Non-bank lenders got bank-grade security rules and a named person to answer for them

The week

On October 27, 2021, the Federal Trade Commission announced amendments to its Standards for Safeguarding Customer Information, known as the Safeguards Rule. The rule is issued under the Gramm-Leach-Bliley Act of 1999, the federal law that requires financial institutions to explain how they share customer information and to protect it.

The original rule dated from 2002 and took effect in 2003. It asked covered firms to keep a written information security program with reasonable safeguards, scaled to their size and the sensitivity of their data. It said little about which safeguards. The FTC began a review in 2016, proposed amendments in March 2019, and held a public workshop on them in July 2020.

Consider what changes hands when someone buys a car on credit, applies for a mortgage through a broker or has their taxes prepared. They give up some of the most sensitive information they have: Social Security number, income, bank details, sometimes a copy of their driver’s license. The bank down the street holding similar data had been examined on how it protects that information for years. Many of the businesses the rule covers had not.

The rule covers financial institutions under FTC jurisdiction, such as mortgage brokers, non-bank lenders, auto dealers that arrange financing or leasing, payday lenders and tax preparers. Banks and credit unions answer to their own regulators instead. That puts a wide range of businesses, many of them small or family-owned, under the same rule. The amendments also widened the definition of financial institution to include “finders,” firms that bring together buyers and sellers of financial products.

Auto dealers were an especially large group. The Dodd-Frank Act of 2010 kept most dealers that arrange financing outside the new Consumer Financial Protection Bureau’s authority, which left the FTC as their main federal regulator for consumer financial matters. The FTC’s press release framed the amendments as a response to widespread data breaches, and its own enforcement work had shown how often non-bank firms lacked basic safeguards.

The amendments replaced general requirements with specific ones. Where the old rule broadly asked firms to have reasonable safeguards, the new one spelled them out. It named a single qualified individual to run the program and required written risk assessments, access controls, encryption, multifactor authentication, testing, logging, incident response plans and annual written reports to the board.

Firms already subject to New York’s Department of Financial Services cybersecurity regulation, in force since 2017, found much of the list familiar. That regulation also required a single responsible security leader, annual reporting to the board, risk assessments and multifactor authentication. For a national lender licensed in New York, the FTC changes mostly meant extending existing practice to every state. For a single-store dealer in another state, almost all of it was new.

A few of those terms deserve a quick translation. Encryption scrambles data so that it is unreadable without a key, protecting it if a laptop is stolen or a file is intercepted. Multifactor authentication means a login needs more than a password, usually a code from a phone or an app. An incident response plan is a written playbook for what to do when something goes wrong.

The Commission split 3-2 on the amendments. Commissioners Noah Joshua Phillips and Christine S. Wilson dissented, objecting to the more prescriptive approach and its costs, especially for smaller firms. The final rule softened that burden in one respect. Firms holding information on fewer than 5,000 consumers were exempted from some requirements, including the written risk assessment, the written incident response plan and the annual board report.

On the same day, the Commission voted unanimously to seek comment on a further change. It would require covered firms to report certain security events to the FTC itself. Until then, a non-bank lender that suffered a breach had duties to customers under state notification laws but no duty to tell the federal agency that wrote its security rule.

The amended rule was published in the Federal Register on December 9, 2021, and took effect on January 10, 2022. Most of the new requirements carried a compliance date of December 9, 2022. For thousands of businesses, the clock had started.

Banks and credit unions have worked under detailed information security guidelines for two decades, set by the federal banking agencies and the NCUA and tested in examinations. Many non-bank firms holding the same kinds of customer data worked under a far more general standard and were rarely examined at all. A customer’s Social Security number was arguably better protected at their bank than at the dealership that arranged their car loan.

The October 2021 amendments narrowed that gap. For covered firms, and for the banks and fintechs that partner with them, the rule made three distinct demands: specific technical controls, named accountability, and evidence that the program actually ran. Each lands on a different part of a small firm, and each has a different failure mode.

