Cyber insurance for small businesses.

The FTC Safeguards Rule for non-bank financial businesses

If you lend, broker loans, collect debts, advise on money or prepare taxes, a federal rule may already set your security floor and breach clock. The FTC Safeguards Rule (16 CFR Part 314) applies to financial institutions under FTC jurisdiction, and the FTC says what you do matters more than what you call yourself.

• Who it names. Section 314.1(b) lists, among others, mortgage lenders and brokers, payday lenders, finance companies, check cashers, wire transferors, collection agencies, credit counselors, tax preparation firms, investment advisors not required to register with the SEC, and finders.
• The FTC notice. Since May 13, 2024, if a notification event involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery, on its online form (314.4(j)). A notification event is unauthorized acquisition of unencrypted customer information, and unauthorized access is presumed to be acquisition unless you have reliable evidence otherwise. Discovery is the first day any employee, officer or agent, other than the person committing the breach, knows of it.
• Controls in the rule. A Qualified Individual to run the program, multi-factor authentication for anyone accessing an information system, encryption of customer information in transit and at rest (each with limited alternatives your Qualified Individual must approve), and either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months.

Firms holding customer information on fewer than 5,000 consumers are exempt from four provisions (314.6): the written risk assessment, the monitoring and testing requirement, the written incident response plan and the annual report to the board. The FTC notice is not on that list. Answer cyber applications from your Safeguards program.

Taking cards: PCI DSS and card-brand penalties

The Payment Card Industry Data Security Standard is not a statute. It is a baseline of technical and operational requirements from the PCI Security Standards Council for entities that store, process or transmit cardholder data, and merchants agree to it to accept the major card brands. Version 4.0.1 replaced 4.0 when 4.0 was retired on December 31, 2024, and the requirements that had been future-dated took effect March 31, 2025.

• Who enforces it. Not the Council. Enforcement and any non-compliance penalties are carried out by the individual payment brands, and whether a small merchant must validate compliance is up to the brands. Your acquirer (merchant bank) or card brand tells you what to file.
• Self-assessment. Self-Assessment Questionnaires are validation tools, and every eligibility criterion for a particular SAQ must be met to use it.
• Encryption is not an exit. The Council says encryption does not remove the need for PCI DSS in a merchant environment, because cardholder data is still present.

IRMI describes a "PCI fines and assessments" insuring agreement found in some cyber and privacy forms, designed for PCI DSS non-compliance fines and the cost of contesting them. When you take cards, I read the quote for that insuring agreement and its limit, and I ask for your latest SAQ or validation status, since underwriters ask what payment data you store.

Official sources

• FTC: FTC Safeguards Rule: What Your Business Needs to Know
• 16 CFR Part 314, Standards for Safeguarding Customer Information (GPO, CFR 2025)
• 45 CFR Part 164 Subpart D, Notification in the Case of Breach of Unsecured PHI (GPO, CFR 2025)
• PCI Security Standards Council: PCI DSS
• PCI Security Standards Council: Merchant resources and FAQs
• PCI SSC At-a-Glance: PCI Security Standards Council
• PCI SSC blog: Just Published: PCI DSS v4.0.1
• IRMI: payment card industry fines and assessments insuring agreement
• OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021)
• CISA StopRansomware: Report Ransomware