FTC Safeguards Rule for CPA Firms: What Compliance Takes

An insurance renewal or client questionnaire may prompt a CPA firm to review its security obligations. The FTC Safeguards Rule for CPA firms requires a written information security program and safeguards that operate in practice. Coverage depends on the firm’s activities, and some requirements have limited exceptions. Here is what applies to a CPA firm, what compliance takes, and where firms get stuck.

When the FTC Safeguards Rule Applies to CPA Firms

Tax preparation firms are among the businesses identified in the FTC’s Safeguards Rule guidance. Coverage depends on the firm’s activities and the FTC’s jurisdiction; holding financial records alone is not the coverage test. The Rule applies to covered financial institutions that are not subject to another regulator’s enforcement authority under section 505 of GLBA.

Tax preparation firms were covered before the 2021 amendments. Those amendments added more detailed safeguards and expanded the definition to include finders who bring buyers and sellers together.

When checking applicability:

• Size does not decide coverage. A covered activity can bring a firm within scope regardless of headcount.
• Revenue does not decide coverage. There is no minimum dollar threshold that lets you opt out.
• Your CPA license is separate. State board rules and professional standards do not substitute for the federal requirement.

Your program should reflect the firm’s activities, systems, and customer information. Customer information includes records containing nonpublic personal information about a customer, whether maintained on paper or electronically.

Confidentiality Duties Are Not the Same as Safeguards Rule Compliance

Professional confidentiality duties and tax-data restrictions can overlap with security responsibilities. Covered firms must also maintain the written program and applicable safeguards required by the Rule. Check whether your current documents describe the systems, controls, and responsibilities actually in place.

What the Rule Requires: Nine Elements in Plain English

The core requirement is a written information security program sized to your firm. It must include administrative, technical, and physical safeguards appropriate to your activities and the sensitivity of customer information. The nine elements below should be read alongside the under-5,000-consumer exception explained later.

1\. Name a qualified individual

Designate a Qualified Individual to oversee and implement the program. This person may work for your firm, an affiliate, or a service provider. If outsourced, your firm retains responsibility, assigns a senior person to oversee the role, and requires the provider to maintain a program that protects your firm.

2\. Assess risks and document the findings

Start by documenting where client data actually lives: tax software, document portals, email, cloud storage, laptops, home offices, backups, and the external drive someone still uses. Then identify the realistic threats to each, rank them, and write it down.

The assessment connects identified risks with the safeguards selected. The specific written-assessment requirements have a small-firm exception, but the underlying duty to assess risk remains. Sixwatch offers cybersecurity assessments for existing clients to review security gaps and prioritize improvements.

3\. Put safeguards in place

The rule names the controls your program has to address:

• Limits on who can reach client files, reviewed on a schedule
• An inventory of your systems and the data they hold
• Encryption at rest and in transit, or effective alternative controls approved by the Qualified Individual where encryption is infeasible
• Secure development practices for in-house applications and procedures to assess relevant third-party applications
• Multi-factor authentication (MFA) for access to customer information, unless the Qualified Individual approves equivalent secure access controls in writing
• Secure disposal under a retention policy that accounts for the Rule’s disposal requirements and exceptions
• Change procedures so new systems do not quietly bypass your controls
• Logging authorized user activity and monitoring for unauthorized access

The Rule generally requires disposal no later than two years after the most recent use of the information to serve the customer, with exceptions for legitimate business needs, legal retention requirements, and cases where targeted disposal is not reasonably feasible. Review those exceptions before deleting tax records. Sixwatch’s identity and access security services support work on MFA, permissions, and account access.

4\. Monitor and test safeguards

Regularly monitor and test whether safeguards work. Where §314.4(d)(2) applies, use continuous monitoring or the prescribed testing approach: annual penetration testing and vulnerability assessments, including scans every six months and assessments following relevant changes or newly identified risks.

5\. Train staff and security personnel

Provide security awareness training, update it as risks change, and ensure the people responsible for the program have appropriate training and current knowledge. Include temporary staff who handle customer information.

6\. Oversee service providers

Select providers capable of protecting customer information, require appropriate safeguards in contracts and periodically assess their suitability. Include relevant tax software, hosting and document-management providers.

7\. Keep the program current

Evaluate and adjust the program as risks, operations and testing results change. A new office, acquisition, platform or security incident may require changes.

8\. Prepare an incident response plan

Where required, maintain a written plan covering responsibilities, communications, response procedures, remediation and review after an incident. A practical response plan is also useful for firms eligible for the written-plan exception.

