FTC Safeguards Rule technology support
Protect your customers' financial information with safeguards that fit how your office already works: the loan files, the tax returns, the deal jackets, and the inbox where it all gets shared.
Based in Rome, Georgia, Brotherly Technology helps financial services businesses make practical, informed technology decisions about protecting consumer information.
Protecting customer information works best when it is part of the routine
The FTC Safeguards Rule applies to non-bank financial institutions under the Federal Trade Commission's jurisdiction, such as auto dealers, tax preparers, mortgage brokers, and lenders. These businesses often hold Social Security numbers, income records, and account details, and the rule requires them to maintain an information security program that protects that information. The technology part of the program comes down to who can get into which systems, whether the data is encrypted, and whether anyone notices when something goes wrong.
- Know where customer financial information lives: shared drives, email, line-of-business software, and the laptops that go home
- Make MFA, encryption, and secure communication part of normal work
- Keep systems monitored so problems surface as alerts, not surprises
Practical safeguards for customer information
We connect the right technology work to your FTC Safeguards Rule obligations. The tools come from the same layered approach as our cybersecurity services.
Lock down access
- Multi-factor authentication (MFA) on email, remote access, and the systems that hold customer data
- Access controls so staff reach only the records their job requires
- Accounts removed promptly when an employee or vendor no longer needs them
Encrypt and protect
- Server encryption, hard drive encryption, and encrypted email for sending sensitive documents
- Endpoint detection and response (EDR) and anti-ransomware protection on covered devices
- Firewall management with intrusion detection and prevention at the network edge
- Email security that helps block phishing, malicious links, and spoofing, available as its own itemized service, because the inbox is where many attacks start
Keep watch and recover
- 24/7 monitoring and real-time alerting on covered systems
- Dark web monitoring for stolen credentials and business data
- Microsoft and third-party patch management on a schedule
- Backup and disaster recovery, quoted as its own service, so a hardware failure or ransomware incident doesn't have to wipe out years of customer files
Assessments, policies, training, and documentation
The safeguards above are the technology side of the rule. We also help with the rest of the program: formal risk assessments, written security policies, staff security training, and audit-ready documentation. These are scoped and quoted separately from our monthly managed IT plans, so you take on only the compliance work your business needs.
Backup, Microsoft 365, email security, and other per-user licenses are itemized and are not folded into managed IT. Unlimited support means business-hours remote support. When you see 24/7, it refers to monitoring, and after-hours work is quoted separately. The details are on pricing.
A clearer path from uncertainty to a working plan
Review
We map where customer financial information moves through your systems and who can reach it.
Prioritize
Gaps become a short, ordered list of safeguards, starting with the ones that close the biggest exposure, such as missing MFA or unencrypted laptops.
Strengthen and monitor
We put the controls in place, keep them monitored and current, and revisit them as staff, software, or locations change.
Practical guidance from people who understand the technology
Our small, owner-led team learns your environment, explains the work in plain English, and stays available when a decision needs context. As a Sophos partner, we select the right security tools for your business and remain accountable for how they run.
- A named account manager who knows your environment
- Remote support when it is faster and onsite help when it matters
- Clear reporting on what is protected and what needs attention
A note on scope: technology support can help put safeguards into practice. It is not legal advice, it does not replace your legal or compliance counsel, and no IT provider can guarantee compliance.
Download “The Small Business IT Buyers Guide”
Our free guide helps you understand what to look for in IT support, the fees involved, and how choosing the right partner can protect your business from data breaches, compliance risks, and unnecessary downtime.
Who this is for
Auto dealers, tax preparers, mortgage brokers, lenders, and other financial services businesses that hold consumer financial information and want the technology side of their safeguards handled by a team they can reach.
If you also take card payments, the same safeguards support PCI DSS. If you handle health information, they support HIPAA. We can handle the technology side of all three together.
Frequently Asked Questions
Does the FTC Safeguards Rule apply to my business?
It applies to non-bank financial institutions under the FTC's jurisdiction, such as auto dealers, tax preparers, mortgage brokers, and lenders. If you are not sure whether your business is covered, ask your attorney or compliance advisor. Our support is not legal advice.
Can you make us compliant with the Safeguards Rule?
No IT provider can guarantee compliance. We put the technical safeguards in place, including MFA, encryption, access controls, endpoint protection, firewall management, and monitoring, so your security program has solid technology behind it.
Do you write our information security program or train our staff?
Yes, as separately scoped work. We offer formal risk assessments, written security policies, staff security training, and audit-ready documentation, quoted on their own rather than included in a monthly managed IT plan. See pricing for how separate work is handled.
What technical safeguards do you put in place?
MFA, access controls, server and drive encryption, encrypted email, EDR, firewall management, dark web monitoring, patching, and 24/7 monitoring. Email security and backup are available as their own services. See cybersecurity services for the full set of layers.
Is email security or backup included with managed IT?
No. Backup, Microsoft 365, email security, and per-user licenses are itemized, so your quote reflects what you actually use.
Can you help if a phishing email or stolen password gets through?
Yes. Monitoring and real-time alerting help surface problems early, and a response plan makes the next steps clear. MFA makes a stolen password far less useful on its own, and dark web monitoring can alert you when credentials show up in breach data.
Turn compliance questions into a practical next step
Tell us where your team needs more clarity. We will help you understand the technology work that can support your next decision.