Non-banking financial institutions regulated by the Federal Trade Commission (FTC), including financial technology companies, mortgage brokers, credit counselors, financial planners and tax preparers, will now be required to report certain data breaches and other security events directly to the FTC. This article analyzes the recent amendment to the Standards for Safeguarding Customer Information (Final Rule) and offers practical measures for non-bank financial institutions to take in response to the Final Rule’s new reporting requirement, which takes effect on May 13, 2024. See “Advice From a CISO and Lawyer on Best Practices in Information and Data Governance” (Apr. 12, 2023).