The annual report should show how the program is working
The FTC Safeguards Rule requires covered financial institutions to maintain a written information-security program appropriate to their size, complexity, activities, and the sensitivity of customer information. The Rule uses “financial institution” more broadly than everyday conversation, so organizations should evaluate coverage based on their activities and the Rule’s definitions rather than their business name alone.
For a covered business, the designated Qualified Individual must report in writing regularly—and at least annually—to the board of directors or equivalent governing body. If there is no board or equivalent, the report goes to the senior officer responsible for the information-security program. FTC guidance says the report should address the program’s overall status and compliance and identify material matters such as risk assessments, risk-management decisions, service-provider arrangements, test results, security events and management’s response, and recommended changes.
This checklist can help a Central Florida automobile dealer, mortgage broker, tax preparation firm, non-federally insured credit union, or other potentially covered business organize evidence. It is not a substitute for the Rule, counsel, or a coverage analysis.
1. Confirm the reporting structure
Record:
- Legal entity and operations included in the report.
- Reporting period and date delivered.
- Named Qualified Individual and whether the person is an employee, affiliate, or service provider.
- Senior employee responsible for supervising an external Qualified Individual.
- Governing body or senior officer receiving the report.
- Affiliates, locations, systems, and business lines included or excluded.
Explain any material scope limitation. A report for one location or system should not imply enterprise-wide coverage. If the business relies on a service provider to run the program, FTC guidance makes clear that responsibility still remains with the covered company.
2. Summarize the customer-information environment
The FTC defines customer information as records containing nonpublic personal information about a customer, whether maintained in paper, electronic, or another form, and whether handled by the company or on its behalf.
Summarize material changes to:
- Types and volumes of customer information.
- Collection points, storage systems, data flows, and disposal processes.
- Workforce, contractor, affiliate, and vendor access.
- Cloud services, applications, locations, and network connections.
- Remote work, mobile devices, paper files, and removable media.
- New acquisitions, mergers, service offerings, or technology platforms.
Do not insert passwords, encryption keys, complete account numbers, or technical details that would create unnecessary exposure. The report should allow leadership to understand the environment and make decisions without becoming a new repository of secrets.
3. Describe the written risk assessment
FTC guidance says a covered company’s written risk assessment must identify reasonably foreseeable internal and external risks and include criteria for evaluating risks, assessing existing safeguards, and addressing identified risks. It must be reassessed periodically as operations and threats change.
Report:
- Assessment date, scope, method, and responsible parties.
- Material risks identified or changed during the period.
- Evaluation criteria and risk-rating approach.
- Important gaps, accepted risks, and overdue remediation.
- Safeguards selected, rejected, or deferred and the reasoning.
- Events that triggered reassessment, such as new systems, incidents, or business changes.
Separate confirmed evidence from estimates and assumptions. Leadership should be able to see which risks have been reduced, which remain, who owns them, and what decision is required.
4. Report on required safeguards
Organize the evidence around the safeguards relevant to the program, including:
- Access controls and periodic review of legitimate business need.
- Data, personnel, devices, systems, and facilities inventories.
- Encryption of customer information at rest and in transit, or documented alternative controls approved by the Qualified Individual where allowed.
- Security evaluation of internally developed and third-party applications.
- Multifactor authentication for people accessing information systems, or a written approval of an equivalent form of secure access control where allowed.
- Secure disposal practices and documented exceptions.
- Change-management procedures.
- Logging and monitoring of authorized and unauthorized activity.
For each control, state its scope, operating evidence, exceptions, owner, and next action. Avoid reporting only that a tool was purchased or enabled. A defensible report describes whether the safeguard covers the intended people and systems and whether testing found it operating as expected.
5. Summarize monitoring and testing
FTC guidance requires regular monitoring and testing. It explains that continuous monitoring may be used for information systems; otherwise, the Rule calls for annual penetration testing and vulnerability assessments, including system-wide scans at least every six months, along with testing after material changes or other circumstances that may materially affect the program.
Include:
- Testing type, scope, dates, provider, and limitations.
- Significant findings and severity criteria.
- Remediation status and validation results.
- Systems not tested and the reason.
- Material changes that triggered additional testing.
- Monitoring coverage, alert handling, and unresolved visibility gaps.
A clean executive summary is not proof that every system was assessed. Preserve the scope and detailed results in a restricted evidence repository and give leadership the information needed to allocate resources and accept or reject residual risk.
6. Account for training and personnel
Report general security-awareness training, specialized training for people implementing the program, participation, role-based topics, testing, and material gaps. Record how the business verifies that responsible employees, affiliates, and service-provider personnel maintain knowledge appropriate to their work.
Training statistics should not stand alone. Pair completion rates with evidence that employees know how to report suspicious activity, payment changes, lost devices, misdirected information, or unauthorized access through a channel that remains available during an outage.
7. Assess service providers
The FTC requires covered financial institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess providers based on their risk and the continued adequacy of their controls.
Summarize:
- Critical providers and the customer information or system access involved.
- Risk tier and business owner.
- Due-diligence evidence and contract safeguards.
- Monitoring and reassessment completed during the period.
- Material incidents, control changes, acquisitions, or subcontractor changes.
- Providers lacking adequate evidence or overdue for review.
- Required corrective actions, alternatives, and termination or transition plans.
The appropriate safeguards depend on the service and access. FTC automobile-dealer guidance explains that a network-connected marketing company and a paper-shredding company present different risks even when both may handle customer information.
8. Document security events and response
The annual report should summarize material security events, what management did, and what changed. Include confirmed facts, affected systems and information, business impact, containment, recovery, notifications evaluated, lessons learned, and corrective actions. Avoid speculation and unnecessary personal information.
The Safeguards Rule also contains a separate FTC notification requirement for certain events. FTC guidance describes a notification event as unauthorized acquisition of at least 500 consumers’ unencrypted information, with encrypted information treated as unencrypted when the encryption key was accessed by an unauthorized person. Covered institutions must notify the FTC as soon as possible and no later than 30 days after discovery. Unauthorized access is treated as unauthorized acquisition unless reliable evidence shows acquisition did not and could not reasonably have occurred.
Those are consequential legal determinations. The incident plan should identify who gathers facts and who evaluates FTC, Florida, industry, contractual, insurance, and other obligations. Compliance with one rule does not replace obligations under other laws.
9. Present decisions leadership must make
Conclude with a short decision register:
- Decision required.
- Risk or obligation addressed.
- Options considered.
- Qualified Individual’s recommendation.
- Cost, owner, and target date.
- Interim safeguards.
- Residual risk if delayed or declined.
- Approval and follow-up date.
Examples may include expanding multifactor authentication, replacing an unsupported system, funding log retention, changing a service provider, validating backups, improving data disposal, or testing the incident plan.
10. Preserve the evidence trail
Keep the signed or approved report, delivery evidence, minutes or decisions, referenced assessments, test summaries, service-provider reviews, incident records, and remediation tracking according to the organization’s legal and records requirements. Control access and protect the material because it may describe weaknesses and sensitive systems.
The report should not be a ceremonial document assembled once a year. It should connect risk evidence to leadership decisions, resources, and follow-through. Update the program between annual reports when threats, systems, personnel, providers, incidents, or operations materially change.
Human-reviewed draft. This article offers general information and is not legal, regulatory, breach-notification, or compliance advice. Organizations should review the current Rule and obtain advice appropriate to their activities and facts.