If your Orlando business handles customers’ financial information—even if you’re not a bank—you may be covered by the Federal Trade Commission (FTC) Safeguards Rule. In 2026, the biggest risk we see isn’t a lack of tools; it’s a lack of documented, repeatable security processes. Regulators and clients want proof that you can protect nonpublic personal information (NPI) with a real security program.
This guide breaks the rule into a practical, IT-friendly checklist you can use to reduce audit stress, lower breach risk, and show clients you take security seriously.
Who needs to pay attention in Orlando?
The Safeguards Rule applies to FTC-regulated “financial institutions” (in the Gramm-Leach-Bliley Act sense), which can include tax preparation firms, mortgage brokers, some lenders, and many advisory or “finance-adjacent” businesses. If you collect, store, transmit, or can access customer NPI, assume it’s in scope until counsel confirms otherwise.
Even if you’re not technically covered, the Safeguards Rule has become a de facto baseline for vendor due diligence. More Orlando businesses are asking their partners for written policies, risk assessments, MFA, encryption, and incident response documentation.
What the FTC expects: the program (not just the tools)
The FTC is explicit that covered organizations must develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information. That means your security can’t live only in someone’s head or in a collection of point products.
At a minimum, your program should answer:
- What data do we protect (and where is it)?
- What threats matter most to our business?
- Which safeguards reduce those risks, and how do we test them?
- How do we know we’re improving (and who is accountable)?
FTC Safeguards Rule checklist for 2026 (practical + auditable)
Use the checklist below to build a “binder-ready” compliance package. Each item is something we can help implement and document through managed IT and cybersecurity services.
1) Assign ownership (Qualified Individual)
- Name a Qualified Individual to run the security program and keep documentation current.
- Define decision rights (who can approve exceptions like “encryption not feasible”).
2) Build an accurate data & systems inventory
- List systems that store or process customer info (tax apps, document portals, CRM, email, file shares, endpoints, cloud storage).
- Map third parties and integrations (e-signature, payroll, practice management, MSP tools).
- Document where NPI flows (intake → processing → storage → retention → disposal).
3) Perform a written risk assessment (and keep it alive)
- Document foreseeable internal and external risks (phishing, ransomware, credential theft, misconfigurations, insider risk, vendor compromise).
- Score likelihood and impact in plain language leaders can understand.
- Review after major changes (new software, M&A, new office, new vendor, major incident).
4) Require multi-factor authentication (MFA) everywhere it matters
- Enforce MFA for email, remote access, admin portals, and any system with customer info.
- Turn on conditional access (geo/risk-based rules) to reduce credential abuse.
5) Encrypt customer information at rest and in transit
- Enable full-disk encryption on laptops and desktops (BitLocker).
- Use encrypted cloud storage and TLS for data transfers.
- Document exceptions and compensating controls if encryption is not feasible.
6) Lock down access (least privilege + review cycles)
- Use role-based access control (RBAC) and remove shared admin accounts.
- Run quarterly access reviews for key systems (email, file shares, tax software, portals).
- Automate onboarding/offboarding and disable stale accounts fast.
7) Centralize logging and monitor for suspicious activity
- Keep logs of authorized user activity where feasible.
- Monitor identity sign-ins, mailbox rules, impossible travel, and endpoint detections.
- Define alert thresholds and an escalation path.
8) Test your defenses (vuln scans + pen tests or continuous monitoring)
- Run vulnerability scans on a schedule and remediate high-risk findings.
- If you don’t have continuous monitoring, plan for annual penetration testing and six-month vulnerability scans.
- Track remediation with owners and due dates.
9) Strengthen endpoints and email (the most common entry points)
- Deploy endpoint detection and response (EDR) with tamper protection.
- Harden Microsoft 365: anti-phishing, safe links/attachments, and restrictive admin roles.
- Use a secure DNS/web filter to reduce drive-by malware risk.
10) Create (and rehearse) a written incident response plan
The rule calls for a written incident response plan. In practice, your plan should include:
- What counts as an “incident” and who declares it.
- Containment steps for ransomware, account takeover, and lost devices.
- Evidence preservation and forensics coordination.
- Client communications templates and regulatory notifications.
The 30-day breach reporting requirement: why response speed matters
The FTC added a breach reporting requirement: covered organizations must notify the FTC as soon as possible—and no later than 30 days after discovery—of a “notification event.” The FTC says those breach notification requirements took effect in May 2024, so they are fully in play in 2026. A notification event involves the unauthorized acquisition of at least 500 consumers’ unencrypted information (and “unencrypted” can include data where an attacker accessed the encryption key).
What this means operationally: your incident response plan must be built for speed. You need the ability to quickly answer three questions: What happened? What data was accessed? How many individuals are impacted? Without centralized logging and a practiced response playbook, 30 days disappears fast.
A quick “next 30 days” action plan for Orlando firms
- Confirm scope: Identify where customer NPI lives and which lines of business might be covered.
- Turn on MFA and device encryption everywhere immediately.
- Document your risk assessment and create a 90-day remediation plan.
- Implement monitoring for identity, email, and endpoints.
- Write and rehearse an incident response plan focused on 30-day reporting timelines.
How Perez Technology Group helps (managed IT + compliance-ready security)
At Perez Technology Group (PTG), we help Orlando businesses operationalize compliance: not just “buy security tools,” but implement policies, controls, monitoring, and documentation that stand up to audits and customer questionnaires. If you want a clear gap assessment and a prioritized plan, start with a conversation.
Contact PTG to schedule a compliance-focused security assessment. If you want ongoing visibility into your security posture and dark web exposure, explore our managed platform at CyberFence.