FTC Safeguards Rule External Assessment

$2,900 per year · two assessments

External Vulnerability Assessment for FTC Safeguards Rule Programs

If your firm is covered by the FTC Safeguards Rule, the Rule calls for vulnerability assessments at least every six months unless you run continuous monitoring. We take care of the internet-facing part, twice a year, and give you the paperwork to show it was done.

Who this is for

Non-bank financial businesses that the FTC lists as covered “financial institutions”, including:

• Tax preparation firms
• Mortgage brokers and home loan originators
• Consumer finance companies and short-term lenders
• Debt collection agencies and credit counselors
• Financial advisors and investment advisors not required to register with the SEC
• Check-cashing and money-transfer businesses

The FTC exempts firms that maintain customer information on fewer than 5,000 consumers from this specific testing requirement (16 CFR 314.6). If that is you, our one-time External Website Security Review may be the better fit.

What the Rule asks for

Under 16 CFR 314.4(d)(2), covered firms must either run continuous monitoring or carry out annual penetration testing and vulnerability assessments at least every six months. The FTC describes the vulnerability assessments as scans designed to test for publicly known security vulnerabilities (FTC guidance).

This service covers the external, internet-facing part of those assessments, on the six-month rhythm the Rule describes.

What’s included

• Two full external assessments per year, six months apart, each at the depth of our External Website Security Review
• Website, forms, login pages, visible APIs, subdomains, TLS, security headers, cookies and third-party scripts
• Email domain protection (SPF, DKIM, DMARC) and a data breach check of the email address you provide at checkout
• A plain-English PDF report after each assessment, with a one-page “fix this week” list
• Safeguards Rule mapping appendix — what our assessment covers, what it partly covers, and what you need to handle another way
• Dated assessment letter after each assessment, stating what was tested, when and how, for your security records
• Verification of fixes from the first assessment during the second one
• Email reminders before each assessment and questions answered by email all year

What this covers, and what it does not

Most firms already have an IT provider for the internal side. Our reports are written so you can hand them straight to that provider.

How it works

1. Subscribe below and enter your website. We confirm the scope by email within one business day.
2. Month 0: first assessment. Report, mapping appendix and assessment letter within 7–10 business days.
3. Month 6: second assessment, including a check of what you fixed. New report and letter.
4. Each year: the plan renews and the cycle repeats. Cancel anytime before renewal by email.

Pricing

Covers one main website and its subdomains. More domains on request. Secure checkout via Stripe; you can cancel by email at any time. By subscribing you agree to our Terms & Conditions and Refund Policy.

See what you get

Download a sample report for a fictional tax preparation firm, including the Safeguards Rule mapping appendix and the assessment letter.

New to the Rule's testing requirement? Read our guide: FTC Safeguards Rule for tax preparers: the six-month vulnerability assessment explained, or our guide for mortgage brokers.

Common questions

This service covers external, internet-facing systems only. It does not include internal network testing or the annual penetration test of your full information systems, and it is not a certification of compliance or legal advice. References to 16 CFR Part 314 summarize the Rule as published in the eCFR; please rely on the official text and your own advisors.