Before the table
No row below puts your firm in compliance. Duties under the Safeguards Rule attach to financial institutions and never to products. What a supplier can do is operate a technical measure and pass you the record it throws off. Deciding whether that measure suits a firm of your size and complexity, the business you actually transact, and how sensitive the customer information you hold really is, remains a judgement your Qualified Individual reaches, writes down, and revisits.
The rule speaks the language of a programme rather than a checklist. More than one element below is discharged by a decision your firm takes and minutes, not by anything that gets installed. Where that is so, the table admits it instead of casting about for a product to credit.
Smaller firms should read the exemption row at the bottom before reading the rest. A financial institution that maintains customer information concerning fewer than 5,000 consumers is relieved of several of the requirements listed here, including the written risk assessment, the continuous monitoring or penetration testing choice, the written incident response plan, and the annual report. The controls themselves remain worth owning; the paperwork obligation is what changes.
This correspondence has been drawn cautiously. Where a line reaches only part of an element, the wording names the part. Where the duty is contractual, or belongs purely to how the firm governs itself, nothing is claimed at all.
| Citation | Element | Status | What we contribute | Service family |
|---|---|---|---|---|
| 16 CFR 314.3(a) | A written information security program | Required | Nothing on this site writes it. The program is your firm's own document, and every service below is something it can cite. | Not supplied by this catalog |
| 16 CFR 314.4(a) | Designation of a Qualified Individual | Required | The designation stays with your firm. We report to that person, escalate to them, and address our evidence to them. | Not supplied by this catalog |
| 16 CFR 314.4(b)(1) | Written risk assessment | Required, see 314.6 | Endpoint discovery of where customer information has actually accumulated, plus vulnerability scanning with trend reporting, as findings the assessment reasons about | Customer Data Protection Device Management |
| 16 CFR 314.4(c)(1) | Access controls, reviewed periodically | Required | Default deny control approaching the question from the execution end, with lock and timeout profiles pushed onto managed hardware instead of merely asked for | Execution Control Device Management |
| 16 CFR 314.4(c)(2) | Inventory of data, personnel, devices, systems, facilities | Required | A register of hardware kept current over Windows, macOS, Linux, Apple kit and handsets, alongside a list of permitted software that allowlisting produces by itself | Device Management Execution Control Customer Data Protection |
| 16 CFR 314.4(c)(3) | Encryption of customer information at rest and in transit | Required | AES at 256 bits over everything we hold, transport encryption across every connector, and file-level encryption that follows material left on a machine | Recovery & Continuity Customer Data Protection |
| 16 CFR 314.4(c)(4) | Secure development practices for in-house applications | Required where applicable | Not supplied. This catalog operates purchased platforms and does not develop your applications. | Not supplied by this catalog |
| 16 CFR 314.4(c)(5) | Multi-factor authentication for access to information systems | Required | Not supplied. Configured inside your identity platform and your line of business systems, and one of the few places where a gap is both common and cheap to close. | Not supplied by this catalog |
| 16 CFR 314.4(c)(6) | Secure disposal within two years of last use, and retention review | Required | Discovery locates the copies a disposal procedure has to act on; each recovery line publishes its retention window and its deprovisioning behaviour on cancellation | Customer Data Protection Recovery & Continuity |
| 16 CFR 314.4(c)(7) | Change management procedures | Required | Patch and configuration state per device, enforced Apple baselines, and directory configuration changes recorded as they happen with last known good values | Device Management Recovery & Continuity |
| 16 CFR 314.4(c)(8) | Monitoring and logging of user activity, detection of unauthorised access | Required | Correlated detection reviewed by named analysts with the review itself timestamped, and per-device records of web activity including private sessions | Threat Monitoring Device Management |
| 16 CFR 314.4(d)(1) | Regular testing or monitoring of safeguard effectiveness | Required | Unattended restore tests returning written proof, results from simulated phishing, and the direction of travel on vulnerability scans | Recovery & Continuity Email Defense Customer Data Protection |
| 16 CFR 314.4(d)(2) | Continuous monitoring, or annual penetration testing with six-monthly vulnerability assessments | Required, see 314.6 | The detection lines supply the continuous monitoring option. Penetration testing is a separate engagement and is not included in this catalog. | Threat Monitoring |
| 16 CFR 314.4(e) | Personnel able to enact the program, including awareness training | Required | Recurring lessons and unlimited phishing simulation producing dated per-person records, with the operations desk as the security personnel operating these particular controls | Email Defense Threat Monitoring |
| 16 CFR 314.4(f) | Service provider selection, contractual terms, and periodic assessment | Required | Fortify 24x7 becomes one of the providers you are required to oversee. Contractual, plus the operating evidence your periodic assessment asks for. | Contractual, not technical |
| 16 CFR 314.4(g) | Evaluate and adjust the program | Required | Trend reporting, patch history, detection volume, training results, and restore test outcomes as the inputs an evaluation reads | Device Management Customer Data Protection Recovery & Continuity |
| 16 CFR 314.4(h) | Written incident response plan | Required, see 314.6 | Containment carried out by analysts on the remediation lines, leaving a case record with author and clock time on it, plus separate custody standing in for the recovery half | Threat Monitoring Recovery & Continuity |
| 16 CFR 314.4(i) | Written report to the board or governing body, at least annually | Required, see 314.6 | The dated artifacts the report is assembled from. The report itself is written and signed by your Qualified Individual. | Not supplied by this catalog |
| 16 CFR 314.4(j) | Notification to the Federal Trade Commission of a notification event | Required | The factual record of what happened, when, and what was done about it. The determination and the filing belong to your firm and your counsel. | Threat Monitoring |
| 16 CFR 314.6 | Exemption for firms holding information on fewer than 5,000 consumers | Exemption | Not a service. Listed because it changes which rows above are mandatory for a smaller firm, and because the underlying controls remain worth having either way. | Not supplied by this catalog |
Where the twenty-four lines sit.
