Fighting Fraud with the Red Flags Rule: A How-To Guide for Business

This site from the FTC can help a business get a handle on the Red Flags Rule.

Fighting Fraud with the Red Flags Rule: A How-To Guide for Business

...As a practical matter, most businesses and organizations that provide products and services to their customers and then bill them later are covered by the Rule.

http://ftc.gov/redflagsrule

If you look into the FAQ section of this site it will remind you that even if you are not covered under the Red Flags Rule now, that you need to periodically do a Risk Assessment to consider whether your status has changed

http://ftc.gov/bcp/edu/microsites/redflagsrule/faqs.shtm#C

Of course, from time to time you need to consider whether your identity theft risk has changed, warranting a different approach with respect to the Rule.