The FTC Safeguards Rule: A Compliance Checklist for Accounting Firms

If your firm prepares tax returns, does bookkeeping, offers financial planning, or otherwise handles clients' personal financial information, the Safeguards Rule applies to you. Firm size does not change that. There is no exemption for being small or for being a sole practitioner.

The rule does carve out firms that hold information on fewer than 5,000 consumers from a few of its documentation requirements, such as the written risk assessment and the formal incident response plan. But the core duty to actually protect client data applies to every firm regardless of size, and skipping the paperwork does not skip the responsibility. Most firms find it easier to do the whole program than to track which pieces they are exempt from.

The rule requires you to designate one person responsible for overseeing your information security program. The rule calls this the Qualified Individual. It does not have to be a technical expert or a full-time role, and at a small firm it is usually a partner or the office manager. What matters is that one named person owns the program rather than everyone assuming someone else has it covered.

This person can lean on outside help. Many firms rely on their IT provider or a managed security service for the technical work, and the rule expressly allows that. The Qualified Individual stays accountable for the program either way.

Before you can protect client data, you have to know what you hold and what could go wrong. The rule requires a written risk assessment. In practice this is an honest inventory paired with a list of the realistic threats to it.

The heart of the rule is a set of safeguards you design to address the risks you found. Several of these are now explicitly named in the rule rather than left to judgment, and they line up closely with the IRS Security Six that tax preparers already hear about.

The rule names obligations, not products, so the practical question becomes which tools cover each layer. A password manager handles access and credential hygiene, advanced antivirus and managed detection cover the endpoints, and staff training addresses the human gap. Our ranking of the best security software for accounting firms walks through the specific categories and how they map to these requirements.

The rule requires security awareness training for staff, and this is not box-checking. Most firm breaches start with an email, not sophisticated code, so the people opening client attachments all day are your real perimeter. Run regular training, keep dated completion records, and treat the records as evidence you can show an insurer or regulator later.

Your compliance does not stop at your own walls. The rule makes you responsible for the service providers that touch your client data, which for most firms means the cloud hosting provider, the document management platform, and any app holding client information. You must vet their security and hold them to it by contract.

In practice that means asking each vendor for a SOC 2 report and confirming they meet the same bar you hold yourself to on encryption, access control, and backups. Our guide to choosing a tax software hosting provider covers exactly which security questions to put to a host before you sign.

You need a written plan for what happens when something goes wrong, decided before it goes wrong. It does not need to be long. It needs to name who is in charge during an incident, the first steps to contain it, who gets notified including clients and authorities, and how you document what happened. A plan written calmly in July is worth far more than decisions made in a panic in the middle of a breach.

A security program is not a one-time project. The rule expects you to monitor or test your safeguards over time, adjust the program as your firm and its risks change, and have the Qualified Individual report on it in writing to the firm's leadership at least once a year. Put a recurring calendar reminder on the annual review so it does not quietly lapse.

Bring this to your next partner meeting. If you can honestly check every box, your firm is in good shape. If you cannot, you now have your to-do list.