Those three demands are the core of what follows, in that order. Before them comes a short guide to the rule’s terms and to who is covered. After them come a hypothetical first year at a dealership group and the annual cycle the rule sets up. The piece closes with what the rule changes for owners and partners, and the signs and questions that tell a working program from a paper one.

The argument is that the bigger change was the second demand. Technical controls can be bought. Named accountability changed who in a small firm had to know about security, and what they had to put in writing.

What the rule asks for, term by term

The Safeguards Rule is, at heart, a requirement to run an information security program: an organized, ongoing effort to protect customer data, rather than a one-off purchase of software. The 2021 amendments made that program concrete. Several of the terms are worth explaining, because they turn up in vendor pitches and board reports alike.

Customer information. Non-public personal information about a customer that the firm handles or keeps, whether on paper or in electronic form. It covers the obvious records, such as loan applications and tax returns, and also the less obvious ones, such as a scanned pay stub in an email folder.

Risk assessment. A written analysis of what could go wrong with customer information, how likely and harmful each risk is, and how the firm will address it. The amended rule required it to set out criteria for evaluating risks, so that two people reading it would reach similar conclusions.

Encryption in transit and at rest. Encryption scrambles data so it can be read only with the right key. “In transit” means while data is moving, for example from a dealership’s computer to a lender’s website. “At rest” means while it sits stored, on a server, laptop or backup drive. A stolen, encrypted laptop is an inconvenience. A stolen, unencrypted one full of loan applications is a reportable breach.

Multifactor authentication. A login that needs two different kinds of proof, typically a password plus a code from a phone. It is the single most effective defense against stolen passwords, because a password alone is no longer enough.

Access controls. Rules that limit each person to the customer information their job requires. A salesperson may need a customer’s name and trade-in details. They rarely need the full credit application or a copy of the pay stub.

Penetration tests and vulnerability assessments. A vulnerability assessment is an automated scan for known weaknesses, such as missing software updates. A penetration test is a deeper exercise in which skilled testers try to break in.

Logging and monitoring. Keeping records of who signed in, when and what they accessed, and having someone or something review those records for unusual activity.

Change management. A simple, recorded process for approving changes to systems, so that a new firewall rule or a software update is checked before it goes live and can be traced afterward.

Qualified individual. The rule’s term for the one person responsible for overseeing the program. It does not require a particular job title or certification; it requires someone with the competence and authority to run it. The FTC chose the term over “chief information security officer” because most covered firms have nobody with that title.

Service provider. Any outside firm that receives, keeps or processes customer information for the covered firm. A managed service provider is the most common example: an outside IT firm that runs a business’s computers, email and networks for a monthly fee. Many small dealers and brokers rely on one for nearly all their technology.

Who answers to which rule

The Gramm-Leach-Bliley Act split its security mandate among several regulators, and the split decides which rule applies. Banks and their affiliates follow the Interagency Guidelines Establishing Information Security Standards, issued by the federal banking agencies in 2001. Federally insured credit unions follow the NCUA’s parallel guidelines. Broker-dealers, investment advisers and investment companies registered with the SEC follow Regulation S-P. Insurance companies answer to state insurance regulators.

The FTC rule covers the financial institutions left over. That includes mortgage brokers and non-bank lenders, most auto dealers that arrange financing or leasing, consumer finance companies, check cashers, tax preparers, and many fintech firms without a bank charter. Colleges and universities that take part in federal student aid programs are also covered, and the Department of Education enforces the requirement through its own agreements with schools.

State law adds another layer for everyone. Every state has a data breach notification law, and the rules on timing, content and whom to notify differ. A breach at a multi-state lender can trigger dozens of notices to consumers and state attorneys general, whatever federal rule applies.

Some firms sit under more than one regime. A non-bank mortgage lender may also be licensed by several states, each with its own rules, and New York licensees face the state’s Department of Financial Services cybersecurity regulation as well. The exemption for firms with fewer than 5,000 consumers is narrower than it looks, because a dealership that has kept every credit application for a decade can easily exceed it. Organizations should check with counsel on which regime applies to each entity, and on how the consumer count is measured.

