FTC Safeguards Rule: A Complete Compliance Checklist for Accounting Firms

FTC Safeguards Rule: A Complete Compliance Checklist for Accounting Firms

The FTC Safeguards Rule is one of the few federal cybersecurity regulations that applies directly to accounting firms, tax preparers, and bookkeepers. Many firm leaders still assume it’s a banking rule. It isn’t. The Federal Trade Commission names tax preparation firms as covered financial institutions, and the revised rule that took full effect in June 2023 spells out specific controls every covered firm needs to have in place.

This guide is for firm owners, managing partners, operations leads, and anyone responsible for protecting client data. In this post, we’ll cover what the FTC Safeguards Rule is, who it applies to, the nine elements your information security program must include, the breach notification requirement added in 2024, and how the rule fits alongside IRS expectations. Use it as a working checklist to see where your firm stands today.

What Is the FTC Safeguards Rule?

The FTC Safeguards Rule (16 CFR Part 314) is a federal regulation issued under the Gramm-Leach-Bliley Act. It requires financial institutions under FTC jurisdiction, including tax preparation firms, to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards that protect customer information.

In the FTC’s own words, the rule “requires financial institutions under FTC jurisdiction to have measures in place to keep customer information secure.” The rule first took effect in 2003. The FTC amended it in 2021 to add concrete requirements, and covered firms had until June 9, 2023, to comply. A 2023 amendment added a breach notification requirement that took effect on May 13, 2024.

The rule is flexible by design. Your program must be appropriate to your firm’s size and complexity, the nature of your work, and the sensitivity of the data you handle. A sole practitioner and a 200-person regional firm won’t build identical programs, but both need every required element in place. You can read the full text in the Electronic Code of Federal Regulations and the FTC’s plain-language small business compliance guide.

Who Does the FTC Safeguards Rule Apply To?

The FTC Safeguards Rule applies to non-bank financial institutions under FTC jurisdiction. The rule defines “financial institution” by what a business does, not by what it calls itself. If your firm is significantly engaged in financial activities, you’re likely covered.

Why tax preparers count as financial institutions

Section 314.2 of the rule lists examples of covered financial institutions, and tax preparation firms are on that list alongside mortgage brokers, collection agencies, credit counselors, and investment advisors that don’t register with the SEC. For most accounting practices, that settles the question. If your firm prepares tax returns, you should treat the rule as applying to you.

Firms that offer bookkeeping, payroll, financial planning, or client advisory services should also evaluate coverage carefully. Those services often involve the same kind of nonpublic personal information the rule is designed to protect.

What counts as customer information

The rule defines customer information as any record containing nonpublic personal information about a customer of a financial institution, in paper, electronic, or other form. For an accounting firm, that includes Social Security numbers, income details, bank account numbers, and addresses on a tax return. It also covers information about customers of other financial institutions that shared the data with you.

Paper counts. The file cabinet in your back office and the scanned PDFs in your document management system fall under the same rule.

The under-5,000-consumer exemption

Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from four specific requirements:

• The written risk assessment (314.4(b)(1))
• Continuous monitoring or annual penetration testing and vulnerability assessments (314.4(d)(2))
• The written incident response plan (314.4(h))
• The Qualified Individual’s annual written report (314.4(i))

This exemption doesn’t remove a small firm from the rule. You still need a Qualified Individual, a risk-based security program, safeguards like encryption and multifactor authentication, staff training, and service provider oversight. The count is based on consumers, not records. One client with dozens of documents on file is still one consumer.

FTC Safeguards Rule Requirements Checklist

Section 314.4 of the FTC Safeguards Rule lists nine elements your information security program must include. Work through each one and document how your firm meets it. That documentation becomes the backbone of your written information security plan.

1. Designate a Qualified Individual

Name one person to implement and supervise your information security program. The Qualified Individual can be an employee, or someone at an affiliate or service provider. No specific degree or title is required. What matters is practical knowledge suited to your firm’s systems.

If you use a service provider in this role, your firm keeps responsibility for compliance. You must designate a senior member of your firm to oversee the provider and require the provider to maintain a program that protects your firm.

