The name makes it sound like paperwork for your compliance advisor. It isn’t. The FTC Safeguards Rule is a cybersecurity rule, and most of what it requires happens on your computers, your network and your cloud accounts: multi-factor authentication, encryption, monitoring, vulnerability scans, penetration testing and a plan for when someone gets in.
Tax preparers have been covered by the rule since 2003, but the FTC rewrote it in 2021 with much more specific technical requirements. Those took effect on June 9, 2023, and a breach reporting requirement followed on May 13, 2024. If your firm’s IT setup hasn’t changed much since before then, there are probably gaps.
This checklist goes through each requirement and what it means for your IT, in plain language.
The Safeguards Rule (16 CFR Part 314) is the regulation that carries out the data security part of the Gramm-Leach-Bliley Act, so you’ll also hear it called the GLBA Safeguards Rule. It requires covered businesses to run a written information security program that protects customer data. In practice, that means the security controls themselves plus the documentation that proves they’re in place.
In most cases, yes. The FTC and the IRS both treat professional tax preparers as financial institutions under GLBA, no matter how small the firm is. Firms that do bookkeeping, payroll or financial planning for individuals are generally covered as well. If you prepare individual tax returns, assume the rule applies to you, and check with your compliance advisor if you’re unsure.
The rule’s requirements fall into nine areas. Under each one, you’ll find what the rule asks for and what it usually looks like in an accounting firm’s IT environment.
☐ One named person, the “Qualified Individual,” oversees your security program.
☐ If you outsource it to an IT provider, someone senior at your firm supervises the provider.
What this looks like in practice: At most small firms, a partner or office manager owns the program and works with the firm’s managed IT provider, who handles the technical work. The partner doesn’t need to be technical. They do need regular reports on what’s protected and what isn’t.
☐ You’ve identified the realistic threats to client data, both inside the firm and out.
☐ You’ve checked how well your current security controls stand up to them.
☐ The assessment is written down, with a clear way of rating each risk.
☐ You repeat it regularly.
What this looks like in practice: For an accounting firm, the threats are fairly predictable: phishing emails, business email compromise, ransomware, stolen laptops, staff reusing passwords and remote desktop connections that were opened up in a hurry and never closed. A good assessment looks at each one and asks whether your current firewall, endpoint protection, email filtering and backups would actually stop it.
This is the heart of the rule, and every item on this list is an IT task.
☐ Access controls. Staff can only reach the client data and systems their job requires, and you review permissions regularly.
☐ Inventory. You have a current list of the computers, servers, cloud apps and data stores that hold client information.
☐ Encryption. Client data is encrypted when it’s stored and when it’s sent.
☐ Application security. Software you rely on, whether built in-house or bought, has been reviewed for security.
☐ Multi-factor authentication. MFA is required for anyone logging into your systems.
☐ Secure disposal. Client data is deleted within two years of its last use unless you have a reason to keep it, and old drives are wiped or destroyed.
☐ Change management. Software updates and system changes follow a defined process.
☐ Logging and monitoring. User activity is logged so unauthorized access can be spotted.
What this looks like in practice: MFA should be on email, your tax software, remote access, the client portal, Microsoft 365 or Google Workspace and any cloud storage. Laptops should have full-disk encryption turned on. Client files should go out through a secure portal, not as email attachments. And when a seasonal preparer leaves in April, their accounts should be shut off the same day. Of all these, MFA is the gap we find most often. A lot of firms have it on email and nowhere else.
☐ You have continuous monitoring of your systems, or
☐ You run a penetration test every year, and
☐ You run vulnerability scans at least every six months and after any major change.
What this looks like in practice: Continuous monitoring usually means endpoint detection and response (EDR) software on every computer and server, with someone watching the alerts around the clock. That is often part of a managed IT agreement. A vulnerability scan checks your network and devices for missing patches, outdated software and settings that leave you exposed. A penetration test goes a step further, with a security professional actually trying to break in.
☐ Everyone gets security awareness training, including seasonal and remote staff.
☐ Your security program is run by qualified people, in-house or through a provider.
☐ Those people keep up with current threats.
What this looks like in practice: Short online training sessions a few times a year, plus simulated phishing emails that show who is clicking. Time a refresher for December or early January. That’s when fake IRS notices, fake client document requests and fake “your tax software needs an update” emails pick up.
☐ You choose vendors capable of protecting client data.
☐ Your contracts require them to keep appropriate security in place.
☐ You check in on them periodically, based on the risk each one presents.