Specific technical controls

The amended rule named controls that had previously been left to judgment. Customer information had to be encrypted in transit over external networks and at rest, with compensating controls approved by the qualified individual where encryption was not feasible. A compensating control is an alternative safeguard that achieves a similar level of protection when the preferred one cannot be used. Multifactor authentication was required for anyone accessing an information system, unless the qualified individual approved an equivalent alternative in writing.

Firms had to inventory their data and systems, apply secure development practices to software they built, manage changes, and log and monitor user activity. They also had to dispose of customer information within two years of last use, unless a business or legal reason required keeping it. Testing had to be continuous monitoring or, failing that, annual penetration tests and vulnerability assessments every six months. Staff had to be trained, and security staff kept current.

Where the controls live

For a large non-bank lender, most of this was already in place. For a dealership group or a twelve-person mortgage brokerage, several items were new, and the work did not sit with the firm. These businesses run on hosted loan origination systems, the software lenders and brokers use to take and process applications, along with dealer management platforms, tax software and office suites configured by a managed service provider. Encryption at rest and multifactor authentication on every system touching customer data meant vendor settings, license upgrades and contract changes.

That gave the small firm a weak bargaining position. A dealership cannot rewrite its dealer platform’s contract or demand a feature the vendor does not offer. What it can do is ask, in writing, how the vendor meets each control, and record the answer. Where the vendor cannot meet one, the qualified individual decides whether a compensating control is enough, and that decision goes in the record.

Multifactor authentication in a small firm

The multifactor requirement sounds like one switch. At a small firm it is a series of decisions. The first is scope: email, remote access, the dealer or loan platform, lender portals, tax software, the accounting system and the file share all touch customer information. Each has its own login and its own options, and some older systems offered no second factor at all.

The second decision is method. An authenticator app on a company phone is the usual answer. Staff without company phones may refuse to install work apps on personal devices, so some firms buy inexpensive hardware tokens instead. Shared computers in a showroom or front office need individual logins first, or the second factor protects nothing.

The third is the reset process. If anyone who calls the provider’s help desk can have their second factor removed, the control is only as strong as that phone call. A short written procedure that requires a manager to confirm the request closes most of that gap. Where a system cannot support a second factor, the qualified individual records the compensating control, such as limiting access to the office network, and a date to revisit it.

How the controls differ by type of firm

Each kind of covered firm meets the controls in a different place. At a dealership, the finance office is the center of gravity. Credit applications, identity documents and pay stubs pass through it daily, often by scanner, email and lender portal. Showroom tablets and shared desks make individual logins and multifactor prompts harder to enforce.

A mortgage broker’s exposure is concentrated in document collection. Borrowers send bank statements, tax returns and pay stubs, often as email attachments. Moving that intake to an encrypted upload portal does more for the broker’s risk than almost any other single change.

A tax preparer’s exposure is seasonal. Temporary staff join for a few months, often working from home on their own devices, and leave in April. Joiner and leaver processes, which the rule’s access requirements depend on, are tested every year. The IRS has long reminded professional preparers that the FTC rule applies to them and that they need a written security plan.

A fintech lender usually has the opposite profile. It is cloud-native, technically capable and already running most controls. Its gaps tend to be in documentation, board reporting and oversight of the many software services it plugs together.

The disposal requirement

The disposal requirement was often the hardest. Many firms had kept every loan file since they opened, in systems with no retention function at all, and deleting data safely took more effort than encrypting it. Old data is a hidden liability: it costs little to keep, until a breach turns every stored record into a notification letter.

Disposal also collides with other obligations. Lenders must keep certain records under fair lending and other consumer finance rules, and tax preparers have record retention duties of their own. The two-year rule allows for that, but only if the firm can say which records it keeps, under which obligation, and for how long. That turns disposal into a records schedule, a document most small firms did not have.

Named accountability

The rule required one qualified individual to oversee and enforce the program. That person could be an employee, an affiliate or a service provider. If the role was outsourced, the firm kept responsibility, had to designate a senior person to supervise the provider, and had to require the provider to maintain its own program.