9\. Report to leadership

Where required, the Qualified Individual must report in writing regularly and at least annually to the board, equivalent governing body, or responsible senior officer. Cover the program’s status, material risks, testing, incidents, and recommended changes.

The Under-5,000-Consumer Exception: What Changes and What Remains

Under 16 CFR §314.6, firms maintaining customer information concerning fewer than 5,000 consumers are exempt from four specific provisions:

• The written risk-assessment requirements in §314.4(b)(1)
• The prescribed testing provisions in §314.4(d)(2)
• The written incident response plan in §314.4(h)
• The leadership reporting requirement in §314.4(i)

General risk assessment and regular monitoring/testing obligations remain, along with the written security program and other applicable safeguards. The MFA and encryption provisions still apply, including their stated alternatives. Exactly 5,000 consumers is outside this exception.

Count relevant consumers whose customer information is maintained, including retained records from prior years. Count people, rather than files or repeated annual returns. Document the basis for your count; staff size or a large archive alone cannot establish eligibility.

FTC Breach Notification: The 500-Consumer Trigger and 30-Day Deadline

The deadline for certain updated safeguards was June 9, 2023. The separate FTC notification requirement took effect May 13, 2024.

Notify the FTC as soon as possible, and no later than 30 days after discovery, of a qualifying notification event involving at least 500 consumers. This concerns unauthorized acquisition of unencrypted customer information. Encrypted information is treated as unencrypted for this purpose when an unauthorized person accessed its encryption key.

Unauthorized access is presumed to include acquisition unless reliable evidence shows acquisition did not occur or could not reasonably have occurred. Reports go to the FTC and may be made public. State laws and other applicable obligations may also require notices to clients or other parties.

The under-5,000-consumer exception does not remove this reporting duty. Your response procedures should identify who assesses notification obligations and tracks the discovery date.

What Non-Compliance Costs

The FTC can take enforcement action. A breach can also interrupt operations, require remediation, and damage client relationships. Insurance coverage depends on the policy and circumstances; neither having a written program nor using an IT provider guarantees payment of a claim.

How IRS WISP Guidance Fits the Safeguards Rule

The IRS directs tax professionals to maintain a written information security plan (WISP) and provides resources to help them meet their security responsibilities under GLBA and the Safeguards Rule. IRS Publication 5708 offers a template and planning guidance for tax and accounting practices.

Use the resource to describe your actual systems, people, and procedures.

Completing a template alone does not establish compliance; the safeguards described must be implemented and maintained.

A Practical FTC Safeguards Rule Checklist for CPA Firms

Prioritize work according to current risks and applicable obligations. This sequence is a planning aid, not a grace period or a promised completion schedule.

Immediate priorities. Assign responsibility, identify urgent security gaps, and inventory systems, customer information, and service providers. Confirm which requirements and exceptions apply.

Implementation. Connect assessment findings to controls, address access and encryption gaps, update the written program, train staff, and establish the relevant testing and response processes.

Ongoing review. Assign review dates and retain evidence of completed work. Quarterly access reviews and an annual program review can be useful internal routines, with additional reviews when circumstances change. Apply the Rule’s specific testing and reporting schedules where required.

Assign an owner and keep evidence of the work

The examples below help organize implementation. They are not a prescribed legal format or a complete compliance checklist. Adapt the responsibilities to your firm.

For example, a tax practice could assign an owner to review seasonal preparers’ access when their work ends, remove permissions no longer needed, and retain a dated record. This is an illustrative workflow, not a Sixwatch client result.

Where CPA Firms Get Stuck

Check whether the written program matches current systems, assigned responsibilities, and retained evidence. Useful checks include:

An unchanged template. Replace references to teams, tools, or procedures your firm does not use. Assign an owner to resolve differences between the document and actual practice.

Reviews delayed during filing season. Schedule essential work, assign backup owners, and track overdue actions so the program remains current during busy periods.

Unclear documentation responsibilities. Ask who maintains the risk assessment, access reviews, and applicable reports, and request the current versions. Confirm which deliverables your provider’s agreement includes.

Sixwatch’s managed cybersecurity support can help firms strengthen practical controls as part of ongoing IT management. Our local, U.S.-based engineers support firms in Tampa, Sarasota, and Orlando, as well as distributed teams beyond Florida. Discuss the scope of support and documentation your firm needs before assigning responsibilities.

Frequently Asked Questions

Review Your Firm’s Safeguards and Next Steps

Start by identifying the responsible owner, reviewing current evidence, and prioritizing unresolved security gaps. Keep the program aligned with how your firm operates throughout the year. Schedule a consultation with Sixwatch to discuss your current safeguards, support needs, and appropriate next steps.