FTC Safeguards Rule Readiness

This page is a free self-assessment aligned to the FTC Safeguards Rule, 16 CFR Part 314. The sections are Information Security Program, Access, Encryption & Authentication, Change Management & Monitoring, People & Service Providers, Incident Response & Reporting. The questions cover a named Qualified Individual, a written information security program, access and MFA, encryption, service providers, monitoring, and incident response. It is educational. It is not an FTC examination, not a GLBA certification, and not legal advice.

The Rule applies to many non-bank financial institutions. On the work we actually see in Nebraska, that is independent insurance agencies, CPA and accounting firms, mortgage brokers, and auto dealers that keep customer information in an agency system, a mailbox, or a shared drive. A bank with an internal security department is outside this page. This is an educational self-assessment aligned to the FTC Safeguards Rule (16 CFR Part 314). It is not an FTC examination, GLBA certification, or legal advice.

Neighboring tracks, if this is the wrong frame: NIST CSF 2.0 for a general business baseline, HIPAA for a clinic, and CISA CPGs for a city or district. The full set is on the assessment hub. The longer explanation of how SAINT maps the Rule to operations is FTC Safeguards compliance.

Lincoln’s version of this buyer is a professional-services office — an agency, a CPA firm, a broker — close enough to Hickman that on-site work is a short drive. Omaha’s version is denser: insurance and finance gravity, broker and TPA offices, and payment teams that move ACH. Business email compromise against those teams is the failure mode we see, not a generic “someone clicked phishing.” West Omaha, Aksarben, Midtown, and downtown are neighborhoods we serve. They are not offices we lease.

There is no Omaha headquarters and no Lincoln storefront. Headquarters is Hickman. Lincoln is about 15–20 minutes north. Omaha-metro is about 55–70 minutes via I-80, scheduled. Papillion, Bellevue, La Vista, Gretna, and Elkhorn are service area on the Omaha hub. The Lincoln hub is the capital-city market page. Industry pages, if you want the vertical before the quiz: insurance, financial services, and CPA and accounting.

Carrier and cyber-insurance questionnaires often arrive in the same quarter as a Safeguards question. This assessment will not fill the carrier form for you. It will show whether the underlying controls — MFA, encryption, a Qualified Individual, an incident plan, vendor oversight — are real or informal. The separate worksheet for insurability language is the cyber insurability check. Email-specific work sits on email security.

Answer the questions below. They stay in this browser session until you download a report. No account. Most people finish in under 15 minutes; the set on this track is shorter than the NIST and CISA sets. “Not sure” is a gap. If you cannot name the Qualified Individual, that is the answer — do not guess a title to improve the score.

The results page scores the program and breaks it down by section, with the same tiers used on the other tracks: At Risk, Developing, Managed, Optimized. The PDF requires name, email, and company because that is how the confirmation is sent. An optional SAINT review is a 30-minute call, not a retained engagement. Book it or call 531-625-2111. If something is actively compromised, use the incident line instead of finishing the quiz.

We will not stamp the PDF as FTC compliant, and we will not tell a carrier you passed. If the gaps are access, monitoring, and a written program, the operating work is vCISO / risk advisory when you need a named security lead, and managed IT when you need the tenant actually run. Human-led assessments, if the quiz is the wrong shape, are listed under consulting assessments.