thearm.aiAgent Relationship Management
FTC Safeguards Scorecard · Free Self-Assessment

Score your own store.

GEO scores how findable you are. This scores how defensible you are. Twenty-two questions against the FTC Safeguards Rule, 16 CFR Part 314: the written program, the elements of 314.4, and breach notification. You get a grade, the gaps ranked by weight, and a printable report for your written information security program.

Why answers instead of a scan: the rule cannot be seen from your homepage. MFA, encryption, and your written program are invisible to any scanner, so a tool that claimed to check them by fetching your site would be theater. The score reflects what you attest. Nothing is invented. Everything runs in your browser; nothing you answer leaves this page.

One question first, it changes the rule
Under 16 CFR 314.6, stores with customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, the pen test and scan schedule, the written incident response plan, and the annual report. Those items become unscored recommendations and the grade renormalizes. Breach notification still applies.
Start the assessment
The Assessment

Answer like the FTC is asking.

Yes means you could show the artifact today. Partial means it exists but is incomplete or stale. Not sure counts as no, because if the FTC asks, an unknown is a gap. Under every element, the regulation itself is one click away, word for word as the FTC wrote it, so nothing here rests on our paraphrase.

The Result
PassPartialNeeds action
The printout is built for your WISP file.
Beyond the Rule

Unscored, because the rule has not caught up.

Three questions the Safeguards Rule does not ask. They are worth answering anyway. These do not affect your grade.

Do you keep an inventory of every AI tool, yours and your vendors', that touches customer information?
You cannot oversee what you have not listed. Start the list.
Does your incident response plan account for AI tools refusing to analyze real attack data?
In July 2026, a breached company's own AI tools declined to examine the logs because they contained real payloads. Know your fallback before you need it.
Can you see how much of your website traffic is AI agents rather than people?
A measurable share already is. Visibility is the first safeguard.
The Tool Family

Three tools, one discipline.

Element F, On Paper

The Vendor Check

Service provider oversight is a required element. Generate the questionnaire, send it, file the answers with your written program. Plus an auditor you run in your own AI before you sign.

 Discoverability

GEO Scorecard

Score any site's AI visibility against the GEO Playbook. Can agents find you?