FTC Safeguards Rule Vulnerability Assessments

Vulnerability scanning for the FTC Safeguards Rule

The FTC Safeguards Rule gives non-bank financial institutions a choice: continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months. Most auto dealers, tax preparers, mortgage brokers and lenders take the second route, and the vulnerability assessment is the half people forget. This page explains what the rule asks for and how to have it running before your next review.

What the Safeguards Rule actually says

16 CFR 314.4(d)(2) requires regularly testing or otherwise monitoring the effectiveness of your safeguards. If you do not have continuous monitoring, you must perform annual penetration testing and vulnerability assessments, including systemic scans or reviews of information systems reasonably designed to identify publicly known security vulnerabilities, at least every six months and whenever there are material changes to your operations or business arrangements. The qualified individual responsible for the program reports on the results to the board or senior management.

What your auditor needs to see

Two dated vulnerability assessment reports per year, at minimum.
Coverage of every system that holds customer financial information, including internet-facing systems.
A scan after any material change, such as a new dealer management system or a new location.
Findings tracked to a fix.
The annual report to the board referencing the results.

Getting it done this week

Clone Systems external vulnerability scanning covers your internet-facing systems and is ready the moment you check out. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. Add internal vulnerability scanning for the office network and servers that hold customer information. Internal scanning is $1,095 a year for 128 IPs, $1,495 for 512, $2,295 for 2,048. Every package includes free rescans, and reports export mapped to the FTC Safeguards Rule from the portal.

Why Clone Systems

PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.

Buy vulnerability scanning · Talk to our scanning team

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.