IT Support for Accounting Firms and the FTC Safeguards Rule

Yes, if your firm prepares tax returns, the FTC Safeguards Rule most likely applies to you, and much of it lands on your IT. The FTC’s business guidance lists tax preparers among the businesses the rule covers. The rule asks for a written security program, multi-factor authentication, encryption, staff training, oversight of your vendors, and a plan for when something goes wrong. Good accounting IT support is the part of that list that gets installed, patched, and watched.

This guide is for owners and office managers at accounting, tax, and bookkeeping firms of roughly 10 to 50 people around Hampton Roads. It covers who the rule reaches, what it asks for, which of those items are IT work, and what to ask a provider before you hire one. It is not legal advice. Whether and how the rule applies to your firm is a question for your attorney.

Does the Safeguards Rule apply to an accounting firm?

The Safeguards Rule is 16 CFR Part 314, issued by the FTC under the Gramm-Leach-Bliley Act. It covers businesses the law calls “financial institutions,” and that definition is wider than banks. The FTC’s guidance, FTC Safeguards Rule: What Your Business Needs to Know, names tax preparers as one example.

The IRS says the same thing to tax professionals. Its Publication 4557 states that the “financial institutions” definition “includes professional tax preparers,” and that tax return preparers must create and enact security plans to protect client data.

What about a CPA firm that mostly does audit work, or a bookkeeper who never touches a return? Coverage turns on the activities you perform, not the name on the door. Firms that prepare returns or give financial advice are the clearest cases. If your firm sits at the edge, get a written answer from an attorney instead of guessing. We cannot give you one.

What does the rule ask a firm to do?

The FTC guidance walks through the required elements. Here they are in plain terms, with the part that touches IT called out.

A Qualified Individual. You name one person who oversees and runs the security program. The FTC says this person can be an employee, or can work for an affiliate or a service provider, and that what matters is “real-world know-how suited to your circumstances.” If you use an outside person, 16 CFR 314.4(a) says your firm must “retain responsibility for compliance,” name a senior member of your own staff to direct and oversee that person, and require the provider to keep a security program that protects you. You can outsource the role. You cannot outsource the responsibility.

A written risk assessment. You identify where client information lives and what could go wrong with it.

Multi-factor authentication. The rule text says to implement it “for any individual accessing any information system,” unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.

Encryption. Customer information must be encrypted in transit over external networks and at rest. Only if you determine encryption is infeasible may you use effective alternative controls, reviewed and approved by your Qualified Individual.

Access control and a data inventory. Staff should reach only the client files their job needs, and you should know where those files are.

Secure disposal. Customer information should be disposed of no later than two years after you last used it to serve the customer, unless you have a business or legal reason to keep it.

Monitoring and testing. The rule calls for continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.

Staff training. Security awareness training, updated as your risks change.

Service provider oversight. You must take reasonable steps to choose providers that can keep information safe, require safeguards by contract, and check on them. Your IT provider, your tax software host, and your cloud storage vendor are all in this category.

A written incident response plan, and notice to the FTC after certain breaches.

That is a business program, not an IT project. Policies, risk decisions, and vendor contracts belong to your firm. What follows is the portion that IT support can do for you.

Which of those requirements are IT work?

Most of the technical items. Here is how they look in a small accounting office.

Multi-factor authentication should sit on email, your tax and practice software, remote access, and any file portal. A stolen password alone should not get anyone into client returns. This is the control the IRS calls out as required “for all companies regardless of size.”

Encryption means encrypted laptops and desktops, encrypted backups, and encrypted email or a secure portal for sending client documents. A lost laptop during a client visit is a very ordinary event. Whether it becomes a reportable one depends partly on whether the drive was encrypted.

Access control means client folders are not open to the whole office, new hires get only what they need, and when someone leaves their accounts close the same day. Offboarding is where small firms leak the most, because nobody owns it.

Monitoring and patching means devices and servers are updated on a schedule, and automated 24/7 monitoring alerts us when something drifts out of range, such as a failing disk or a backup that did not finish. This supports the rule’s monitoring and testing element. It does not replace the penetration testing or vulnerability assessments the rule describes.

Backups that get tested. Ransomware at a tax firm is a client-data event and a deadline event at once. Ask any provider how often they restore from backup to prove it works.

Training. Phishing emails land in the same inboxes your staff use for client work. Short, regular training is inexpensive, and the rule expects it.

Vendor records. Someone needs a list of the vendors that touch client data and a copy of what each has agreed to. A provider that keeps those records for you saves your Qualified Individual real time.