The qualified individual had to report in writing, at least annually, to the board of directors or equivalent governing body. Where a firm had no board, the report went to a senior officer responsible for the program. The report had to cover the program’s overall status, compliance with the rule, and material matters such as risk assessment results, testing, incidents and recommended changes.

What the written report changes

This changed the conversation at the top of many firms. A written report creates a record of what owners knew about their risks and what they chose to fund. For a family-owned dealership group, the “board” may be two owners, and the report may be the first time security appears as a line item they must decide on rather than an IT cost.

The record cuts both ways. A report that flags a gap the owners then decline to fund is evidence of an informed decision, and also evidence that they knew. Qualified individuals felt pressure to soften findings, and owners sometimes preferred not to see them in writing. A program that only works when the report is candid needs owners willing to read bad news without punishing the messenger.

What the qualified individual needs

A title is easy to assign. The role works only with three things behind it. The first is time: a set number of hours each month, protected from other duties, for reviewing logs, vendors and test results. The second is authority to stop or delay a change that would weaken a safeguard, such as a new vendor that cannot encrypt data. The third is access to the owners, so the annual report is a conversation rather than a document left on a desk.

A qualified individual who is also the office manager, the bookkeeper and the person who orders toner will rarely have all three. Owners who want the role to work decide in advance what it displaces.

Outsourcing the role

Outsourcing the role to a managed service provider is legitimate, but it creates a conflict to manage. The provider reporting on the program’s gaps may also be the party responsible for closing them, and may sell the remedy. It is a little like asking the contractor who built your house to write the inspection report and quote for the repairs. That is not necessarily wrong, but it needs a second pair of eyes on the owner’s side.

The senior person who supervises the provider does not need to be technical. They need to read the report, ask why each recommendation matters, and occasionally get a second opinion. Some firms used an independent assessor every year or two for that purpose. Others asked the provider to separate its findings from its sales proposals, in different documents and different meetings.

A provider that serves many covered firms also concentrates risk. If one managed service provider holds administrative access to dozens of dealerships, a breach at the provider reaches all of them. The rule’s requirement that the provider maintain its own program is the owner’s lever. The contract should say what that program includes and how the firm will see evidence of it.

How accountability reaches banks

The same governance reached banks indirectly. Banks that use non-bank partners for indirect auto lending, mortgage origination or point-of-sale credit share customer data with firms now under the amended rule. A bank’s third-party risk program, its process for vetting and monitoring outside partners, can reasonably ask a partner who its qualified individual is and for a summary of the latest board report.

That gave bank vendor managers a common vocabulary. Before 2021, a bank asking a dealership about its security had no shared standard to point to. After, it could ask about the same named controls the dealer was already legally bound to run. Credit unions with large indirect auto portfolios had particular reason to ask, since dealers originate many of their loans. Organizations should check with counsel on which regime applies to each entity, since the line between FTC and banking agency jurisdiction depends on charter and activity.

Evidence that the program ran

The third demand was documentation. Risk assessments had to be written and had to set criteria for evaluating and categorizing risks and for deciding how each would be addressed. Incident response plans had to be written. Service providers had to be selected with care, bound by contract to safeguards, and periodically reassessed.

A program that existed in practice but not on paper would struggle to show compliance. A program that existed on paper but not on an ordinary working day would be exposed the first time a breach or inquiry tested it. Both failures are common, and they call for different fixes: the first needs writing down, the second needs doing.

The order of work

For a firm starting from a thin base, the order of work mattered more than the volume. Naming the qualified individual came first, because everything else needed an owner. The data inventory came next, since encryption, access control and disposal all depend on knowing where customer information lives, including spreadsheets, scanned documents and email attachments.

Multifactor authentication on email and remote access followed, because those are the most common entry points for small firms. Vendor contracts came after that, with each provider asked to confirm in writing how it met the specific controls. The written risk assessment and board report then described a program that existed rather than one that was planned.

