FTC Safeguards Rule

Financial institutions: software inventory, third-party risk, license compliance, change management.


Short name	FTC
Region	Americas
Country or scope	United States
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers FTC

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for FTC.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for FTC and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`FTC-SG-314.4(c)` Encryption Component Identification	FTC Safeguards requires encryption of customer financial data: identify encryption components	Scan
`FTC-SG-314.4(f)` Third-Party Service Provider Documentation	FTC Safeguards requires oversight of service providers with access to customer information	Scan
`FTC-SG-314.4(b)` Access Control Components	FTC Safeguards requires access controls to customer information	Scan
`FTC-SG-314.4(h)` Component Integrity Hashes	Safeguards rule requires strong hash algorithms for data integrity verification	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`314.4(a)`	Designate a Qualified Individual
`314.4(b)`	Conduct a Risk Assessment
`314.4(c)`	Design and Implement Safeguards
`314.4(d)`	Oversee Third-Party Service Providers
`314.4(e)`	Evaluate and Adjust the Security Program
`314.4(f)`	Implement an Incident Response Plan
`314.4(g)`	Report Regularly to the Board
`314.4(h)`	Implement Specific Technical Safeguards
`314.5`	Maintain Written Information Security Program
`314.6`	Provide Notice of Security Breach
`314.4(c)(1)`	Implement Access Controls
`314.4(c)(6)`	Train and Test Security Personnel

Policy templates

Written for FTC:

FTC Safeguards Rule Information Security Program
FTC Safeguards Rule Technical Safeguards Policy
FTC Safeguards Rule Incident Response and Breach Notification Policy
FTC Safeguards Rule Service Provider Oversight Policy

And 22 from the standard set, adapted to FTC.