What does the small-firm exemption actually cover?

This is the part most often misread, so here is the text. Under 16 CFR 314.6, four provisions do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers: the written risk assessment (314.4(b)(1)), continuous monitoring or annual penetration testing with six-month vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)), and the annual written report to the board (314.4(i)).

Read that list again. The exemption does not mention the Qualified Individual, multi-factor authentication, encryption, training, service provider oversight, or the data disposal rule. Those are not on the exempted list. The FTC notification requirement for breaches of 500 or more consumers is also not on it.

Some firms hear “under 5,000” and conclude the rule is optional for them. It is not. A firm with 800 clients still needs a written information security program, multi-factor authentication, and encryption. What it is excused from is narrower than it sounds. It still has to base its program on a risk assessment; the assessment just does not have to meet the written-assessment requirements. It still has to regularly test or monitor its safeguards; it is excused from the specific continuous-monitoring or penetration-testing schedule. Even so, a basic incident plan is worth writing, because the day you need one is a bad day to draft it.

Also check how you count. The threshold is customer information about consumers, and the count may include more people than your active clients. Ask your attorney how to count for your firm.

What happens after a breach?

The FTC added a notification requirement that took effect in May 2024. If there is a “notification event,” meaning unauthorized acquisition of unencrypted customer information of at least 500 consumers, you must tell the FTC as soon as possible and no later than 30 days after you discover it. The notice covers items such as your firm’s name, the types of information involved, the dates, and the number of consumers affected.

Two practical points. First, the word “unencrypted” matters, which is another reason encryption is not optional in practice. Second, this is a federal notice. Virginia and other states have their own breach laws, and the IRS expects tax professionals to report data theft too, so a real incident has several clocks running at once. Write down who to call before you need to.

What should accounting IT support include?

Use the rule as a checklist when you talk to providers. A provider worth hiring should be able to answer, in plain words and in writing:

Which of your systems hold client information, and how are they protected? Is multi-factor authentication on every account that touches it? Are laptops and backups encrypted? Who gets alerted when monitoring finds a problem? How often are backups restored as a test? What is the offboarding process, and how fast does it run? What do you keep as records, and will we get them if we leave?

Then ask the question that tells you the most: what are you not going to do? A provider who says “we make you compliant” is promising something nobody can promise. The rule puts the program, the decisions, and the accountability on your firm. A provider can build the controls and keep the evidence, which is what readiness means.

Ask about people as well. At Helix Stax, requests go to our own in-house help desk, not a third party. For any provider, ask how a staff member who cannot open a return in the middle of busy season reaches a person, during which hours, and get the answer in the agreement.

Where does Helix Stax fit?

Helix Stax is a managed IT provider in Hampton Roads. For accounting and tax firms our cybersecurity and compliance readiness work helps you put controls like these in place and keep records of them, alongside managed IT services and an in-house help desk for the daily problems. We help with readiness. We do not guarantee compliance with the Safeguards Rule or any other rule, and we do not replace your attorney or your Qualified Individual.

If you want more background on the basics before you talk to anyone, our small business cybersecurity guide and the post on what a cybersecurity assessment covers are good places to start.

Where should a small firm start this month?

Start with three things that cost little and cut the most risk. Turn on multi-factor authentication for email and your practice software. Find out whether every laptop is encrypted. Write down the name of your Qualified Individual and the list of vendors that hold client data.

Then pick the dates. Busy season is a poor time to change systems, so the quiet months are when to fix the rest. If you wait for a slow week in March, you will not get one.

The next step

If you are not sure where your firm stands on multi-factor authentication, encryption, backups, and offboarding, the simplest way to find out is to have someone look. Helix Stax offers a free IT assessment for Hampton Roads businesses. There is no obligation, and you can decide afterward whether managed IT fits.

Book a free IT assessment

Sources

1. FTC, FTC Safeguards Rule: What Your Business Needs to Know. Coverage of tax preparers; Qualified Individual; multi-factor authentication; encryption; disposal; incident response plan; service providers; notification to the FTC for events involving at least 500 consumers, effective May 2024.
2. 16 CFR Part 314 on eCFR: 314.1(b) (tax preparation firms named), 314.2(h)(2)(viii) (an accountant or tax preparation service in the business of completing income tax returns), 314.3(a) (written program), 314.4(a), (b), (c)(3), (c)(5), (c)(6), (d), (f), (h), (i), (j), 314.5 (effective May 13, 2024), and 314.6 (exceptions).
3. IRS, Publication 4557, Safeguarding Taxpayer Data.