Internet-facing systems
What a stranger can reach, which is where most incidents in this sector start.
- Exposed services and remote access
- Web applications and client portals
- Email security and spoofing
- Unpatched and end-of-life systems
If you are a non-bank financial institution under the FTC’s Safeguards Rule - and the definition is far wider than most businesses realise - 16 CFR 314.4(d) gives you a choice. Either you run effective continuous monitoring of your information systems, or you perform annual penetration testing and vulnerability assessments at least every six months. Most firms in this position are doing neither, usually because nobody told them the rule reached them.
"Financial institution" under the Safeguards Rule does not mean bank. It covers mortgage brokers and lenders, motor vehicle dealers arranging finance, tax preparers, investment advisers not registered with the SEC, collection agencies, title companies, payday lenders, finders and a range of other businesses that would never describe themselves that way. If you are not certain, that uncertainty is itself worth resolving with counsel.
The testing obligation sits at 314.4(d). Paragraph (d)(1) requires you to regularly test or monitor the effectiveness of your safeguards. Paragraph (d)(2) says that absent effective continuous monitoring, you must do both of the things beneath it: annual penetration testing of your information systems under (d)(2)(i), and vulnerability assessments at least every six months under (d)(2)(ii) - and also whenever there are material changes to your operations or circumstances you know may materially affect your programme.
Scoped from the risks in your written risk assessment, which is what the rule itself points the scope at.
What a stranger can reach, which is where most incidents in this sector start.
The commonest route into a small financial business.
Where customer information actually sits.
The thing the rule exists to protect.
Often the widest door and the least reviewed.
Written so your qualified individual can report from it.
Before anything else, whether the rule reaches you and whether you have continuous monitoring.
The rule points the scope there, so the two documents must agree.
Outside and inside, manually, against the systems in scope.
In language a non-technical qualified individual can report from.
Including the six-monthly assessment the rule also requires.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows 16 CFR Part 314 (Safeguards Rule), NIST SP 800-115, OWASP Web Security Testing Guide and PTES, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our compliance and audit service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
It requires one unless you have effective continuous monitoring. 16 CFR 314.4(d)(2) says that absent that monitoring you must conduct annual penetration testing under (d)(2)(i) and vulnerability assessments at least every six months under (d)(2)(ii). Most small firms do not have continuous monitoring in the sense the rule means, which leaves the testing obligation.
Possibly, even if you have never thought of yourself that way. The definition reaches mortgage brokers, motor vehicle dealers arranging finance, tax preparers, non-SEC-registered investment advisers, collection agencies and title companies among others. We are not lawyers and will not tell you that you are covered - but if you are not sure, it is worth an hour of counsel’s time to find out.
The rule does not define it with a product list, which is deliberate. In practice it means systems that would detect changes creating vulnerabilities, operating continuously, with somebody acting on what they produce. A tool nobody watches is not continuous monitoring, and treating it as one is a risky reading to defend.
All of it. Everything in this engagement is done from our side over an agreed window, and most firms in this sector have no internal network worth visiting in person.
The report, the scope, the dates, who did it, and evidence that the findings were addressed. The rule puts the reporting duty on your qualified individual, so the document is written for that person to report from rather than for an engineer alone.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.