Does the Safeguards Rule apply to a firm our size?

The rule turns on what the business does, not how big it is. Many firms discover they are in scope years after the fact.

What is the single highest-risk thing we do?

Moving money on emailed instructions. Fixing that costs process, not product.

Financial services & real estate

Title and closing companies, mortgage brokers, insurance agencies, advisors, and real estate operations in Florida; banks, credit unions, and insurers in Trinidad & Tobago.

How this business actually runs

Money moves on instructions, and the instructions arrive as email. Closings, premiums, payoffs, and client records cross CRM, document management, e-signature, and inboxes. Every party in a transaction can see part of the thread. The most attacked moment in this industry is the one where someone wires money based on something they read.

The systems and the data

CRM, document management, e-signature, email, accounting, and the wire instructions that pass between them. In Trinidad & Tobago, add core banking and AML screening. The client file is the business: losing control of it is not an IT incident, it is the end of a relationship built over years.

What most firms think they need, and what comes first

Most think cyber insurance plus antivirus means covered. What comes first is the part the insurer and the regulator will actually ask about: a written program with an owner, access that matches roles, and evidence that the controls exist outside the policy binder.

Obligations and local texture

In the United States, the FTC Safeguards Rule requires nonbank financial institutions (mortgage brokers, title companies, advisors among them) to maintain a written information security program, and since May 2024 to report certain incidents to the FTC.
Florida's data protection statute requires notifying affected residents within 30 days of determining a breach.
Florida's local texture is wire fraud around closings, the loss that shapes how this market behaves. Out-of-band verification is the control that survives it.
In Trinidad & Tobago, the Data Protection Act is partially proclaimed: its general privacy principles are in force, and the defensible position is to operate as if the rest were coming.
Trinidad & Tobago's FATF-driven review of the sector has produced new obligations: the Miscellaneous Provisions (FATF Compliance) Act 2025, in full force since 17 November 2025. Institutions are being asked for evidence, not intentions.

What excellent looks like here

Wire instructions are never executed from email alone. Verification is out-of-band, every time, no exceptions for known parties.
One identity per person, MFA everywhere money or client records move.
A written safeguards program exists, has a named owner, and matches what is actually running.
Access is reviewed on a schedule, and departures are closed the day they happen.
Vendors that touch client data are known, listed, and reviewed.

How you’d start

Whatever the industry, the entry point is the technology diagnostic: this page's systems and obligations, assessed on your operation.

Questions owners ask

Coverage is demonstrable or it isn't. If nobody can produce the written program, the access list, and the evidence in a day, the honest answer is not yet, and finding that out before an incident is cheap.

Customer Success Team

Itaca Technologies

Your question isn't here?

Ask it as you'd ask it across the table. The team that does the work reads it and answers with a concrete next step.