FTC Safeguards for CPA & Accounting Firms

It depends on what the firm does.

The FTC Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for non-bank "financial institutions" under FTC jurisdiction, and 16 CFR §314.2(h) names accountants and tax-preparation services among the examples.

A firm engaged in tax preparation, financial planning, bookkeeping, client accounting services, or financial advisory work is generally covered, because it collects and handles the nonpublic personal information the rule protects.

A firm doing purely audit and attest work for public companies may fall under different regimes rather than the Safeguards Rule. Most practices are a mix of service lines, so coverage is not automatic in either direction.

We do not claim that every CPA firm is in scope. Cyber One Solutions assesses your specific activities during onboarding and documents why and how the rule applies to your firm.

The rule requires a written information security program overseen by a designated Qualified Individual.

It also requires a risk assessment and access controls with multi-factor authentication for anyone accessing your information systems, unless a documented equivalent is approved. Client information must be encrypted in transit and at rest.

You must apply secure development practices if you build your own software. You need continuous monitoring of your systems. Without it, you need annual penetration testing and vulnerability assessments at least every six months.

The remaining elements are security awareness training, a written incident response plan, and an annual written report to your firm leadership or governing body. You must also notify the FTC within 30 days of a notification event.

A notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers.

Firms maintaining information on fewer than 5,000 consumers are exempt from four of these elements: the written risk assessment, the penetration testing and twice-yearly vulnerability assessments, the written incident response plan, and the annual board report.

They must still maintain a written program with the remaining safeguards. Those include access controls and MFA, encryption, audit logging of access to customer information, secure disposal, and training.

The FTC breach-notification duty applies regardless of size.

The Safeguards Rule itself does not carry a first-violation civil penalty. The FTC has told Congress it lacks civil penalty authority for initial Safeguards Rule violations.

Instead, the FTC investigates and typically resolves cases with consent orders that last for years and require a comprehensive security program, independent assessments, and annual compliance certifications.

Violating such an order can bring civil penalties of up to $53,088 per violation (16 CFR 1.98, as adjusted in January 2025 and unchanged for 2026). State attorneys general can bring parallel actions under state consumer protection laws.

Beyond regulators, a breach involving client tax data, financial statements, or bank details can disrupt engagements during busy season, damage the trust that a professional practice depends on, and trigger contractual and reputational consequences with the businesses and individuals you serve.

The compliance program exists to prevent the breach, not just to satisfy the regulator.

We deliver the program end to end. We start with a coverage determination that documents why and how the rule applies to your service lines.

That is followed by a gap analysis against the Safeguards Rule, a written risk assessment, and the WISP and supporting policies. It includes implementation of the technical controls: MFA, encryption, access controls, logging, and endpoint and email security.

It also covers the penetration testing and vulnerability assessment schedule, security awareness training, the incident response plan, and the annual report to firm leadership.

We then manage the program on an ongoing basis so it stays current as your service lines, your environment, and the rule change. We serve commercial clients across Texas, Tennessee, and the United States.

If your firm prepares returns, one program can satisfy both the rule and the IRS guidance. Federal law (the FTC Safeguards Rule) requires paid preparers to maintain a written information security plan, as IRS Publications 4557 and 5708 explain.

The rule and the IRS guidance overlap heavily. A Safeguards-aligned WISP that addresses the risk assessment, access controls, MFA, encryption, monitoring, training, and incident response meets the FTC requirement and the IRS guidance at the same time.

We build one program, map it to both, and keep the documentation an FTC inquiry would ask for. Firms that do no tax work still need the Safeguards program on its own if their other activities bring them into scope.

They serve different purposes and do not substitute for one another. The FTC Safeguards Rule is a federal data-security regulation that legally requires a covered firm to protect the nonpublic personal information it holds about its own clients.

An AICPA peer review evaluates the quality of your firm's accounting and auditing practice against professional standards, not your information-security program.

A SOC engagement is an attestation your firm performs for a client, or that a service provider performs for you, reporting on controls at a service organization.

Passing a peer review or holding a vendor's SOC report does not establish that your own firm meets the Safeguards Rule, and a Safeguards program does not replace peer review or a SOC report.

Cyber One Solutions builds and documents the Safeguards program; peer review and any SOC engagement remain separate work performed by independent CPA firms.

No. A secure cloud-accounting platform, general-ledger system, or client portal is helpful, but the Safeguards Rule applies to your firm as a whole, not just one application.

You are still responsible for your own written program, your access controls and MFA, your risk assessment, your incident response plan, and your training.

You must also oversee every service provider that touches client information, including that platform vendor. Reviewing and documenting the vendor's security posture is part of your obligation, not a replacement for it.

We build the program around your full environment, from staff laptops and email to the portals clients upload documents through, and document vendor oversight as part of it.