- Six of the twenty-four sit under Threat Monitoring, resting on SentinelOne with Fluency doing the correlation.
- One of the twenty-four sit under Execution Control, resting on the default deny engine inside ThreatLocker.
- Two of the twenty-four sit under Email Defense, resting on Ironscales.
- Four of the twenty-four sit under Device Management, resting on N-sight from N-able, plus Addigy and Zimperium.
- Two of the twenty-four sit under Customer Data Protection, resting on Actifile.
- Nine of the twenty-four sit under Recovery & Continuity, resting on Cove from N-able, plus Dropsuite.
Each line is purchased on its own. Nothing is packaged together, no floor is set on seats, and no year is committed to, which means a program may open with whichever two or three controls your most recent assessment complained about and widen later as the firm and its register move.
Which regulator actually reaches your firm.
This map is written against the Federal Trade Commission's Safeguards Rule because that is the regime reaching most of the firms who read this page: mortgage brokers and lenders, money transmitters, cheque cashers, payday lenders, collection agencies, tax preparers, accountants and bookkeepers acting as financial institutions, motor vehicle dealers arranging finance, and investment advisers not registered with the Securities and Exchange Commission.
It is not the only regime, and the boundaries matter. An investment adviser or a broker dealer registered with the Securities and Exchange Commission answers to Regulation S-P instead, which since its 2024 amendments carries its own written incident response programme and customer notification requirements. An insurance producer is generally supervised by a state insurance department, many of which have adopted a data security law modelled on the National Association of Insurance Commissioners standard. A bank, a credit union, or a savings association answers to its own federal banking regulator's information security guidelines. Firms holding personal information about Massachusetts residents have a separate written program obligation under state regulation, whoever else supervises them.
The technical measures serve every one of those programmes, because they are all describing the same controls in different words. The citations are not interchangeable. Which regime binds your firm, and what your written program must therefore contain, is a question for your counsel and not for a storefront.
Obligations that stay with your firm, whatever you buy here.
A map worth trusting marks its own boundary. Everything below belongs to your firm, and no subscription sold on this site discharges any of it.
Governance. Designating the Qualified Individual, writing and maintaining the program, performing the risk assessment, evaluating and adjusting the program as circumstances change, and reporting in writing to the board or governing body. We produce input. We do not perform any of it.
Authentication. Multi-factor authentication is a named requirement and it is configured in your identity platform, your custody platform, your practice management system, and your mail tenant. Nothing in this catalog substitutes for it, and a firm that buys every line here and skips this one has not closed the most exploited gap in the industry.
Process controls around money movement. Callback verification on changed payment instructions, dual authorisation on transfers above a threshold, and separation of the person who sets up a payee from the person who releases the payment are business procedures. They prevent more loss in this sector than any product on this page, and they cost nothing but discipline.
Physical safeguards and personnel practice. Facility access, clean desk and workstation policy, media disposal, background checks, and the terms on which access ends when somebody leaves.
Retention determinations. Discovery output can tell you what exists and where. What your firm is required to keep, and for how long, comes from statute, professional obligation, and contract, and is legal work.
The words we are careful about
An FTC certification does not exist for any product, and no supplier is able to put a firm into compliance with the Safeguards Rule. That rule reaches financial institutions, and its duties settle on the Qualified Individual your own firm appoints. We sell technical services, plus the operating evidence those services leave behind, set out against the elements of 16 CFR Part 314 so that whoever signs the written program has something dated and specific to point to.
None of it promises a compliance verdict, a clean examination, or freedom from a security event, and none of it is legal advice. Which supervisor reaches your firm, what the written program has to contain as a result, and whether an event carries any duty to notify are all matters for your Qualified Individual and your lawyers.
Heads up: card statements show FORTIFY 24X7 - MoneyGuard Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.