The FTC Safeguards Rule Doesn't Just Cover Banks. It Names One Person You Must Produce.
October 2, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
The FTC Safeguards Rule requires every covered non-bank financial institution to name one Qualified Individual responsible for its information security program, but the rule itself never defines what makes someone qualified. That gap doesn't go away in an exam or after a breach. It becomes the exact question an examiner, insurer, or opposing counsel asks first, and a recognized certification is the cleanest answer you can hand them.
Who Actually Has to Have One of These People?
If you run an auto dealership that arranges financing, a mortgage brokerage, a tax preparation firm, or a retailer that extends its own credit, you almost certainly qualify. The rule's definition of "financial institution" is far broader than most operators assume. The FTC's own compliance guide lists thirteen categories of covered entities, including mortgage lenders, check cashers, collection agencies, credit counselors, tax preparation firms, and investment advisers not registered with the SEC, and it applies regardless of how the business describes itself.
That breadth matters because most of these businesses never budgeted for a formal security program, let alone a named executive to run it. The 2021 amendments to the rule made the requirement concrete and gave covered institutions until June 2023 to designate someone, and there was no phase-in grace period once that date passed. If your organization has never formally documented who holds this role, that gap is the first thing a regulator or plaintiff's attorney will look for.
What Does "Qualified" Actually Require Under the Rule?
The rule's text at 16 CFR 314.4(a) says only that the institution must designate someone to implement, supervise, and enforce the program. It does not require a specific degree, title, or credential. As one compliance guide summarizing the FTC's own guidance puts it, the person "doesn't need a particular degree or title. What matters is real-world knowhow suited to your circumstances."
That flexibility was written for the tax preparer or independent dealership that can't hire a full-time CISO. It was not written to let a large institution point to an unqualified employee and call the box checked. The absence of a defined credential means your organization has to build its own evidentiary case for why the person you named actually has the judgment to run the program, and a recognized security management certification is the fastest, most portable way to build that case.
The Named Individual Is Where Accountability Lands First
Unlike a general security team or a vague "IT department," the Qualified Individual is a specific person the FTC can point to during an enforcement action, and the person your insurer will scrutinize during a claim. Federal enforcement isn't hypothetical here. In one FTC testimony to Congress describing a Safeguards Rule case, a settlement included injunctive relief and roughly $100,000 in civil penalties against a company that failed to develop and use reasonable safeguards for consumer information.
That is the downside case. The upside case, and the one procurement and HR teams should actually be planning around, is what the role requires day to day. The designated individual has to oversee a written risk assessment, direct implementation of controls like encryption and multifactor authentication, supervise testing, and write the report that goes to the board.
A written information security program under the rule generally has to cover a defined set of elements, and most compliance guides converge on the same list:
- A designated Qualified Individual with real authority and reporting access
- A documented, periodically updated risk assessment
- Technical safeguards including encryption, access controls, and multifactor authentication
- Regular testing, through annual penetration testing or continuous monitoring
- Staff training on the program's specific policies, not generic awareness content
- Oversight of service providers with access to customer information
- A written incident response plan
- An annual (at minimum) written report to the board or governing body
That last element is the one procurement teams underweight. The annual board report has to cover the overall state of compliance, risk assessment findings, and any material security events, and if your institution has no board, it goes to a senior officer instead. A person without governance training can write a status update. Writing a report that a board can rely on to satisfy its own oversight duty is a different skill, and it's the one a management-track certification is specifically built to test.
Why a Governance Certification Is the Evidence That Travels
This is where the procurement decision gets concrete. ISACA's Certified Information Security Manager credential is built around exactly the functions the Qualified Individual role demands: governance frameworks, enterprise risk management, program development, and incident response at the organizational level, and it currently sits behind more than 107,000 credential holders worldwide who have validated that skill set against a common standard. When an examiner or an underwriter asks how you know your designated person can actually run this program, "they hold the CISM" is a faster and more defensible answer than "they've been doing IT here for six years."
If you're weighing whether to build this internally or hand the role to an outside provider, the calculus changes with headcount. A larger institution with in-house IT staff usually gets more durable value from training an existing employee toward the CISM certification than from perpetually retaining an outside consultant, because the internal person also understands the business, the customer base, and the existing control environment. Smaller shops that genuinely can't support a dedicated role may still outsource the function, but even then, someone inside the company has to be capable of evaluating whether the outside provider is doing the job competently. That evaluation capability itself requires governance literacy.
If your organization is deciding between these paths, a good starting point is comparing what a governance-focused certification actually covers against your written information security program's gaps, and Forge University's resources page breaks down curriculum coverage against common compliance frameworks so you're not guessing. From there, the practical next step for whoever will hold this title is straightforward: they need structured preparation, not ad hoc reading. You can start training toward that credential whenever your team is ready to move.
What This Means for the Procurement Conversation
Treat the Qualified Individual designation as a hiring and credentialing decision, not a paperwork formality. When you're evaluating a candidate, a consultant, or an existing employee for this role, ask for the same kind of evidence an examiner would ask for: a named designation in writing, a credential that maps to governance and risk management rather than pure technical operations, and a documented history of board-level reporting. The rule gives you flexibility on who qualifies. It does not give you flexibility on whether you can prove it when someone asks.
For institutions that have already survived one exam cycle without a real answer to this question, the second cycle rarely goes as well. Building the paper trail now, starting with who holds the title and what training backs it up, costs far less than reconstructing it after an incident report is already due.