FTC Safeguards readiness, proven continuously.
The Safeguards Rule expects covered financial institutions — including auto dealerships that arrange financing — to run an information security program with specific elements. AssurIQ maps its universal controls into those elements, collects the evidence continuously, and gives the qualified individual a defensible picture for the board.
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
The requirement areas, in plain language.
Original AssurIQ summaries — not reproductions of the standard. Use the primary source for the authoritative text.
Someone accountable for the program, with periodic written reporting to leadership on status, risks and recommended changes.
Identify internal and external risks to customer information and evaluate the safeguards in place, on a documented and repeated basis.
Limit access to customer information to those who need it; require multi-factor authentication for access to information systems.
Know what data and systems you have; encrypt customer information in transit and at rest; manage change securely.
Monitor and log authorized user activity; test safeguards through continuous monitoring or periodic testing; train staff.
Select and oversee providers capable of protecting customer information; maintain a written incident response plan.
Universal controls that carry evidence into each requirement area.
Illustrative, high-level mapping. Inside the product every mapping is versioned and every control shows its live state, confidence and evidence.
| Requirement area | AssurIQ universal controls | Typical evidence | Example state |
|---|---|---|---|
| Access controls & MFA | AIQ-IAM-002 privileged MFAAIQ-IAM-004 user MFA coverageAIQ-IAM-007 stale account review | Identity connector reads, AD posture | Fail |
| Inventory of data, personnel, devices, systems | AIQ-AST-001 asset inventory currentAIQ-AST-003 unknown device triageAIQ-END-004 supported OS | Collector discovery, topology snapshots | Partial |
| Encryption | AIQ-CRY-001 disk encryptionAIQ-CRY-003 TLS on exposed services | Endpoint connector, external surface scan | Pass |
| Monitoring & testing | AIQ-LOG-001 central loggingAIQ-VUL-001 vulnerability cadenceAIQ-NET-011 no KEV on exposed services | Collector scans, log platform connector | Fail |
| Service-provider oversight | AIQ-VND-001 provider inventoryAIQ-VND-002 assessments on schedule | Vendor records, contracts, questionnaires | Exception |
| Incident response plan | AIQ-IRP-001 written plan reviewedAIQ-IRP-002 exercise performed | Policy artifact, exercise record | Evidence Gap |
| Risk assessment | AIQ-GOV-002 risk assessment currentRisk Register linkage | Register entries linked to findings and controls | Partial |
Example states are illustrative. An Evidence Gap means proof has not been collected yet — it is not a failed control.
What stays verified between assessments.
- MFA coverage re-read from the identity provider on schedule
- Asset inventory refreshed by the collector; unknown devices raised for triage
- Exposed services scanned for known-exploited vulnerabilities
- Vendor review dates tracked; overdue reviews change control state
- Exceptions expire and revert automatically
- Board report generated as a point-in-time snapshot with evidence
What AssurIQ does not do.
- AssurIQ does not determine whether your organization is a covered financial institution or whether the rule applies — your counsel does.
- AssurIQ does not certify compliance with the Safeguards Rule.
- AssurIQ does not make notification determinations after an incident.
- Mappings are original AssurIQ summaries, not the regulatory text.
Common questions
Who at a dealership uses this?+
How does the written risk assessment work in AssurIQ?+
Can our assessor see this?+
AssurIQ supports FTC Safeguards Rule readiness with continuous evidence, risk and remediation. It does not certify compliance, does not decide applicability and does not make legal notification determinations. Requirement summaries are original AssurIQ wording.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.