If we spoke recently, this is what I would look into before spending a dollar on anything. None of these ask what you have installed. Every one asks what record exists, who owns it, and when someone last looked at it.
You do not need me to work through this list. Several organizations have run it internally and found they were in better shape than they thought. A few found the opposite. Both outcomes are useful, and both are cheaper to learn on a Tuesday than during an incident.
Read each question out loud to whoever would know. The useful signal is not whether the answer is yes. It is how long it takes and how many people it takes.
Which of our activities, if any, bring us inside the definition of a financial institution, and who wrote that determination down?
The Rule reaches organizations that are significantly engaged in financial activities. It does not reach industries. Arranging financing counts even if you hold no paper of your own, and leasing on a non-operating basis beyond 90 days is treated the same way. The record that matters is a dated written determination, not an assumption in someone's head.
Where does customer financial information exist across this organization, and who maintains the list?
Customer information is broader than the database. It lives in email, attachments, paper files, credit applications, DMS records, phones, cloud storage, and vendor systems. One record can exist in six places with different people able to reach it.
Who holds the document naming the senior person on our side responsible for directing and overseeing whoever runs our information security program?
A Qualified Individual can be an employee, an affiliate, or a service provider. If the role sits outside the organization, you must still designate a senior member of your own personnel to direct and oversee them, and the responsibility for compliance stays with you. This is the single question most organizations cannot answer with a document.
Is there a current written information security program, and when was it last reviewed by someone with authority?
The program has to be written, and it has to be appropriate to the size and complexity of the organization. A file that exists but has not been opened in three years is evidence of a different problem than having no file at all.
What written risk assessment are our current safeguards actually based on, and who signed off on it?
The assessment must be written, must identify reasonably foreseeable internal and external risks, and must state the criteria used to evaluate them. Safeguards are supposed to flow from it. Organizations under 5,000 consumers are exempt from the written form of this one.
Which safeguards can we demonstrate are operating right now, as opposed to installed?
Access controls, encryption in transit and at rest, multi-factor authentication, secure disposal, change management, and logging of authorized user activity. Then testing that they work. A dashboard shows what is true today. It cannot show what was true on the day something mattered.
If our technology provider stopped answering the phone tomorrow, who on our payroll holds the record of what they were required to protect?
You must select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them based on the risk they present. FTC staff guidance issued to dealers in June 2025 focused specifically on obligations around third-party vendors and OEMs. This one is never exempt at any size.
If an employee discovered this morning that customer records had been reached, who is named in writing as the person who decides whether the reporting clock has started?
Training records with completion dates, a written incident response plan, and evidence it has been exercised. Then the piece almost nobody has: §314.4(j) requires notifying the FTC within 30 days of discovering a notification event affecting at least 500 consumers, and discovery means the date any employee or agent knew, not the date leadership was told.
What has the Qualified Individual actually reported in writing to our board or senior officer, and when?
At least annually, in writing, covering overall program status, compliance, risk assessment results, service provider arrangements, testing results, security events and management's response, and recommendations for change. Verbal updates leave leadership with no record of what it was told or when.
For each of the nine, who owns the artifact, where does it live, and when was it last reviewed?
This is the one that turns the other nine into something usable. Ownership, location, and review date for every record. An organization that can answer this in an afternoon is in a fundamentally different position from one that needs three weeks and four people.
If leadership can quickly name the owner, the evidence location, the review date, and the decision record for all ten, you are in better shape than most organizations I meet, and you should keep doing exactly what you are doing.
If it cannot, that gap is worth understanding before a policy purchase, a platform subscription, or a consultant. Buying tools to solve a documentation problem is how organizations end up owning things they cannot explain and still cannot produce.
Twenty questions, about six minutes, mapped to 16 CFR Part 314. Nothing is sold to you on the results screen. The nine program elements in full →
Twenty questions, about six minutes. You will know more when you finish than when you started.
Check where you stand How engagements work