What a file of evidence contains

An FTC inquiry, a bank partner’s due diligence and an insurer’s underwriting questions tend to ask for the same artifacts. The designation of the qualified individual, in writing. The current risk assessment, with its date and criteria. The latest board report and any minutes recording the owners’ decisions.

The technical evidence is just as concrete. Penetration test and scan reports, with dates and the remediation of what they found. Configuration records showing multifactor authentication and encryption, with any approved exceptions. Access reviews showing that departed staff lost access. Vendor confirmations and contracts. Training records. A log of disposal. The incident response plan and a note of when it was last rehearsed.

Keeping these in one place, updated as the year runs, costs little. Reconstructing them after an incident costs a great deal, and reconstructed evidence is less persuasive.

Incident response at small scale

The written incident response plan is the document small firms most often copy from a template and never read again. A useful one is short and specific. It names who is called first, at the firm and at the managed service provider, with phone numbers that work at night. It says who can authorize taking a system offline, which is a business decision as much as a technical one.

It also lists the outside parties to call. These typically include the firm’s lawyer, its cyber insurer, whose policy may require using approved forensic and legal firms, and the key vendors whose systems may be involved. It says how logs and affected devices are preserved, since wiping and rebuilding a laptop destroys the evidence needed to decide whether customer data was taken. And it names who decides whether customers, state authorities or lending partners must be notified, with counsel’s advice.

A one-hour tabletop discussion each year, walking through a phished email account or a stolen laptop, is enough to find the gaps. Most firms find at least one phone number that no longer works.

A realistic cadence

Small firms also needed a realistic cadence. An annual penetration test, two vulnerability scans and one board report a year is a manageable calendar if it is set in January. It becomes an emergency if it is remembered in November. Firms that put the dates in the same compliance calendar they use for licensing renewals and fair lending reviews kept up. Firms that treated the rule as a one-time project tended to drift.

The case against the prescriptive approach

The dissenting commissioners’ concern deserves a fair hearing. Specific mandates can turn security into a checklist. A firm may buy a penetration test because the rule requires one, file the report and fix nothing. Fixed requirements also age, while threats change. A principles-based rule, they argued in substance, let firms spend where their own risks were greatest.

The argument holds in part. The paperwork elements are where small firms are most likely to produce documents that describe nothing. Prescription cannot by itself make an owner care.

Two facts weigh the other way. The controls the rule named, chiefly multifactor authentication and encryption, were among the cheapest and most effective available. And the principles-based rule had produced, at many small firms, no program at all. The qualified individual’s authority to approve alternatives kept some flexibility inside the prescription. On balance, specific controls plus named accountability did more than general standards had done in the two decades before.

Three dealerships, one first year

Take a hypothetical family-owned group of three car dealerships. It arranges financing for most of its customers, so it collects credit applications, pay stubs and copies of driver’s licenses every day. Its technology is run by a managed service provider; its sales and finance staff use a hosted dealer management platform and a lender portal.

The owners begin by naming a qualified individual. They choose the provider’s security lead, and designate their own controller as the senior person who supervises that relationship. The controller’s job is not to be technical but to ask questions, read the reports and make sure the provider’s recommendations are weighed against cost and need.

The data inventory surprises everyone. Customer information lives in the dealer platform but also in a shared drive of scanned documents going back years, in finance managers’ email attachments and in spreadsheets used to track deals. Each of these needs encryption, access limits and a disposal rule. The scanned archive alone takes months to sort, because nobody can say which files are still needed.

Multifactor authentication on email and remote access is switched on within weeks; it mostly requires settings and some staff training. Sales staff on shared showroom computers push back, and the provider sets up individual logins for each of them. The vendor contracts take longer. The dealer platform confirms in writing that it encrypts data at rest. A smaller vendor that provides a credit application widget has to be chased several times.

The first penetration test finds an old remote access service still open on a server at one store, left over from a previous IT provider. It is closed within a day. The finding goes into the report, along with the question of how it was missed.

