AegisAI Perspectives · 021
The FTC Safeguards Rule requires multi-factor authentication for anyone accessing an information system, and a mailbox that holds customer data is one.
Yes. The FTC Safeguards Rule requires multi-factor authentication, at least 2 factor types6, for any individual accessing any information system, and a mailbox holding customer information is one1. AegisAI weighs new devices and inbox rule changes together per account21. MFA is one control in the wider set covered by What email security does a financial services firm need?
FTC Safeguards Rule multi-factor authentication has one written exception. Your Qualified Individual can approve, in writing, reasonably equivalent or more secure access controls instead2. Without that written approval, every account that reaches customer information needs MFA.
Scope every account that touches customer information, enforce two factor types on it, and write down each exception.
List the information systems. The rule counts electronic resources that contain customer information or connect to a system that does8. Put every user and shared mailbox on the list. Add each service account that sends or stores customer files.
Limit access first. Section 314.4(c)(1) requires access controls, reviewed periodically, that admit only authorized users to the customer information their duties need3. Remove mailbox delegations that no duty explains.
Pick two factor types. MFA means verification of at least two types of factor. The types are knowledge (a password), possession (a token) and inherence (a biometric)7.
Enforce it in Microsoft 365. Security defaults in a Microsoft Entra tenant turn on Microsoft Authenticator for all users14. Conditional Access policies set which apps and events require MFA. They ask for extra verification when a user is remote or on a personal device15.
Enforce it in Google Workspace. In 2-Step Verification enforcement, the On from date option starts within 24 to 48 hours of the date you pick16. During the new user enrollment period, users sign in with just a password17, so set it short.
Write each exception. A service account or shared mailbox without MFA needs reasonably equivalent or more secure controls, approved in writing by the Qualified Individual. Record the account and the control. Add the reason and a review date.
Log and watch the accounts. Section 314.4(c)(8) requires monitoring and logging of authorized users' activity and detection of unauthorized access4. Send mailbox audit events and sign-in logs to one place.
Tie each choice to the risk assessment. The FFIEC guidance calls the risk assessment critical for choosing access and authentication practices11. Keep the assessment next to the exception register.
AegisAI weighs impossible travel, new devices, inbox rule changes and suspicious internal sends together per account, as the account takeover protection page describes. Behind each finding it runs one agent per signal, weighed together per account22. Sign-in checks alone fall short, because a phishing proxy keeps the session cookie and no second factor is asked for23.
Five clauses decide what a mailbox needs, and two of them name MFA: 314.2(k) defines it and 314.4(c)(5) requires it. The other three set which accounts are in scope and what is checked after sign-in.
| Clause | What it says | What it asks of a mailbox |
|---|---|---|
| 314.2(j) information system | Resources that contain customer information or connect to a system that does | Any mailbox, archive or service account that holds or reaches customer files is in scope |
| 314.2(k) multi-factor authentication | At least two factor types: knowledge, possession, inherence | A password plus a token or a biometric |
| 314.4(c)(1) access controls | Only authorized users, limited to what their duties need | Periodic review of who can open each mailbox |
| 314.4(c)(5) MFA | Any individual, any information system, or a written equivalent | MFA on every account in scope, or a signed exception |
| 314.4(c)(8) monitoring | Log user activity and detect unauthorized access | Sign-in and mailbox audit logs that someone reads |
Encryption of customer information is a separate clause, covered in Does the FTC Safeguards Rule require email encryption for customer information?
Run each exception through the same three questions: is the account in scope, which control stands in for MFA, and who signed it.
Illustrative example, figures are fictional. An auto lender keeps customer information on 3,200 consumers. It runs 45 user mailboxes, 2 shared mailboxes and 1 scanner service account that emails loan files to the shared "payoffs" mailbox. All 48 accounts reach customer files, so all 48 are information systems. The 45 users get Microsoft Authenticator through security defaults. The two shared mailboxes have sign-in blocked, and staff open them from their own MFA accounts. The scanner cannot answer a second factor. The Qualified Individual signs a one page approval naming the scanner and its replacement controls, with a 90 day review date. The lender's size does not remove the MFA clause, because the small institution exception skips 314.4(c)(5)9. Three weeks later the audit log shows a new inbox rule on a user mailbox that passed MFA. The lender treats it as possible unauthorized access under 314.4(c)(8).
The FTC Safeguards Rule requires MFA for any individual accessing any information system. "Any information system" covers anything that holds or connects to customer information.
The rule defines MFA by factor types and names no app, token brand or protocol. The only alternative is a written approval of reasonably equivalent or more secure access controls by the Qualified Individual.
The Safeguards Rule sets no phishing-resistant standard, so the legal test is two factor types. A code sent to the same mailbox you are protecting adds little, because whoever holds the mailbox holds the code.
A phishing proxy keeps the session cookie, so no second factor is asked for. Google Workspace has an Only security key option, which now accepts security keys and passkeys as the 2-Step Verification method18. Use it for administrators and for staff who handle the most customer files.
Every email system that contains customer information, or connects to a system that does, is covered. In practice that means every user and shared mailbox. It also means the archive and any service account that relays customer files.
Connected systems count too. A scanner account that drops loan files into a mailbox reaches customer information, and so does an integration that reads the mailbox. Put each one on the inventory from step 1 and give it MFA or a written exception.
No. The MFA clause applies to every institution the rule covers, at any size. The small institution exception, for firms with customer information on fewer than five thousand consumers, removes 314.4(b)(1), (d)(2), (h) and (i) only. Section 314.4(c)(5) is not on that list.
The FFIEC authentication guidance is a second reference, and the FDIC sent it to all FDIC-supervised institutions12. It says MFA, or controls of equivalent strength, mitigates unauthorized access10, and it bases the choice on the risk assessment.
The evidence is four records kept in one folder.
Any method that combines two of the three factor types is compliant under the rule's definition. A password and a second password are one factor type and do not qualify.
Microsoft Entra MFA requires two or more methods drawn from something you know, have or are13. That matches the rule's three types. In Google Workspace, the Only security key option limits 2-Step Verification to security keys and passkeys.
Track three numbers from day one.
Yes, for every account that is or reaches an information system holding customer information. The only alternative is a reasonably equivalent or more secure control that the Qualified Individual approves in writing.
They are in scope when they hold or reach customer information. Block direct sign-in on a shared mailbox and open it from MFA accounts. For a service account that cannot take a second factor, get a written approval of the equivalent control.
The rule names none. Google Workspace offers a new user enrollment period, during which users sign in with just a password. Keep it short and note it in the exception register.
Yes. The exception for customer information on fewer than five thousand consumers removes four provisions, and 314.4(c)(5) is not one of them.
No. A phishing proxy keeps the session cookie, so no second factor is asked for. The rule also requires logging and detection of unauthorized access. What is account takeover in email security and how does it work? walks through the attack chain.
Knowledge factors such as a password, possession factors such as a token, and inherence factors such as biometric characteristics.
