FTC Safeguards Scorecard · Free Self-Assessment

Score your own store.

GEO scores how findable you are. This scores how defensible you are. Twenty-one honest answers against the nine required elements of the FTC Safeguards Rule, 16 CFR Part 314. You get a grade, the gaps ranked by weight, and a printable report for your written information security program.

Why answers instead of a scan: the rule cannot be seen from your homepage. MFA, encryption, and your written program are invisible to any scanner, so a tool that claimed to check them by fetching your site would be theater. The score reflects what you attest. Nothing is invented. Everything runs in your browser; nothing you answer leaves this page.

One question first, it changes the rule
Under 16 CFR 314.6, smaller stores are exempt from a few written requirements. Those items become unscored recommendations and the grade renormalizes.
Start the assessment
The Assessment

Answer like the examiner is in the room.

Yes means you could show the artifact today. Partial means it exists but is incomplete or stale. Not sure counts as no, because in an examination, an unknown is a gap. Under every element, the regulation itself is one click away, word for word as the FTC wrote it, so nothing here rests on our paraphrase.

The Result
PassPartialNeeds action
The printout is built for your WISP file.
Beyond the Rule

Unscored, because the rule has not caught up.

Three questions the Safeguards Rule does not ask yet. After July 2026, your examiner eventually will. These do not affect your grade.

Do you keep an inventory of every AI tool, yours and your vendors', that touches customer information?
You cannot oversee what you have not listed. Start the list.
Does your incident response plan account for AI tools refusing to analyze real attack data?
In July 2026, a breached company's own AI tools declined to examine the logs because they contained real payloads. Know your fallback before you need it.
Can you see how much of your website traffic is AI agents rather than people?
A measurable share already is. Visibility is the first safeguard.
The Tool Family

Three tools, one discipline.

Element F, On Paper

The Vendor Check

Service provider oversight is a required element. Generate the questionnaire, send it, file the answers with your written program. Plus an auditor you run in your own AI before you sign.

 Discoverability

GEO Scorecard

Score any site's AI visibility against the GEO Playbook. Can agents find you?