FTC Safeguards Rule Requirements for CPA Firms

FTC Safeguards Rule requirements for CPA firms center on a written information-security program that protects customer information through administrative, technical, and physical safeguards. The Federal Trade Commission specifically identifies tax-preparation firms as an example of a financial institution that may be covered by the Rule.

Quick answer: A covered CPA or tax-preparation firm should designate a Qualified Individual, document its risk assessment, implement safeguards such as access controls, encryption and multifactor authentication, test those safeguards, train personnel, oversee service providers, maintain an incident-response plan, keep the program current, and provide regular written reporting to leadership.

This guide is educational and is not legal advice. Coverage and specific obligations depend on a firm’s activities, size, customer information, regulators, and other circumstances. Consult qualified counsel regarding your firm’s obligations.

For many CPA firms, the hardest part is not caring about security—it is turning a long list of requirements into a practical plan that someone owns. Our approach at InnerPC is to break that work into manageable priorities: understand the data, identify the most important risks, document the safeguards already in place, and create a realistic roadmap for the gaps.

FTC Safeguards Rule Requirements for CPA Firms: What the Rule Covers

The Safeguards Rule is formally known as the Standards for Safeguarding Customer Information. It implements safeguarding requirements under the Gramm–Leach–Bliley Act for financial institutions subject to the FTC’s jurisdiction. The authoritative legal requirements appear in 16 CFR Part 314.

The FTC amended the Rule in 2021 to provide more specific security requirements and amended it again in 2023 to add breach-notification obligations that took effect in May 2024. The FTC’s current Safeguards Rule compliance guide is the best plain-language starting point, but the regulation itself controls.

Does the FTC Safeguards Rule Apply to CPA Firms?

The Rule applies to financial institutions under the FTC’s jurisdiction, and the definition is broader than ordinary use of that term. The FTC lists tax-preparation firms among its examples. What matters is the activity a business performs—not simply whether it calls itself a CPA firm, accounting practice, tax preparer, or financial institution.

Some institutions that maintain customer information concerning fewer than 5,000 consumers are exempt from certain provisions, but this is not a blanket exemption from the entire Rule. Small firms should not assume they are outside the Rule without evaluating their activities and the specific provisions with counsel.

The Nine Core Safeguards Rule Requirements

The FTC organizes a reasonable information-security program around nine elements:

1. Designate a Qualified Individual. Assign a person with suitable real-world knowledge to implement and supervise the program. A service provider may fill this role, but the firm retains oversight responsibility.
2. Conduct a written risk assessment. Identify customer information, where it is stored, foreseeable internal and external threats, existing safeguards, and how risks will be evaluated and addressed.
3. Design and implement safeguards. Select controls appropriate to the risks identified by the assessment.
4. Monitor and test safeguards. Use continuous monitoring or the testing approach described by the Rule, including penetration testing and vulnerability assessments where applicable.
5. Train personnel. Provide security-awareness training and specialized training for people responsible for the information-security program.
6. Oversee service providers. Select capable providers, contractually require appropriate safeguards, monitor their performance, and periodically reassess them.
7. Keep the program current. Adjust safeguards as operations, systems, personnel, threats, and risk assessments change.
8. Create a written incident-response plan. Define goals, roles, communications, remediation, documentation, reporting, and post-incident improvement.
9. Report to leadership. Require the Qualified Individual to report in writing, regularly and at least annually, to the board, governing body, or responsible senior officer.

Technical Safeguards CPA Firms Should Address

The appropriate controls depend on the firm’s written risk assessment. The FTC guidance specifically discusses access controls, data and system inventories, encryption, application security, multifactor authentication, secure disposal, change management, logging, and monitoring. A practical implementation commonly includes:

• Multifactor authentication for access to customer information
• Role-based access and periodic access reviews
• Encryption for customer information in transit and at rest, or approved compensating controls where encryption is infeasible
• Managed endpoint protection and security monitoring
• Email security and identity-threat detection
• System, device, application, and data inventories
• Secure, tested backups and documented recovery procedures
• Vulnerability scanning, penetration testing, and remediation tracking as applicable
• Central logging and procedures to detect unauthorized access
• Secure data-retention and disposal practices

InnerPC’s cybersecurity services, cloud hosting for accounting firms, and business-continuity services can support technical portions of a broader security program. Technology alone does not establish compliance.

