FTC Safeguards Rule Annual Risk Assessment Worksheet

Use it if your organization is an auto dealer or financial institution subject to the FTC Safeguards Rule and you need a written annual risk assessment. It is also useful for any business that stores customer information and wants a structured record of risks, controls, and remediation. The worksheet is designed for the person coordinating compliance, not just IT, so it can capture governance, technical, and physical safeguards together. If you are outside the rule’s scope, you can still adapt it as an internal security review template.

This worksheet is built for an annual risk assessment, which is the normal cadence expected under the FTC Safeguards Rule. Many organizations also update it after major changes such as a new system, a vendor change, a security incident, or a merger. If your data flows or access model change mid-year, waiting until the next annual cycle can leave a gap in your written record. The template helps you keep a dated assessment history and show when follow-up actions were assigned.

It ties together scope, data inventory, safeguards, findings, remediation, and approval in one written record. Ad hoc checklists often miss the evidence trail, the residual risk decision, or the connection between a specific deficiency and the corrective action assigned. This worksheet also forces you to document where customer information is collected, stored, transmitted, and disposed of, which is where many assessments become incomplete. That structure makes it easier to defend the review during an audit or exam.

Include the customer information categories and systems that are actually in scope for your business, such as application data, paper records, shared drives, cloud tools, email, endpoints, and third-party platforms. The template is meant to capture where information enters the business, where it is stored, and how it moves between teams or vendors. It should not be limited to the core system of record if staff export data to spreadsheets or local devices. If a system can access customer information, it belongs in the inventory.

The assessment is usually coordinated by the designated security officer or compliance lead, with input from IT, operations, and business owners. Technical safeguards should be validated by someone who understands the environment, while governance and remediation decisions should be reviewed by management. The approval section is important because it records who accepted the residual risk and who owns the follow-up actions. That division of responsibility helps prevent the worksheet from becoming a purely IT document.

It is structured to support the written risk assessment, safeguard review, and remediation tracking expected under the FTC Safeguards Rule. The sections cover administrative, technical, and physical safeguards, plus data inventory and third-party oversight, which are common exam focus areas. It also creates a place to document deficiencies and management approval, which helps show that risks were evaluated and not just noted. You should still tailor the content to your actual program and business model.

Common mistakes include listing controls without checking whether they are actually enabled, leaving out paper records and exported files, and failing to assign owners for remediation. Another frequent issue is treating the assessment like a one-time form instead of a written record that reflects current systems and vendors. Teams also sometimes skip residual risk approval, which leaves the record incomplete. The template is most useful when every finding has a clear owner, due date, and status.

Yes. You can add vendor-specific review fields, separate business units by location, or expand the data flow section to cover cloud storage, managed service providers, and remote access. If you use multiple systems or franchises, it helps to duplicate the inventory and safeguard sections for each environment so the assessment stays specific. The template is intentionally editable so you can match your actual operating model instead of forcing everything into one generic checklist. That makes it easier to reuse year after year.

This worksheet can complement ISO 9001-style audit records, internal security reviews, and vendor oversight programs, but it is written for FTC Safeguards Rule compliance. If you already maintain a broader information security program, you can map the findings from this assessment into your existing corrective action process. It also works well alongside incident response, access review, and training records because those documents often provide the evidence this worksheet references. The key is to keep the annual assessment as the central written summary.