What this looks like in practice: List every outside company that stores or can reach client data. That usually means your tax software or hosting provider, cloud storage, the client portal, Microsoft or Google, your IT provider, a payroll service and the shredding company. For each, confirm they use encryption and MFA and that they’ll notify you if they have a breach.
☐ You update your program when test results, new technology or changes in the firm call for it.
What this looks like in practice: Moving to cloud-hosted tax software, adding remote staff, opening an office or switching IT providers all change your risk. Each one is a reason to revisit your controls.
☐ The plan states its goals.
☐ It lays out the steps for responding to a cyberattack or data breach.
☐ It assigns roles and decision-making authority.
☐ It covers communication inside and outside the firm.
☐ It explains how you’ll fix the weakness that was exploited.
☐ It describes how incidents are documented and reported.
☐ It includes a review after every incident.
What this looks like in practice: If ransomware hits on a Tuesday in March, who disconnects the affected computers? Who calls your IT provider, your cyber insurance carrier and your IRS Stakeholder Liaison? Where are the backups, and how long does a restore take? A useful plan answers those questions ahead of time, in a few pages your team can actually follow.
☐ The person in charge of security gives the partners or owners a written report at least once a year.
☐ It covers the program’s status, risk assessment, vendors, test results, any incidents and recommended changes.
What this looks like in practice: Many firms combine this with an annual review meeting with their IT provider, where you go over scan results, open issues and the budget for next year.
Since May 13, 2024, covered firms have had to notify the FTC when unencrypted customer information involving 500 or more people is acquired without authorization. That’s one of the strongest arguments for encryption. If the stolen data was properly encrypted and the encryption key wasn’t taken with it, this requirement generally doesn’t apply.
The notice is due as soon as possible and no later than 30 days after discovery, and discovery is the first day anyone at your firm knows about it. The FTC assumes data was taken unless you have reliable evidence that it wasn’t, which is where good logging pays off. Reports go through an online form on the FTC’s website and may be made public.
Tax practices also need to contact their IRS Stakeholder Liaison right away, notify the state tax agencies where they file returns and follow state breach notification laws for affected clients.
If your firm holds information on fewer than 5,000 consumers, four requirements don’t apply to you: the written risk assessment, the monitoring and testing schedule, the written incident response plan and the annual report to leadership. Count former clients whose files are still on your systems.
The core security controls still apply, including MFA, encryption, access controls, training and vendor oversight. And frankly, the exempt items are good practice anyway. A vulnerability scan costs far less than a breach.
MFA is on email but not on the tax software or remote access. Laptops aren’t encrypted. Nobody is watching for alerts after hours. There has never been a vulnerability scan, let alone a penetration test. Backups exist but haven’t been test-restored in a year. Former employees still have active accounts. And the incident response plan is “call our IT person.”
If a few of those sound familiar, you have company. The good news is that every one of them is a fixable IT problem.
The Safeguards Rule sets out which security controls you need. Your written information security plan (WISP) documents that you have them. IRS Publication 4557 adds guidance specific to tax businesses, and Publication 5708 provides a sample plan. Our WISP template guide for accounting firms walks through writing one, section by section.
Waterdog has been handling IT and cybersecurity for accounting and tax firms around Philadelphia and the Main Line since 2002. We set up and manage the controls this rule calls for, including MFA, encryption, endpoint protection, 24/7 monitoring, backups and staff training, and we help you document all of it for your WISP. Learn more about our cybersecurity services, our IT compliance services and our work with accounting firms. To see how your firm’s security measures up against this checklist, request a Cybersecurity Risk Review.
Yes. Most of its requirements are security controls: multi-factor authentication, encryption, access controls, logging, monitoring, vulnerability scanning, penetration testing, staff training and incident response.
Yes. The FTC Safeguards Rule carries out the Gramm-Leach-Bliley Act’s data security requirements for businesses the FTC oversees, so both names refer to the same rule.
Most do. Firms that prepare tax returns or offer financial services to individuals are considered financial institutions under GLBA, regardless of size.
Yes. MFA is required for anyone accessing your information systems, unless the person in charge of your security program approves an equally secure alternative in writing.
If you hold information on 5,000 or more consumers and don’t have continuous monitoring, the rule calls for a penetration test every year and vulnerability scans at least every six months. Smaller firms are exempt from that requirement but still benefit from regular scans.
The FTC can bring an enforcement action, which typically comes with years of required security improvements and outside assessments. For tax preparers, a breach that exposes weak security can also cause trouble with the IRS, state regulators, cyber insurers and clients.
This article is general information and not legal advice. Please talk with your attorney or compliance advisor about your firm’s specific obligations.
