FTC Safeguards Rule
The FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions to develop, implement, and maintain a written information security program protecting customer information. Its reach is the part most firms misjudge: the definition of a financial institution is functional rather than conventional, and it captures a large number of professional firms that do not think of themselves as financial at all.
Who Counts as a Financial Institution
The rule applies to businesses significantly engaged in activities that are financial in nature. In practice that includes:
- Tax return preparers and many CPA firms
- Mortgage brokers and mortgage lenders
- Investment advisers not registered with the SEC
- Collection agencies and credit counselors
- Automobile dealers that arrange financing or leasing
- Finders who bring together buyers and sellers of a transaction
Banks and SEC-registered advisers sit under other regimes, which is a frequent source of confusion inside multi-entity firms where one affiliate is covered and another is not.
The Required Elements
A compliant program must be written and must address each of the following:
- Designate a Qualified Individual responsible for the program
- Conduct a written risk assessment, periodically reassessed
- Access controls limiting access to customer information, with periodic review of who holds what
- An inventory of data, personnel, devices, and systems
- Encryption of customer information in transit and at rest
- Secure development practices for in-house and customer-facing applications
- Multi-factor authentication for any individual accessing information systems
- Secure disposal of customer information no later than two years after the last use, absent a legitimate need
- Change management procedures
- Monitoring and logging of authorized user activity
- Annual penetration testing and semi-annual vulnerability assessments, or continuous monitoring in their place
- Security awareness training for personnel
- Service provider oversight, including selection, contractual safeguards, and periodic reassessment
- A written incident response plan
- An annual written report from the Qualified Individual to the board or equivalent governing body
Firms maintaining customer information on fewer than 5,000 consumers are exempt from the written risk assessment, penetration testing, incident response plan, and annual report requirements. The remaining obligations still apply.
The Notification Requirement
Since May 2024, a covered firm must notify the FTC of a notification event involving the unencrypted customer information of 500 or more consumers, as soon as possible and no later than 30 days after discovery. Notice is filed electronically and the FTC publishes the entries.
Two details drive behavior here. The threshold counts unencrypted information, so encryption narrows exposure. And the FTC filing is public, which makes it a disclosure decision as much as a compliance one.
Where CPA and Tax Firms Fall Short
- Assuming the rule does not apply. Tax preparation is a covered activity. Many firms discover the obligation during a PTIN renewal or an insurance renewal rather than before.
- A template program. The rule requires a program appropriate to the firm size and complexity and grounded in its own risk assessment. A generic document has no evidence behind it.
- No service provider records. Firms can name their vendors but cannot produce the inventory, the diligence record, or the contract clause covering safeguards and breach notification.
- Testing skipped. Annual penetration testing and semi-annual vulnerability assessment are specific, dated deliverables, and they are among the easiest gaps for an examiner to identify.
- Disposal ignored. Client records are retained indefinitely with no documented legitimate need, against a two-year default.
Why the FTC Safeguards Rule Matters for Investment & Professional Firms
For CPA, tax, and advisory firms across DFW, the Safeguards Rule is the floor that other requirements build on. The program it requires is largely the same program IRS Publication 4557 references, the same one cyber insurers ask about at renewal, and the same one institutional clients probe in security questionnaires. DKBinnovative has built and maintained these programs for compliance-intensive firms in Frisco, Plano, Irving, and Las Colinas since 2004 — the written assessment, the access reviews, the vendor records, the testing on schedule, and the annual report — so that the firm can evidence the program rather than describe it.
Related DKBinnovative Resources
- Managed IT for Accounting & CPA Firms
- Managed IT for Investment & Professional Firms
- Glossary: Written Information Security Program (WISP)
- Glossary: IRS Publication 4557
- Glossary: GLBA Compliance
- Glossary: vCISO
External references: 16 CFR Part 314 · FTC Safeguards Rule: What Your Business Needs to Know · FTC Safeguards Rule legal library