At the end of the first year, the qualified individual presents a written report to the two owners. It lists what has been done, the gaps that remain, the results of testing and a recommendation to replace an old server. For the first time, the owners make an explicit decision about security spending, and that decision is on the record.

The year also shows what the rule does not do. It does not tell the owners how much to spend, or which gaps to close first. Those remain business judgments. What changes is that the judgments are made deliberately, by named people, and written down.

How the program runs through a year

Once the initial work is done, the rule describes a cycle rather than a finish line, and in an ordinary small firm the risk of drift is highest after the first push of effort fades.

Early in the year: plan. The qualified individual updates the written risk assessment, looking at what has changed: new systems, new vendors, new ways of working, incidents from the past year. The assessment sets out which risks matter most and how each will be handled. The testing dates and the board report date go into the compliance calendar.

Through the year: operate. Day to day, the controls do their work. Staff sign in with multifactor authentication. Access is granted when people join and removed when they leave or change roles, which sounds obvious but is one of the most frequently missed steps in small businesses. Logs are collected and someone reviews them, or a tool flags unusual activity for review. Changes to systems go through a simple approval step so that nobody switches off a safeguard by accident.

Twice a year and annually: test. Where the firm does not run continuous monitoring, vulnerability scans happen every six months and a penetration test once a year. The results go to the qualified individual, who decides what to fix first. Vendors are periodically reassessed, which can be as simple as asking each one to reconfirm its controls in writing and checking for any reported breaches.

When something happens: respond. If an employee clicks a phishing link or a laptop goes missing, the written incident response plan says who is called, what is checked and who decides whether customers or authorities must be told. A plan that has been rehearsed, even as a one-hour discussion around a table, works far better than one opened for the first time in a crisis.

Year end: report. The qualified individual writes the annual report to the board or owners: overall status, compliance, risk assessment results, testing, incidents and recommendations. The owners decide what to fund, and the cycle begins again.

Each of these steps is simple on its own. The challenge for a small firm is that each one competes with selling cars, closing loans or filing returns. Writing the cycle into the calendar, and giving one person the job of keeping it moving, is what turns a set of policies into a working program.

The cycle also has natural checkpoints for outsiders. A lending partner can ask for the board report each year. An insurer can ask for the latest test results at renewal. A new owner buying the business can ask for the whole file during due diligence. Firms that keep the cycle running find these requests easy; firms that do not find each one a small crisis.

What the rule changes for owners and partners

Customers. The people whose data is held by dealers, brokers and tax preparers are the same people banks protect. A breach at a small firm harms them just as much.

Personal accountability. The written board report means owners can no longer say they did not know. That is uncomfortable, but it also means security decisions get made deliberately rather than by default.

Cost. Much of the work is configuration and contract changes, but license upgrades, testing and data cleanup cost real money. Firms that planned the work in order spent less than those that reacted to deadlines. The smallest firms felt the cost most, which is why the exemption and the later extension of the deadline mattered to them.

Vendors. The platforms that serve dealers, brokers and tax preparers had to support the controls their customers were now required to run. That shifted some of the burden from thousands of small firms to a smaller number of software companies, which is usually the more efficient place for it.

Insurers. Cyber insurers began asking small financial firms about multifactor authentication, backups and incident plans at renewal around this time. A firm that already ran the rule’s controls could answer those questions with evidence. A firm that could not sometimes faced higher premiums, narrower coverage or a declined application.

Partners. Banks and fintechs that rely on these firms for lending relationships now have a common yardstick to ask about. A credit union’s indirect lending manager, a bank’s mortgage warehouse team and a fintech’s partnerships lead can each ask the same questions and compare the answers.

Acquirers. Dealership groups and mortgage businesses change hands often. The rule gave buyers a defined set of records to request, and a defined set of gaps to price.

Signs of a program that runs

• A named qualified individual, and, if outsourced, a senior internal person who supervises them.
• A data inventory that covers spreadsheets, scans and email as well as the main systems.
• Multifactor authentication on email, remote access and every system that touches customer data.
• Written vendor confirmations of how each provider meets the specific controls.
• A records schedule that says what is kept, why and for how long, and a log of what was disposed of.
• Testing and board reporting dates set at the start of the year.
• A written report that records decisions and trade-offs as well as activities.

