What Is the FTC SafeguardsRule?
The FTC SafeguardsRule requires financial institutions—including CPA firms and taxpreparers—to implement a written information security program that protects sensitive customer data. This includes controls like encryption, access management, intrusion detection, and employee training.
If your firm handles tax documents, payroll records, or financial information, this rule applies to you. Failure to comply can result in fines, lawsuits, reputational damage, and regulatory enforcement.
📌 Need a step-by-step compliance roadmap?Download our FTC Safeguards Rule Checklist for CPA Firms
What CPA Firms Need to Know in 2025
The Safeguards Rule is part of the Gramm-Leach-Bliley Act (GLBA) and is enforced by the Federal Trade Commission(FTC). Updates in recent years have made the rule stricter, especially around breach notification and service provider accountability.
Key Requirements for Accounting Firms:
- Encrypt customer data in transit and at rest
- Implement strong access controlpolicies (e.g., password policies, MFA)
- Conduct regular riskassessments and penetration tests
- Maintain up-to-date incident responseplans
- Vet and monitor all third-party service providers
- Provide ongoing employee cybersecurity training
Who Must Comply with the SafeguardsRule?
Any CPA firm or tax preparation business that collects, stores, or transmits sensitive client data—such as Social Securitynumbers, credit cardinfo, or taxIDs—must comply.
This includes:
- Independent accountants and bookkeepers
- Tax preparers using cloud-based accounting software
- Firms outsourcing IT support to third-party vendors
- Providers handling payroll, mortgage, or financial records
What Qualifies as “Customer Information”?
Under the Safeguards Rule, customer information goes beyond names and addresses. It includes any personal data that could lead to identity theft or financial harm if exposed.
Examples:
- Social Security and taxpayeridentification numbers
- Bank account and credit cardinformation
- Health insurance or employment records
- Financial statements and mortgage applications
Protecting this data is essential to maintaining data integrity, confidentiality, and compliance.
New FTC Rules on Breach Notification
What Triggers a Notification in 2025?
Recent rule changes have lowered the threshold for what counts as a reportable security event. Now, even a minor vulnerability discovered during a penetration test or risk assessment could require documentation or notification to the FTC.
You must report if:
- Sensitive data is accessed without authorization
- Malware, ransomware, or phishing compromises client records
- A service provider causes a breach due to poor controls
Are Your Vendors Putting You at Risk?
Service Providers as “Agents” Under the FTC Rule
If your firm outsources IT, cloud services, or client data management, those third parties are now seen as extensions of your business. If they fail to meet compliance standards, you are liable.
✔️ Tip: Choose a managed servicesprovider (MSP) that offers encryption, access control, MFA, and documented security protocols.
How to Comply with the FTC SafeguardsRule: A CPA Firm’s Guide
Compliance doesn’t have to be overwhelming. Follow these steps to create a defensible, regulator-ready security program:
Step-by-Step Compliance Actions:
- Perform a risk assessment to identify vulnerabilities in your systems, software, and infrastructure.
- Implement strong access control using complex passwords, password strength testing, and MFA.
- Encrypt sensitive data—both in storage and when transmitting between systems.
- Schedule regular penetration testing and vulnerabilityscans to identify weak points.
- Create and maintain documentation of all security policies, procedures, and risk management efforts.
- Train employees regularly on cybersecurity best practices, phishing detection, and compliance responsibilities.
- Auditand monitor service providers to ensure they follow the same safeguards you do.
Why This Matters: Risks of Non-Compliance
Failing to comply with the Safeguards Rule can result in:
- Regulatory penalties or lawsuits
- Loss of professional liability insurancecoverage
- Reputational damage and loss of client trust
- Databreaches that compromise sensitive information
Compliance isn’t just about avoiding fines—it’s about protecting your firm, your clients, and your future.
Free FTC Safeguards Rule Checklistfor CPA Firms
Want to simplify compliance?
Our free checklist walks you through every requirement—from access controlto employee training—in a clear, actionable format.
📥 Download the FTC Safeguards Rule Compliance Checklist
Final Thoughts: Build SecurityInto Your Firm’s DNA
Compliance with the FTC SafeguardsRule is not optional—it’s a critical part of running a modern CPA or tax prep firm. By proactively implementing safeguards, monitoring risk, and documenting your efforts, you can stay compliant and protect your clients’ trust.
Need help applying these strategies?
📅 Schedule a Free IT & Compliance Consultation with our experts and secure your firm’s future today.
FAQ: FTC Safeguards Rule for CPA Firms
What is the FTC Safeguards Rule?
The FTC Safeguards Rule is a federal regulation that requires financial institutions, including CPA and tax preparation firms, to implement a written information security program that protects customer data. This includes encryption, access controls, risk assessments, and employee training.
Who does the FTC Safeguards Rule apply to?
It applies to any business defined as a “financial institution” under the Gramm-Leach-Bliley Act. For CPA firms, this includes tax preparers, bookkeepers, and any accounting practice that collects or processes sensitive client information.
What counts as “customer information”?
Customer information includes any personally identifiable financial data, such as Social Security numbers, tax identification numbers, bank account details, credit card information, and employment or health insurance records.
What are the key requirements to FTC complaince for CPA firms?
CPA firms must:
– Conduct regular risk assessments and penetration tests
– Encrypt sensitive data in transit and at rest
– Use strong access control measures (like MFA)
– Monitor service providers for compliance
– Train employees on cybersecurity and phishing threats
Do service providers fall under the Safeguards Rule?
Yes. Any third-party vendor that handles customer data on your firm’s behalf is considered an extension of your business. You must ensure they meet the same security standards required by the FTC.
What triggers a data breach notification under the Safeguards Rule?
A notification is triggered when unauthorized access to sensitive data occurs—whether due to a cyberattack, system vulnerability, or service provider negligence. Even minor incidents may require reporting under recent rule changes.
How can CPA firms ensure compliance with the Safeguards Rule?
Start by performing a risk assessment, developing an information security plan, encrypting data, implementing access controls, and regularly training employees. Downloading a compliance checklist tailored for CPA firms is also a great first step.
