FTC Safeguards Rule Awareness Training
Learn to identify FTC Safeguards Rule requirements, protect customer financial information, apply security safeguards, understand incident response, and recognize employee, vendor, and oversight responsibilities under the GLBA.
Duration
Lectures
Content
About This Course
This online FTC Safeguards Rule Awareness Training course introduces the requirements for protecting customer information under the Gramm-Leach-Bliley Act (GLBA). It explains the FTC Safeguards Rule and the importance of information security safeguards in protecting sensitive customer data.
The course covers five areas: the FTC Safeguards Rule and customer information protection; employee awareness, human risk, and secure daily behavior; required safeguards, access control, and information security practices; incident response, breach notification, and operational readiness; and qualified individual oversight, vendor risk, and global compliance alignment.
By completing this course, learners will understand key Safeguards Rule concepts, recognize their security responsibilities, and identify the safeguards, incident response practices, and oversight activities covered in the curriculum.
What You'll Learn
- Understand the purpose of FTC Safeguards Rule Awareness Training and the requirements of the GLBA Safeguards Rule
- Identify nonpublic personal information (NPI) and customer data protection responsibilities
- Recognize phishing, social engineering, and other cybersecurity threats
- Apply secure access controls, authentication, encryption, and data handling practices
- Understand incident reporting, breach notification, and response procedures
- Support vendor security oversight and information security program requirements
- Strengthen workplace security awareness and regulatory compliance
Requirements
- No prior knowledge of the FTC Safeguards Rule or GLBA is required.
- No previous cybersecurity or information security experience is required.
- Internet access is required to access the online course.
This Course Includes
- 80 Minutes of self-paced FTC Safeguards Rule Awareness Training
- Downloadable compliance guides and information security resources
- Practical cybersecurity and customer data protection scenarios
- Knowledge checks to reinforce learning
- Mobile and desktop access
- Learn anytime with 1-year unlimited access
- Professional Certificate of Completion
Who Is This Course For?
- Financial Institution Employees: Learn customer information protection responsibilities.
- Information Security Professionals: Review safeguards, access controls, and incident response.
- Compliance Professionals: Understand FTC Safeguards Rule and GLBA requirements.
- Managers and Supervisors: Understand information security oversight responsibilities.
- Vendor Risk Personnel: Learn about third-party information security risks.
- Business Owners and Administrators: Understand security practices for protecting customer information.
Certification
Compliance and Regulatory Alignment
This course aligns with the FTC Safeguards Rule (16 CFR Part 314) under the Gramm-Leach-Bliley Act (GLBA). It introduces key requirements for written information security programs, employee security awareness training, qualified individual oversight, multi-factor authentication, encryption, vendor management, incident response, and breach notification. Learners also gain awareness of security frameworks such as NIST, ISO/IEC 27001, PCI DSS, HIPAA, GDPR, and PIPEDA that support broader information security and privacy programs. The FTC also requires notification of certain security events affecting 500 or more consumers within 30 days of discovery.
Why Compliance Training Matters
Cybersecurity incidents involving customer financial information can lead to regulatory enforcement, financial losses, reputational damage, and loss of customer trust. Effective security awareness training helps employees recognize cyber threats, protect sensitive information, report security events promptly, and follow secure workplace practices. Building a strong security culture supports compliance with the FTC Safeguards Rule while reducing organizational exposure to evolving cyber risks.
Career Benefits
- Understand FTC Requirements: Recognize key Safeguards Rule obligations.
- Strengthen Security Awareness: Understand employee responsibilities and secure work practices.
- Recognize Key Safeguards: Learn about access controls and information security practices.
- Understand Incident Response: Review breach notification and operational readiness.
- Learn Security Oversight: Understand qualified individual responsibilities.
- Recognize Vendor Risks: Understand third-party risk and global compliance alignment.
Course Curriculum
20 •80 Minutes
Module 1 The FTC Safeguards Rule and Customer Information Protection
-
1.1 The Legal Purpose of the FTC Safeguards Rule and GLBA
-
1.2 Covered Financial Institutions Beyond Traditional Banking
-
1.3 Customer Information, NPI, and Sensitive Financial Data
-
1.4 Core Safeguard Objectives for Security, Confidentiality, and Customer Protection
Module 2 Employee Awareness, Human Risk, and Secure Daily Behavior
-
2.1 Required Security Awareness Training for Personnel
-
2.2 Phishing, Pretexting, Vishing, BEC, and Social Engineering Defense
-
2.3 Secure Handling of Customer Information in Email, Paper, Cloud, and Devices
-
2.4 Reporting Suspicious Activity, Mistakes, and Potential Security Events
Module 3 Required Safeguards, Access Control, and Information Security Practices
-
3.1 Written Information Security Program and Risk-Based Safeguards
-
3.2 Least Privilege Access, Authentication, MFA, and Account Protection
-
3.3 Encryption, Secure Transmission, Data Inventory, Retention, and Disposal
-
3.4 Monitoring, Testing, Vulnerability Management, and Control Improvement
Module 4 Incident Response, Breach Notification, and Operational Readiness
-
4.1 Security Event Recognition and Internal Escalation Duties
-
4.2 Incident Response Planning, Documentation, Recovery, and Lessons Learned
-
4.3 FTC Notification Duties for Breaches Affecting 500 or More Consumers
-
4.4 Small Institution Exceptions and Training Duties That Still Apply
Module 5 Qualified Individual Oversight, Vendor Risk, and Global Compliance Alignment
-
5.1 Qualified Individual Duties, Security Personnel Training, and Program Oversight
-
5.2 Service Provider Selection, Contract Safeguards, and Vendor Monitoring
-
5.3 Board Reporting, Senior Leadership Accountability, and Compliance Evidence
-
5.4 Alignment with NIST, ISO 27001, GDPR, PCI DSS, HIPAA, PIPEDA, and Global Privacy Standards
Frequently Asked Questions
The Gramm-Leach-Bliley Act (GLBA) establishes requirements concerning financial institutions and consumer financial information. The FTC Safeguards Rule specifically addresses protecting customer information through an information security program. Understanding this distinction helps clarify the purpose of the safeguards covered in this course.
Read our FTC Safeguards Rule Requirements: Compliance Guide for more details.
A designated Qualified Individual oversees, implements, and enforces the information security program. The role includes oversight of security measures and program effectiveness, while the financial institution retains responsibility for compliance.
Learn more in our FTC Safeguards Rule Compliance Checklist for Financial Firms.
The rule requires security awareness training for personnel, updated as necessary to reflect risks identified through the institution's risk assessment. It also addresses the training and ongoing knowledge of information security personnel. Training should reflect relevant risks and the responsibilities of the people receiving it.
See our guide to FTC Safeguards Rule Training Requirements.
The rule requires multi-factor authentication for individuals accessing information systems unless the Qualified Individual approves in writing reasonably equivalent or more secure access controls. MFA is one of the security measures addressed by the rule to help protect information systems and customer data.
For broader context, read our FTC Safeguards Rule Requirements: Compliance Guide.
Financial institutions must take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for customer information. They must also address safeguards in service-provider contracts and periodically assess service providers based on risk and the continued adequacy of their safeguards.
Under the FTC Safeguards Rule, a covered financial institution must notify the FTC as soon as possible, and no later than 30 days after discovering a notification event involving unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. The rule contains specific conditions for determining whether an event qualifies for notification.
Organizations must test or monitor safeguards as required by the rule and evaluate whether their information security program remains appropriate as risks and circumstances change. Risk assessments, access-control reviews, security testing, and service-provider oversight help identify areas that may need attention.