The FTC Safeguards Rule training requirement, explained

The FTC's updated Safeguards Rule, which took effect in 2023, strengthened the information security requirements for financial institutions under the Gramm-Leach-Bliley Act. One of the most significant changes was the explicit addition of a personnel training requirement. If you are subject to the Safeguards Rule, your employees must now receive security awareness training. Here is what that means in practice.

What changed in the updated rule

The original Safeguards Rule, adopted in 2003, required financial institutions to develop a written information security plan but did not explicitly mandate employee training. The 2021 amendments, effective June 9, 2023, added §314.4(c), which now requires institutions to "train all personnel to safeguard customer information." This change closed a gap that many organizations had used to avoid training budgets.

Who is covered by the rule

The Safeguards Rule applies broadly. A "financial institution" under the rule includes not just banks and credit unions, but also mortgage brokers, tax preparers, payday lenders, automobile dealers that arrange financing, investment advisors, and any business that is "significantly engaged" in providing financial products or services. If your business handles consumer financial information, you are likely covered.

What the training must cover

The rule does not prescribe a specific curriculum, but the FTC's guidance makes clear what it expects. Training should cover: the risks to customer information; the organization's information security policies and procedures; how to identify and report security incidents; the proper handling of sensitive data; and the employee's role in maintaining security. The training must be provided to "all personnel," not just IT staff or executives.

How often must training occur

The rule does not specify a frequency, but the FTC has stated that training should be provided "regularly" and that it should be updated when there are material changes to the information security program. Annual training is the most common interpretation, and it is what most compliance advisors recommend. You should also document when training was provided and who received it.

What documentation examiners expect

While the FTC does not conduct routine audits like HIPAA's OCR, it can and does investigate after data breaches or consumer complaints. During an investigation, the FTC will ask for: your written information security plan; training materials and dates; a list of trained personnel; and evidence that the training was actually delivered. Gaps in documentation are often what turn a minor incident into a major enforcement action.

How to satisfy the requirement

The simplest approach is to use a standardized, documented training program that covers the required topics, delivers training to every employee, and produces completion records. The program should be part of your overall information security plan and should be reviewed at least annually. With the right platform, this takes minutes to set up and produces exactly the documentation you need.