a financial institution is much broader than the traditional banking-and-tellers image suggests.

The rule applies to any entity "significantly engaged in financial activities" that is subject to the FTC's jurisdiction — which includes mortgage brokers and lenders, motor vehicle dealers offering financing, payday lenders and consumer finance companies, tax preparers and CPA firms providing financial services, financial advisors and wealth managers operating outside the SEC's investment adviser jurisdiction, debt collectors, check cashers, money services businesses, and colleges and universities administering Title IV federal student financial aid (which makes most U.S. colleges Safeguards-covered through their FAFSA processing).

If your organization handles "nonpublic personal information" about consumers — Social Security numbers, account numbers, driver's license numbers, financial transaction histories, credit information, or anything obtained in connection with a financial product or service — and you're not regulated by one of the federal banking agencies (OCC, Federal Reserve, FDIC, NCUA) or the SEC under Reg S-P, the FTC Safeguards Rule applies to you.

The applicability test is functional, not nominal — what activities you actually perform, not what the company is called. The 2026 FTC enforcement posture has been clear: "we didn't think we were a financial institution" is not a defense once the FTC concludes the rule applies.

The Written Information Security Program (WISP) is the central, written, version-controlled document the FTC Safeguards Rule requires every covered financial institution to maintain. It's the master document that ties together everything else the rule requires — the risk assessment, the safeguards, the incident response plan, the training program, the service provider oversight, the Qualified Individual's designation, and the annual board reporting cadence.

The WISP must include nine specific elements under the revised 2023 rule:

(1) A designated Qualified Individual responsible for overseeing the program. (2) A written risk assessment that identifies reasonably foreseeable internal and external risks to customer information security. (3) Designed safeguards across eight specific control areas (access controls, asset inventory, encryption rest+transit, secure development, MFA, secure disposal, change management, monitoring/logging). (4) Regular testing and monitoring — annual pen tests, biennial vulnerability assessments at minimum, or continuous monitoring as an alternative.

(5) Personnel security awareness and training. (6) Service provider oversight processes including vendor due diligence and contractual safeguard requirements. (7) A written incident response plan. (8) At least annual written reports from the Qualified Individual to the board of directors. (9) The WISP itself, maintained current to reflect material changes in operations, technology, and risk.

The WISP must be "reasonable and appropriate" to the size and complexity of the institution and the nature and scope of its activities — but the 9 prescriptive elements are required regardless of size.

The Qualified Individual is the single most operationally consequential change in the 2023 Safeguards Rule revision. The rule requires every covered financial institution to designate a Qualified Individual — by name, with personal accountability — responsible for overseeing, implementing, and enforcing the institution's information security program.

The Qualified Individual is the named human the FTC looks to when the program is being evaluated, and the named human who signs the annual board report.

The role can be filled by an employee, an affiliate, or a service provider (which is one of the structural enablements of vCISO arrangements under the rule), but the Qualified Individual must have the security knowledge and experience appropriate to the size and complexity of the institution's operations. If the Qualified Individual is provided by a service provider rather than employed directly, the financial institution retains responsibility for designating a senior member of personnel to direct and oversee the Qualified Individual.

The annual board report from the Qualified Individual must include an overall assessment of the institution's compliance with the WISP, material matters related to the WISP including risk assessment results, risk management decisions, service provider arrangements, test results, security events, and recommendations for changes. This board report is one of the artifacts the FTC explicitly examines in enforcement actions — institutions without a current annual report face significant exposure.

Many smaller covered institutions retain a vCISO or external Qualified Individual rather than hiring full-time — both for cost and to access the security expertise the role requires.

A Notification Event under the Breach Notification Amendment (effective May 13, 2024) is defined as the unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. The definition has important nuances:

Customer information is considered unencrypted if an unauthorized person accessed the encryption key — meaning a ransomware attack that exfiltrates encrypted data along with the keys triggers the notification clock just as much as an unencrypted breach would.

Unauthorized access to unencrypted customer information is presumed to be unauthorized acquisition unless the institution has reliable evidence disproving that — the burden is on the institution to demonstrate non-acquisition, not on the FTC to prove acquisition.

The notification window is as soon as possible and no later than 30 days after discovery. Discovery is the point at which the institution knows or reasonably should have known about the event — which can be earlier than when the institution has fully investigated or confirmed the breach.

The notification is submitted through the FTC's published reporting form on their website and must include specific elements: the institution's identifying information, the time and circumstances of the event, the number of consumers affected, the categories of information involved, and details of the institution's response.

The FTC may publicly post the submission — which is itself a significant enforcement and reputational risk amplifier. Civil penalties for FTC violations have reached $51,744 per day under the 2026 inflation-adjusted civil penalty schedule, and the 30-day notification requirement is one of the most actively enforced obligations in the rule.

SEC Regulation S-P is the SEC's implementing regulation of GLBA for broker-dealers, investment advisers, and investment companies subject to the SEC's jurisdiction. It runs parallel to the FTC Safeguards Rule rather than replacing it — SEC-regulated entities comply with Reg S-P; non-bank financial institutions comply with the FTC Safeguards Rule; banks and credit unions comply with their respective federal banking agency's implementation.

The SEC adopted significant 2024 amendments to Regulation S-P that took effect December 2025 for larger covered entities (broker-dealers and investment advisers managing $1.5 billion+ in assets) and become effective June 2026 for smaller entities.

The 2024 amendments introduced three substantial new requirements that align Reg S-P with modern incident response expectations:

(1) Covered entities must adopt and maintain written incident response programs designed to detect, respond to, and recover from unauthorized access to or use of customer information.

(2) Covered entities must notify affected individuals as soon as practicable but no later than 30 days after the entity becomes aware that unauthorized access or use of sensitive customer information has occurred or is reasonably likely to occur.

(3) Covered entities must include contractual notification obligations in service provider agreements, requiring service providers to notify the covered entity no later than 72 hours after becoming aware of an event triggering customer notification.

For dual-jurisdiction situations (an SEC-registered investment adviser that also performs activities under the FTC's jurisdiction), the institution must satisfy each regulator's requirements independently.

Existing frameworks meaningfully reduce the gap to GLBA compliance, but none fully satisfy it.

SOC 2 Type II programs typically cover approximately 60% of the FTC Safeguards Rule's prescriptive control requirements — particularly the technical safeguards (access controls, encryption, MFA, monitoring) and the service provider oversight pieces. What does not transfer directly: the Qualified Individual designation by name with personal accountability, the WISP as a specific named document (SOC 2 has policies but not the WISP per se), the annual board report from the Qualified Individual, and the 30-day FTC notification readiness.

NIST CSF programs at Tier 3 or higher cover approximately 75% of the rule's substance — particularly through the new Govern function which addresses organizational context, risk management strategy, and oversight cadence that map well to the Qualified Individual + annual board report structure.

ISO 27001 programs cover approximately 60% through Annex A controls, with the gap concentrated in the GLBA-specific notification mechanics and the Qualified Individual personal accountability structure.

The strongest existing-framework leverage is for organizations already running NYDFS Part 500 compliance: the FTC's 2023 revision was largely modeled on Part 500, and organizations with mature Part 500 programs typically reach GLBA compliance in 6–10 weeks rather than the 2–4 months a cold start requires.

The remaining work in each case is the GLBA-specific artifact structure (WISP document, Qualified Individual designation memo, annual board report template) plus the notification readiness exercises that the FTC's 2024 amendment made operationally important.