2. Base the program on a written risk assessment

Your security program must rest on a written risk assessment that identifies reasonably foreseeable internal and external risks to customer information. The assessment should set criteria for evaluating those risks, assess whether your current safeguards address them, and describe how you’ll mitigate or accept each one. Repeat the assessment periodically, and again when your systems or operations change in a meaningful way.

How exposed is your firm right now?

Your written risk assessment has to start somewhere. See where your firm’s biggest security gaps are in about a minute.

Take the quiz

3. Design and implement safeguards

This element carries most of the technical work. The rule requires your firm to:

1. Implement and periodically review access controls so only authorized users can reach customer information, and only the information they need for their role.
2. Know what data, devices, systems, and personnel you have, and where customer information lives.
3. Encrypt customer information at rest and in transit over external networks. If encryption isn’t feasible for a system, your Qualified Individual must approve an effective alternative.
4. Adopt secure development practices for any applications you build in-house, and evaluate the security of third-party applications you use.
5. Require multifactor authentication for anyone accessing any information system, unless your Qualified Individual approves an equivalent control in writing.
6. Securely dispose of customer information no later than two years after you last used it to serve the customer, unless you need it for a business or legal reason, and periodically review your data retention policy.
7. Adopt change management procedures for your systems and network.
8. Monitor and log the activity of authorized users, and detect unauthorized access to or use of customer information.

Multifactor authentication, encryption, and access controls are the areas where firms most often fall short, particularly for seasonal staff, remote workers, and offshore teams.

4. Regularly test or monitor your safeguards

You need to confirm your safeguards actually work. The rule gives two options: continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months. You also need to test again after material changes to your operations or systems.

5. Train your staff

Provide security awareness training to everyone at your firm, updated as your risk assessment identifies new threats. Staff responsible for security also need qualified training and regular updates to keep their knowledge current. Many firms run annual training with refreshers for new hires and seasonal staff.

6. Oversee your service providers

Your cloud host, IT provider, document management vendor, and outsourced staffing partners all touch customer information. The rule requires you to select providers that can maintain appropriate safeguards, require those safeguards in your contracts, and periodically assess each provider based on the risk it presents.

7. Keep the program current

Your information security program isn’t a one-time project. Evaluate and adjust it based on testing results, changes to your operations, new threats, and anything else that affects your security posture. A merger, a new office, a shift to remote work, or a new application stack should all prompt a review.

8. Write an incident response plan

Covered firms need a written plan for responding to a security event. The rule lists what it must address: the plan’s goals, internal response processes, clear roles and decision-making authority, internal and external communications, remediation of identified weaknesses, documentation and reporting, and a post-incident review. Our guide to building a data breach response plan walks through each step.

9. Report to your governing body annually

At least once a year, your Qualified Individual must report in writing to your board, partners, or a senior officer. The report covers the overall status of the program, your compliance with the rule, and material matters such as risk assessment results, testing outcomes, security events, and recommended changes.

FTC Safeguards Rule Breach Notification Requirements

Since May 13, 2024, the FTC Safeguards Rule requires covered financial institutions to notify the FTC of certain security incidents. Section 314.4(j) calls these “notification events.” A notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers.

If your firm discovers a notification event, you must notify the FTC as soon as possible and no later than 30 days after discovery. The notice goes through an online form on the FTC’s website. Customer information counts as unencrypted if the encryption key was also accessed without authorization.

This requirement applies regardless of firm size. The under-5,000-consumer exemption doesn’t cover it. FTC notification also doesn’t replace state breach laws. All 50 states have their own notification requirements, and many set separate deadlines for notifying affected individuals and state attorneys general.

How the FTC Safeguards Rule Connects to IRS Requirements

For tax professionals, the FTC Safeguards Rule and IRS guidance work together. The FTC rule is the binding regulation. IRS guidance tells tax professionals how to put it into practice.

IRS Publication 4557 explains how tax professionals can protect taxpayer data and points directly to the Safeguards Rule as the legal basis for a written security plan. The IRS also expects paid preparers to confirm awareness of their written information security plan obligations when renewing a PTIN. Authorized IRS e-file providers have additional obligations to protect taxpayer information.

