FTC Safeguards Rule 2026: What Northern Indiana SMBs Need to Do Now

Quietly, in June 2025, the Federal Trade Commission flipped the switch on the new Safeguards Rule notification requirement. Buried in the Gramm-Leach-Bliley Act, this rule used to be a “big bank” issue. Now it covers almost any business that hands out financing, stores customer credit applications, or brokers services that require Social Security numbers—including plenty of organizations right here in South Bend, Mishawaka, Plymouth, Fort Wayne, and the surrounding counties. If your company has ten or more workstations and you help customers pay over time, you’re on the hook to prove you can protect their data and report qualifying incidents to the FTC within 30 days.

Why this suddenly matters in 2026

The FTC’s own blog (“Safeguards Rule notification requirement now in effect,” June 9 2025) spells out the change: covered businesses must perform written risk assessments, implement encryption and multifactor authentication, monitor vendors, and—crucially—notify the FTC when breaches affect 500+ customers. The Commission has already increased enforcement, and legal/insurance teams expect 2026 to be the year the FTC sends warning letters to smaller firms that thought the rule didn’t apply to them.

Meanwhile, accountants and payroll platforms (OnPay’s “Safeguards Rule Checklist 2026”) are telling their clients to ask for proof that IT controls exist. If you can’t show that you’ve documented a program, you risk contract loss, higher cyber insurance premiums, and fines up to $46,517 per violation.

Who in Northern Indiana is now in scope?

We see five common scenarios among LecsIT clients:

• Auto dealers and powersports shops (Elkhart, South Bend, Auburn) that run credit checks or outsource financing paperwork.
• Accounting, tax, and payroll firms (Mishawaka, Goshen, Fort Wayne) holding sensitive PII all year.
• Healthcare and behavioral health practices that store guarantor data alongside medical records.
• Construction and specialty contractors that offer “same-as-cash” financing for remodels or environmental projects.
• Managed properties and HOAs collecting tenant payments and screening applications.

If any of those describe your operation—and you have ten or more systems—you’re expected to meet the Safeguards Rule today, regardless of whether you’re regulated by the FDIC or SEC.

What the FTC expects in 2026

1. Documented risk assessment. Identify what customer information you hold, where it lives, and the threats (internal and external) that could expose it.
2. Written information security program. Assign a qualified individual (internal or vCISO) to oversee safeguards and report to leadership.
3. Access controls and MFA. Unique logins for staff, least-privilege policies, and multifactor authentication on all remote or administrative systems.
4. Encryption and secure communications. Encrypt customer data in transit and at rest, including backups and mobile media.
5. Continuous monitoring and logging. Deploy monitoring tools (EDR, SIEM, email security) and review alerts regularly.
6. Vendor management. Vet service providers, require written assurances, and monitor their security posture.
7. Incident response and FTC reporting. Define how you detect, contain, and notify. If 500+ customers are affected, you have 30 days to alert the FTC through its reporting portal.

Common gaps we see in Michiana SMBs

• No formal documentation. Many companies have good security tools but nothing written down—an automatic fail in an FTC inquiry.
• Shared accounts and stale access. Vendors or former employees still have live logins into line-of-business apps.
• Backups without encryption. USB or NAS backups carrying unencrypted customer files, often taken off-site.
• Vendor sprawl. Multiple third parties touching customer data with no centralized list or contract language.
• No test-driven incident response. Plans exist “in someone’s head,” and no one knows who files the FTC notification if an event hits.

A practical action plan

If you’re a Northern Indiana SMB trying to stay ahead of this rule, focus on these steps:

• Baseline assessment: Conduct a GLBA/Safeguards risk assessment tailored to your operations. Inventory systems, map data flow, and score controls.
• Write (or refresh) your ISP: Capture policies for access, encryption, vendor vetting, logging, and incident response. Name an accountable owner inside your org or contract a vCISO.
• Implement key technical controls: MFA everywhere, disk and backup encryption, endpoint detection and response, email security with impersonation protection, and automated log retention.
• Clean up vendor access: Enforce least privilege, terminate stale accounts, and add security addenda to contracts.
• Drill your response: Run tabletop exercises so leadership knows how to classify incidents and file FTC notifications inside the 30-day window.
• Train and test: Give staff annual Safeguards/GLBA awareness training and run phishing simulations to keep them alert.

How LecsIT helps

LecsIT already supports Safeguards programs for auto groups, medical practices, and construction firms across South Bend, Plymouth, Mishawaka, Elkhart, and Fort Wayne. Our engagement typically includes:

• GLBA/Safeguards risk assessment mapped to NIST CSF and CIS Controls.
• Written information security program (ISP) with leadership reporting templates.
• Implementation of MFA, encryption, log monitoring, and 24/7 SOC-backed alerting.
• Vendor management playbooks and contract language.
• Incident response runbooks and FTC notification workflows.

Need to prove compliance before regulators or clients ask? Schedule a Safeguards Rule readiness session and we’ll show you exactly where you stand and what to fix before the FTC comes knocking.