AegisAI Perspectives · 027
The FTC Safeguards Rule requires security awareness training for your personnel, updated as necessary, but names no phishing topic and sets no frequency.
The FTC Safeguards Rule, in 16 CFR 314.4(e), requires security awareness training for your personnel, updated as necessary1. It adds security updates and training for information security staff, but names no phishing topic and no frequency. AegisAI replays phishing caught in your own tenant to the people it targeted, so the lesson uses mail your firm received15.
New York's Part 500 sets a firmer floor for firms that NYDFS regulates: periodic training, at a minimum annual, that includes social engineering7. Training is one control among several in What email security does a financial services firm need?
Train everyone, give security staff a second track, tie each update to your risk assessment, and keep the record. These seven steps cover the email part of section 314.4(e).
List every person in scope. Section 314.4(e)(1) covers your personnel. Put each employee with a mailbox on the roster, plus anyone who handles customer information by email.
Give security staff a second track. Section 314.4(e)(3) requires security updates and training for information security personnel. Record their sessions apart from the all-staff module.
Pick email topics from your written risk assessment. The FTC rule names no topic. Part 500 ties training to the risks a covered entity finds in its risk assessment8, and that is a sound pattern to copy.
Name business email compromise in the module. The FBI's IC3 describes it as a sophisticated scam that targets businesses and individuals12. Show staff a payment change request and the call-back step that stops it.
Update the module when the risk assessment changes. The FTC reads the rule to require that the training program be updated as necessary based on changes in your risk assessment4. If NYDFS regulates you too, annual is the minimum.
Pair training with mail controls. Part 500 requires risk based controls that monitor and filter email to block malicious content.
Report results to the board. The Qualified Individual reports to the board or equivalent body in writing, at least annually3. Put training completion and phishing results in that report.
AegisAI replays phishing it caught in your tenant to the people it targeted, as the phishing simulation page describes. The caught message is sanitized and sent back with a training page as the payload. Whoever clicks learns it was a simulation, then gets a video and a quiz. Human clicks are separated from scanner clicks.
Four duties sit in the FTC rule text, one is the FTC's own reading of it in the 2021 final rule, and New York adds three of its own.
| Duty | Where it is written | Type |
|---|---|---|
| Security awareness training for personnel, updated as necessary | 16 CFR 314.4(e)(1) | FTC rule text |
| Security updates and training for information security personnel | 16 CFR 314.4(e)(3) | FTC rule text |
| Written report to the board, at least annually | 16 CFR 314.4(i) | FTC rule text |
| Training updated as necessary when the risk assessment changes | Final rule, December 2021 | FTC reading of the rule |
| Notify the FTC of a notification event involving at least 500 consumers, no later than 30 days after discovery6 | 16 CFR 314.4(j)(1) | FTC rule text |
| Training at a minimum annual, including social engineering | 23 NYCRR 500.14(a)(3) | NYDFS rule text |
| Training updated to reflect risks in the risk assessment | 23 NYCRR 500.14(a)(3) | NYDFS rule text |
| Controls that monitor and filter email to block malicious content | 23 NYCRR 500.14(a)(2) | NYDFS rule text |
A record passes when it shows who was trained, when, on which email risk, and what changed after the risk assessment.
Illustrative example, figures are fictional. A consumer lender has 140 staff with mailboxes and 4 information security staff. All 140 finish the email module in January. The March risk assessment names invoice change requests as the top email risk, so the module gains a payment call-back lesson in April. The 4 security staff attend two vendor briefings and one tabletop. A simulation in May sends 140 messages and logs 31 clicks. Link scanners made 12 of them, so 19 people clicked: 13.6 percent. A second simulation in July logs 9 human clicks: 6.4 percent. The board report in December lists both rates and the April change.
Business email compromise and phishing on phones belong in every 2026 module. Across all internet crime, IC3 counts over $50 billion in reported losses from 2020 to 202411.
Teach staff to check a sender and a link on a phone screen. The steps that stop a payment fraud are in how to prevent business email compromise.
The rule text does not say, but it requires training updated as necessary. The FTC reads that as an update whenever your risk assessment changes, so a module written before your firm saw AI-written lures is out of date once the assessment names them.
Part 500 makes the trigger explicit: training is updated to reflect the risks in the risk assessment. The FTC warned in the 2021 final rule that without risk based updates, employees may get the same training year after year, which might reflect obsolete threats5. See how much AI phishing reaches the inbox before you set the scope of an update.
Run two records. The all-staff track meets 314.4(e)(1) and the security track meets 314.4(e)(3).
Keep proof of training and of each update, plus the board report. The rule asks for a written report to the board at least annually. A notification event involving the information of at least 500 consumers goes to the FTC no later than 30 days after discovery.
Track three numbers and keep each where an examiner can find it.
The FTC Safeguards Rule requires security awareness training for personnel, updated as necessary. It does not name phishing. The FBI's IC3 calls business email compromise a sophisticated scam targeting businesses, so phishing belongs in the module if your risk assessment lists it.
The rule sets no frequency. The FTC reads it to require updates as necessary, based on changes in your risk assessment. Firms that NYDFS regulates train at a minimum annually under Part 500.
Your personnel receive security awareness training. Information security personnel also receive security updates and training.
Yes, on training detail. Part 500 requires training at a minimum annual that includes social engineering, for all personnel, updated to reflect the risk assessment. It also requires controls that filter email to block malicious content.
The rule does not define a format. A simulation that teaches at the moment of the click fits the duty to train personnel. In AegisAI's simulation, whoever clicks learns it was a simulation, then gets a video and a quiz.
Under 16 CFR 314.4(j)(1), a notification event involving the information of at least 500 consumers goes to the FTC as soon as possible, and no later than 30 days after discovery.