In practice, your written information security plan (WISP) is where FTC compliance lives. It documents your Qualified Individual, your risk assessment, your safeguards, and your incident response process. For a full breakdown of what a WISP should contain, see our guide to WISP requirements for accountants.

What Happens If Your Firm Doesn’t Comply

The FTC enforces the Safeguards Rule under the FTC Act. It can investigate a firm, bring an enforcement action, and require the firm to enter a consent order. Consent orders typically impose years of security obligations, independent assessments, and reporting to the FTC. Firms that violate an order can face civil penalties, and enforcement actions become public record.

The FTC isn’t the only source of consequences. A security failure at a tax practice can also lead to IRS scrutiny of e-file privileges, state attorney general action under state data security laws, state board of accountancy inquiries, client claims, and complications with a cyber insurance claim. In most cases, the reputational damage from losing client data outweighs the direct regulatory cost.

The strongest protection against all of these outcomes is the same: a documented program that meets every element of the rule, plus evidence that you follow it.

How Technology Partners Support Safeguards Rule Compliance

Most accounting firms don’t have a dedicated security team, and the rule anticipates that. Your Qualified Individual can work for a service provider, and many of the technical safeguards in element 3 are easier to meet when a managed technology partner handles them.

A few examples of how the right platform maps to the rule:

• Access controls and multifactor authentication: Rightworks Cloud Protect centralizes identity, access, multifactor authentication, single sign-on, offboarding, and app access audit history across the systems that hold client data.
• Monitoring and logging: Cloud Protect access logs show who accessed which systems, when, and from where, which supports both ongoing monitoring and breach scope assessment.
• Endpoint, email, and backup protection: Cloud Protect Plus adds endpoint and email controls that reduce phishing, malware, and ransomware exposure, along with backup and recovery support.
• Evidence for testing and reporting: Both provide records you can use in your annual report, your risk assessment updates, and service provider reviews.

Technology supports compliance, but it doesn’t establish compliance on its own. You still need a written program, a named Qualified Individual, documented procedures, and periodic review. Product fit also depends on configuration, licensing, and how your firm uses the tools.

Build Your FTC Safeguards Rule Program Now

The FTC Safeguards Rule sets clear expectations for accounting firms: a Qualified Individual, a risk-based written program, specific technical safeguards, regular testing, trained staff, vendor oversight, and a plan for when something goes wrong. The compliance deadline passed in 2023, and breach notification has been in effect since 2024. Firms that work through the nine elements now, document each one, and review the program as they grow will be ready when the FTC, the IRS, a client, or an insurer asks for proof.

FTC Safeguards Rule FAQ

Does the FTC Safeguards Rule apply to CPA firms?

Yes, in most cases. The FTC Safeguards Rule names tax preparation firms as examples of covered financial institutions, and coverage depends on the activities a firm performs rather than its title. A CPA firm that prepares tax returns or handles client financial data should treat the rule as applying and maintain a written information security program.

Is the FTC Safeguards Rule the same as GLBA?

No. The Gramm-Leach-Bliley Act (GLBA) is the federal law, and the FTC Safeguards Rule is the regulation the FTC issued under it to set data security requirements. GLBA also includes a Financial Privacy Rule governing privacy notices and information sharing, plus provisions that prohibit pretexting. The Safeguards Rule covers only the security program portion.

What are the penalties for violating the FTC Safeguards Rule?

The FTC enforces the Safeguards Rule under the FTC Act and can investigate firms, bring enforcement actions, and require consent orders with years of security and reporting obligations. Violating a consent order can lead to civil penalties. Tax professionals can also face IRS, state, and professional consequences after a data security failure.

Can a managed IT provider serve as a firm’s Qualified Individual?

Yes. The FTC Safeguards Rule allows the Qualified Individual to be an employee of a service provider or affiliate. The firm remains responsible for compliance, must designate a senior staff member to oversee the provider, and must require the provider to maintain an information security program that protects the firm.

Do small accounting firms need a written risk assessment under the FTC Safeguards Rule?

Firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment requirement, along with the written incident response plan, annual report, and formal testing regime. They still must assess risk, maintain a written security program, and meet every other element of the rule, including multifactor authentication and encryption.