FTC Safeguards Rule Training Requirements: What Covered Businesses Must Do (2026)

Updated November 10, 2026. Rule text quoted from the eCFR and the FTC's own guidance, linked in Sources.

The short answer: yes, the FTC Safeguards Rule requires security awareness training. Section 314.4(e) tells every covered business to give its personnel "security awareness training that is updated as necessary to reflect risks identified by the risk assessment." There is no small-business exception for training. Auto dealers that lease, tax preparers, mortgage brokers, payday lenders and other non-bank financial businesses all fall under it, and since May 13, 2024 they must also notify the FTC within 30 days of a breach involving 500 or more consumers.

This page explains who is covered, what the training requirement actually says, what changes under 5,000 consumers, and how to document a training program so it holds up. It is a plain-English summary, not legal advice.

Who does the FTC Safeguards Rule cover?

The rule applies to "financial institutions" under FTC jurisdiction: businesses significantly engaged in financial activities that are not banks. The rule's own scope list includes mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors, tax preparation firms, non-federally insured credit unions and finders. The FTC's guidance adds investment advisors not registered with the SEC.

Two examples catch many small businesses by surprise. An accountant or tax preparation service is listed as a financial institution in 314.2(h)(2). An auto dealership that leases vehicles on a nonoperating basis for longer than 90 days is a financial institution for that leasing business, and the FTC names motor vehicle dealers when it describes who the rule reaches. A plain retailer, merchant or grocery store is not covered just because it takes cards.

What does the rule say about security awareness training?

Section 314.4(e) requires covered businesses to implement policies and procedures so personnel can carry out the security program, including "providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment."

The FTC's guidance puts it more bluntly under its fifth element, "Train your staff": "Provide your people with security awareness training and schedule regular refreshers." It also asks for specialized training for employees, affiliates or service providers with hands-on responsibility for security.

Three things follow from that wording. Training has to reach your personnel, not just IT. It has to connect to your written risk assessment, so the scenarios should match the attacks your business actually faces, such as payment-change requests or fake invoices. And it has to be refreshed, so a one-time onboarding video does not meet the standard.

The nine required elements at a glance

The FTC's guidance groups the rule into nine elements. Training is one; the others shape what training should cover.

• Designate a Qualified Individual to run the program (314.4(a)).
• Conduct a written risk assessment (314.4(b)).
• Design and implement safeguards, including access controls, encryption, and multi-factor authentication "for any individual accessing any information system" (314.4(c)).
• Monitor and test safeguards: continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months (314.4(d)).
• Train your staff with security awareness training and regular refreshers (314.4(e)).
• Oversee service providers by contract and assess them periodically (314.4(f)).
• Keep the program current as your business and risks change (314.4(g)).
• Keep a written incident response plan (314.4(h)).
• Report in writing, at least annually, to your board or equivalent governing body (314.4(i)).

What changes under 5,000 consumers?

Section 314.6 exempts businesses that hold customer information on fewer than 5,000 consumers from four provisions: the written risk assessment (314.4(b)(1)), the testing schedule (314.4(d)(2)), the written incident response plan (314.4(h)) and the annual board report (314.4(i)).

Training is not on that list. Neither is multi-factor authentication, service provider oversight or the FTC breach notice. A five-person tax office still has to train its staff.

The 30-day FTC breach notice

Since May 13, 2024, section 314.4(j) requires a covered business to notify the FTC "as soon as possible, and no later than 30 days after discovery" of a notification event involving the information of at least 500 consumers. The FTC describes that event as unauthorized acquisition of consumers' unencrypted information, and the clock starts on the first day the event is known to you. Reports go through the FTC's online form and may be made public.

That is why training matters beyond compliance. Employees who recognize and report phishing emails and fake payment requests early give you a better chance of containing an event before it becomes one you have to report.

How to document a training program that holds up

1. Tie the topics to your risk assessment. If your assessment names business email compromise, invoice fraud or credential phishing, your training and phishing simulations should cover those scenarios by name.
2. Train at onboarding and refresh on a schedule. The FTC asks for regular refreshers; monthly short modules plus periodic phishing simulations are easier to defend than one annual session.
3. Add specialized training for anyone with hands-on security duties, including your Qualified Individual and any IT provider staff.
4. Keep records: who was trained, on what, and when, plus how employees responded to phishing simulations over time.
5. Put training results in the annual written report to your board or owner, even if 314.6 exempts you. It is the simplest proof the program exists.

Need the written policy itself? Policy 8 in our free security policy templates is a security awareness training policy you can adapt.

For MSPs serving dealerships, tax preparers and lenders

If you are an MSP, your clients in these industries are your Safeguards Rule opportunity, and section 314.4(f) makes you part of their compliance story: covered businesses must require service providers by contract to maintain safeguards and must assess them periodically. Expect questionnaires. Clients will also ask you to produce training records for their Qualified Individual and their annual report, so pick a platform that exports per-client reports without manual work.

Where Hook fits

Hook Security runs phishing simulations and short, behavior-focused training for employees, with reports that show who completed training and how reporting and click behavior change over time. Hundreds of MSPs use Hook to deliver programs to their clients, and more than 250,000 employees train with Hook every month. Hook does not replace your risk assessment, encryption, MFA or incident response plan; it covers the training element and gives you the records to prove it.

Bottom line

If your business is covered by the FTC Safeguards Rule, security awareness training is required, regardless of size. Build it from your risk assessment, refresh it regularly, keep records, and include the results in your annual report. Do that and the training element is the easiest part of the rule to show.

FAQ

Does the FTC Safeguards Rule require security awareness training?

Yes. 16 CFR 314.4(e) requires covered businesses to provide personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment. The FTC's guidance adds "schedule regular refreshers."

Are small businesses exempt from the training requirement?

No. Section 314.6 exempts businesses with fewer than 5,000 consumers from the written risk assessment, the testing schedule, the written incident response plan and the board report, but not from training, multi-factor authentication, service provider oversight or the FTC breach notice.

Are auto dealers and tax preparers covered?

Tax preparation services are listed as financial institutions in the rule. An auto dealer that leases vehicles on a nonoperating basis for more than 90 days is covered for that business, and the FTC names motor vehicle dealers among the businesses the rule reaches. If you are unsure, ask counsel.

Sources

• 16 CFR Part 314, Standards for Safeguarding Customer Information (eCFR, up to date as of Aug 13, 2026)
• FTC Safeguards Rule: What Your Business Needs to Know (FTC business guidance)
• FTC amends Safeguards Rule to require non-banking financial institutions to report data security breaches (FTC, Oct 27, 2023)

Keep reading

• Free security policy templates - eight ungated policies, including a training policy, mapped to FTC Safeguards and HIPAA.
• Best security awareness training platforms (2026, US) - eight platforms compared for US businesses.
• HIPAA security awareness training - what HIPAA requires and how to document it.
• Cyber-insurance evidence for small businesses - the training records insurers ask for.
• Best security awareness training for MSPs - the MSP vendor landscape.
• Phishing simulation for MSPs - how Hook's phishing simulator works for MSPs and their clients.
• CMMC training after the Phase 2 suspension - what Level 1 and Level 2 still require of defense contractors.
• PCI DSS training requirements by SAQ - which Requirement 12.6 items your SAQ asks for.