Signs of one that does not:

• Treating the rule as a document exercise, producing policies that describe controls nobody runs.
• Letting the managed service provider grade its own work without owner-side review.
• Inventorying only the main loan or dealer system and missing the shared drive.
• Keeping every customer file forever “just in case.”
• Shared logins on showroom or front-desk computers.
• Remembering the annual test in November.

What owners should ask

• Who is our qualified individual, and if they work for an outside provider, who on our side reviews their findings and recommendations?
• Where does customer information live in our business, including spreadsheets, scanned files and email?
• How much customer data are we keeping beyond two years since last use, and why?
• Has each of our vendors confirmed in writing how it meets the rule’s specific controls?
• When are this year’s penetration test, vulnerability scans and board report scheduled?

Good answers name a person, a place, a date or a document. An answer that names a product, or says the provider handles it, is a sign that the program belongs to someone other than the owners.

With hindsight

Implementation took longer than first planned. In November 2022, weeks before the original deadline, the FTC extended the compliance date for most new requirements to June 9, 2023. It cited shortages of qualified staff and supply chain delays for upgrades, problems it said the pandemic had made worse and that smaller firms would feel most. That was a frank acknowledgment that the businesses covered by the rule, and the vendors serving them, needed time to find people and equipment.

The commission then amended the rule again in October 2023. Covered firms must now notify the FTC within 30 days of discovering a security event in which unencrypted information on at least 500 consumers was acquired without authorization. The requirement took effect in May 2024. That closed a loop: the 2021 amendments said what firms had to do, and the notification requirement meant the regulator would hear when things went wrong. It also gave encryption a direct payoff, since encrypted data falls outside the trigger.

Other regulators moved in the same direction. In August 2022, the Consumer Financial Protection Bureau issued a circular on data security. It said that inadequate protection, such as failing to require multifactor authentication or to update software promptly, could be an unfair practice under federal consumer financial law. In November 2023, New York’s Department of Financial Services amended its cybersecurity regulation to tighten governance and expand multifactor requirements. In May 2024, the SEC adopted amendments to Regulation S-P requiring broker-dealers and investment advisers to keep incident response programs and notify affected customers. The direction across regimes was the same: named controls, named owners, and reporting.

The banking agencies also issued joint guidance on third-party risk management in June 2023. It replaced separate agency documents with one framework and expected banks to scale oversight to the risk each relationship carries. For banks that buy loans from dealers or brokers, the FTC rule gave that oversight something concrete to check.

The amendments did what they set out to do. They made the baseline for non-bank financial firms concrete and comparable to bank practice. Multifactor authentication and encryption at rest became standard features that vendors serving dealers, brokers and tax preparers had to offer. That vendor effect may be the most important result: once the platforms small firms depend on build in the controls, every customer of those platforms benefits, whether or not it has a large IT team.

The flip side of that vendor effect appeared in June 2024, when a cyberattack on CDK Global, a major provider of dealer management software, disrupted operations at thousands of dealerships across North America for days. Many dealers fell back to paper deal jackets. A dealer can run every control in the rule and still stop selling cars when a shared platform goes down. Concentration risk in vendors was outside the rule’s reach, and it became the next problem for owners to plan around.

In June 2025, the FTC published frequently asked questions on how the rule applies to motor vehicle dealers. That suggested the commission still saw dealers as a group needing specific attention, years after the amendments.

The board reporting requirement brought security into owners’ decisions at businesses that had rarely discussed it. A written report, read and acted on once a year, is a modest mechanism. But it gives security the same standing as other matters owners must sign off on.

The firms that struggled most treated the rule as a document exercise and learned, during an incident or inquiry, that the described controls were not running. The same holds for any organization, regulated by the FTC or not. A security program is judged by what it does on an ordinary Tuesday rather than by the policies in a binder. The person accountable for it should be able to show the difference.