The FTC Named a "Qualified Individual." It Never Said What Qualified Means.
October 15, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
The FTC Safeguards Rule requires every covered financial institution to designate a Qualified Individual over its information security program, but the rule itself never defines what "qualified" means. That silence is the real exposure: examiners, auditors, and plaintiffs' attorneys fill the gap with their own judgment, and a title without documented expertise rarely holds up.
Who Actually Has to Name One
The requirement reaches far past banks. Under 16 CFR Part 314, any non-bank business significantly engaged in financial activities counts, and the rule's scope specifically includes auto dealers that arrange financing, mortgage brokers and lenders, payday lenders, finance companies, tax preparers, collection agencies, and investment advisers not registered with the SEC. Most of these organizations never thought of themselves as regulated security entities until this rule said otherwise.
That breadth matters because many of these businesses have no security staff at all, let alone a CISO. A used-car dealership arranging financing and a regional tax prep franchise are now held to the same structural requirement as a mid-size bank: name one person, in writing, who owns the information security program.
What "Qualified" Is Supposed to Mean
The rule sets a function, not a credential. The designation requirement took effect in June 2023, and the rule does not require a specific certification, degree, or job title for the Qualified Individual role. What it requires instead is a named person, inside the firm or outsourced, who actually has the knowledge and authority to run the program day to day.
That flexibility sounds generous until you have to defend it. 16 CFR 314.4(a) requires every covered institution to designate a Qualified Individual responsible for overseeing, implementing, and enforcing its information security program, and this designation requirement carries no exemption, not even for the smallest covered institutions. Every other Safeguards Rule provision has a carve-out for institutions with fewer than 5,000 customer records. This one doesn't. You cannot be too small to need a Qualified Individual, only too small for some of the paperwork around them.
How Examiners Decide Whether Your Qualified Individual Passes
This is where procurement and compliance actually meet. When an examiner or outside auditor reviews a Safeguards Rule program, they are not grading a job description. They are asking for files: a CV, a reporting-line document, and proof the person in the role can do what the title claims.
Typical evidence examiners look for includes a CV, professional certifications such as CISSP or CISM, and continuing education records, alongside documentation of reporting lines, budget authority, and escalation procedures. A resume with "security experience" written in prose is weaker evidence than a dated, verifiable credential tied to a recognized body of knowledge. Separate analysis of the rule reaches the same conclusion: while certification is not explicitly required, professional credentials like CISSP or CISM can demonstrate qualification when a regulator or plaintiff's attorney starts asking pointed questions about who was actually running the program.
That's the practical function a credential serves here. It's not career decoration, it's the artifact that turns "we had someone qualified" from an assertion into something you can hand over in a civil investigative demand. Building that kind of file is exactly what a management-track credential like the CISM certification is designed to produce, with its direct focus on governance, risk oversight, and program accountability rather than hands-on technical execution alone. If you want to see how a security management curriculum lines up against the Safeguards Rule's own language on risk assessment, testing, and incident response, Forge University's certification resources walk through that overlap in more detail.
What Happens When the Title Doesn't Hold Up
The FTC's own enforcement record shows what "reasonable safeguards" means once a breach happens. In its case against a data platform provider, the FTC alleged the company let employees use weak or duplicate passwords, skipped multi-factor authentication, and stored Social Security and bank account numbers unencrypted, failures that let an attacker sit undetected on the network for three months. The settlement made clear that "reasonable" now means demonstrable technical controls and timely detection, not a policy binder nobody read.
Enforcement has also moved well past traditional lenders. In December 2025, the FTC and the Colorado Attorney General reached a $24 million settlement with a major rental property manager over an alleged GLBA pretexting violation, confirming that any business collecting financial information as part of a transaction can be treated as a financial institution under the Act. Civil penalty exposure keeps climbing too: separate statutory authority under the FTC Act now allows penalties up to $53,088 per violation for actions assessed after January 2025, with each day of a continuing violation counted separately. None of that gets easier to defend against if the person who signed your written program can't produce proof of the expertise the signature implies.
Can an Outside vCISO Satisfy the Requirement
Yes, and for smaller institutions this is usually the realistic path. The Safeguards Rule explicitly allows the Qualified Individual to be employed by a service provider rather than sitting in-house, provided the institution keeps responsibility for compliance and names a senior employee to oversee that relationship. A fractional or virtual CISO arrangement is a legitimate way for a dealership, brokerage, or tax practice to meet this requirement without carrying a full-time executive salary.
But outsourcing the role does not outsource the diligence. If you're the senior employee responsible for overseeing a contracted Qualified Individual, you still need to be able to answer what makes that person qualified, in writing, the same way an examiner would ask it of an internal hire. The credential question doesn't disappear just because the person holding it works for a vendor.
The Staffing Decision This Actually Forces
Here is the operational choice most covered institutions haven't made explicitly: do you let "qualified" stay undefined until an examiner or opposing counsel defines it for you, or do you build the file now while it's cheap?
| Approach | What it produces when tested |
|---|---|
| Title only, no documented credential | A name on a policy, no independent evidence of competence |
| Title plus verifiable certification and continuing education | A dated, third-party-validated record an examiner can check in minutes |
| Outsourced QI with named internal overseer | Shared accountability, still requires the overseer to document why the vendor's person is qualified |
None of these options is free, but only one of them produces paper that survives scrutiny without a scramble. If your current Qualified Individual's file doesn't yet include a credential tied to information security governance, you can start training toward one now, while it's a planning decision rather than a response to a civil investigative demand.
The rule was written broadly on purpose, to cover institutions of wildly different sizes without dictating one hiring model. That breadth put the burden of proof back on you. A named person with a documented, verifiable credential is the version of "qualified" that actually survives the question when someone outside your company finally asks it.