Testing and Monitoring Requirements

The Rule requires covered firms to regularly monitor and test the effectiveness of safeguards. The FTC explains that continuous monitoring can be used for information systems. If continuous monitoring is not implemented, the Rule describes annual penetration testing and vulnerability assessments that include system-wide scans at least every six months, plus testing after material operational changes or when circumstances may materially affect the security program.

Testing should lead to documented remediation. A scan report sitting untouched does not reduce risk. Firms should assign owners, priorities and deadlines, then confirm that corrective actions were completed.

Service-Provider Oversight Does Not End After Signing a Contract

Using an MSP, cloud platform, software vendor, payroll provider, document portal, or other service provider does not transfer the firm’s responsibility. Covered firms must select providers capable of maintaining appropriate safeguards, state security expectations in contracts, monitor provider performance, and periodically reassess suitability.

Ask providers to explain their responsibilities, security controls, incident-notification process, backup and recovery approach, subcontractors, access to customer information, and how the relationship and data will be handled at termination.

FTC Breach-Notification Requirement

Under Section 314.4(j), a covered financial institution must notify the FTC as soon as possible and no later than 30 days after discovering a notification event. The Rule defines a notification event as unauthorized acquisition of at least 500 consumers’ unencrypted customer information. Encrypted information is treated as unencrypted when an unauthorized person accessed the encryption key. The regulation and FTC guidance should be reviewed for the complete definitions, presumptions, required report contents, and law-enforcement-delay process.

Practical FTC Safeguards Rule Checklist for CPA Firms

• Confirm whether the firm is covered and document the analysis with counsel.
• Name the Qualified Individual and define oversight responsibilities.
• Inventory customer information, systems, devices, applications, vendors, and data flows.
• Complete and approve a written risk assessment.
• Create or update the written information-security plan.
• Map safeguards and remediation actions to identified risks.
• Require MFA, access controls, encryption, logging, monitoring, and secure backups as appropriate.
• Establish a recurring testing and vulnerability-management calendar.
• Train employees and document completion.
• Review provider contracts and monitor service providers.
• Maintain a written incident-response and breach-notification process.
• Provide the required written report to leadership and retain supporting records.

The IRS also emphasizes written information-security plans for tax professionals. Review the IRS resource Written Information Security Plans are essential for tax pros alongside FTC materials.

Frequently Asked Questions

Are all CPA firms subject to the FTC Safeguards Rule?

Not necessarily. Coverage depends on the firm’s activities, applicable regulators, customer information, and other facts. Tax-preparation firms are specifically listed by the FTC as an example of a covered financial institution. Firms should confirm their status with qualified counsel.

Does a small accounting firm need a written information-security plan?

A covered financial institution must maintain a written information-security program appropriate to its size, complexity, activities, and the sensitivity of customer information. Smaller institutions may be exempt from certain provisions when they maintain customer information concerning fewer than 5,000 consumers, but the exemption is not universal.

Does Microsoft Azure make a CPA firm compliant?

No. Azure can support safeguards such as access control, encryption, logging, resilience, and secure remote access, but compliance also requires governance, risk assessment, policies, training, testing, provider oversight, documentation, and incident planning.

Can an MSP serve as the Qualified Individual?

The FTC states that the Qualified Individual may work for a service provider. The firm must still designate a senior employee to supervise that person, and responsibility ultimately remains with the firm.

How often should a CPA firm review its safeguards?

The program must remain current as systems, operations, personnel, threats, risk assessments, and business relationships change. The Qualified Individual must also report in writing to leadership regularly and at least annually.

Start With a Documented Cybersecurity Assessment

A useful first step is to compare the firm’s current safeguards with its customer information, systems, vendors, risks, and written policies. InnerPC can help identify technology gaps and create a prioritized remediation roadmap for discussion with the firm’s legal and compliance advisers.

Request an InnerPC cyber risk assessment or schedule a conversation with our CPA technology team.