Managed IT Services
When this guide was first published in 2023, the FTC Safeguards Rule requirements were brand new and most New Jersey accounting firms, tax preparers, and mortgage brokers were scrambling toward a June 9, 2023 deadline. That deadline is long past. The rule is fully in force, the FTC has added a breach-notification requirement, and examiners, cyber insurers, and clients now expect a documented program rather than good intentions. This updated guide explains exactly what the rule requires, who it covers, and how a small firm meets each element without hiring a security department.
If you want the short version, our FTC Safeguards Rule compliance service page has an interactive 10-step checklist and a printable PDF. This article is the detailed companion: the nine required elements, the exemption for smaller firms, the breach reporting rule, and what an FTC Safeguards Rule compliance program looks like in practice for a New Jersey business.
What the FTC Safeguards Rule Is
The Safeguards Rule (16 CFR Part 314) was issued under the Gramm-Leach-Bliley Act of 1999. It requires “financial institutions” under the FTC’s jurisdiction to develop, implement, and maintain a comprehensive written information security program that protects customer information. The original 2003 version was short on specifics. The 2021 amendments, which took full effect in June 2023, replaced broad principles with concrete FTC Safeguards Rule requirements such as multi-factor authentication, encryption, a designated Qualified Individual, and written risk assessments. A further amendment effective May 2024 added mandatory breach reporting to the FTC.
“Customer information” means any record containing nonpublic personal information about a customer, in paper, electronic, or any other form, that you handle or that is handled on your behalf. For a CPA firm, that is every tax return, bank statement, and payroll file. For a mortgage broker, it is every application. The full regulation and the FTC’s own guidance are available at the FTC’s Safeguards Rule business guidance page.
Who Must Meet the FTC Safeguards Rule Requirements
The term “financial institution” is much broader than banks, which are regulated separately. Under the FTC’s definition it includes any business significantly engaged in financial activities, such as:
- Tax return preparers and accounting firms that prepare returns or handle client financial records
- Mortgage brokers and lenders, including non-bank lenders and loan servicers
- Automobile dealers that arrange or extend financing
- Real estate appraisers and settlement services
- Collection agencies and debt relief or credit counseling services
- Payday and short-term lenders
- Investment advisors not registered with the SEC and certain financial planners
- Finders, meaning businesses that bring together buyers and sellers of financial products, which can include some fintech and marketplace platforms
Across Essex, Morris, Bergen, and Passaic counties, the firms we see most often caught by the rule without realizing it are small CPA practices, enrolled agents, independent mortgage brokers, and title and settlement companies. If your business touches consumer financial information as part of its core service, assume the FTC Safeguards Rule requirements apply and confirm with counsel if you are unsure.
The 9 FTC Safeguards Rule Requirements Explained
Section 314.4 of the rule lays out nine elements every covered business must build into its information security program. Here is what each one means for a small or mid-sized firm.
1. Designate a Qualified Individual
One person must own the program under the FTC Safeguards Rule requirements. The Qualified Individual can be an employee, a service provider, or an affiliate, but your business keeps the responsibility and must oversee them. Small firms often fill this role through a managed IT or compliance provider acting as a fractional security officer. Whoever it is should be named in writing.
2. Conduct a written risk assessment
The FTC Safeguards Rule requirements call for a written assessment that identifies where customer information is stored, transmitted, and processed; the internal and external risks to it; and the controls in place to address those risks. The assessment has to be written, must describe your criteria for evaluating risk, and must be repeated periodically. A security risk assessment performed annually satisfies this element and feeds the rest of the program.
3. Implement specific safeguards
This is the heart of the FTC Safeguards Rule requirements and the section most IT work falls under. The rule names eight controls:
- Access controls that limit each user to the customer information their job requires, reviewed periodically.
- A data inventory identifying what customer information you hold, where it lives, and which systems and people touch it.
- Encryption of customer information in transit over external networks and at rest. If encryption is infeasible, the Qualified Individual must approve an equivalent control in writing.
- Secure development practices for any software you build or customize that handles customer data.
- Multi-factor authentication for any individual accessing any information system that holds customer information. See our guide to MFA for small business.
- Secure disposal of customer information no later than two years after its last use for the purpose it was collected, unless retention is required by law or a legitimate business need, plus periodic review of retention policies.
- Change management procedures so that new systems, software, and network changes are evaluated for security impact.
- Monitoring and logging of authorized users’ activity to detect unauthorized access or use of customer information.
4. Test and monitor the safeguards regularly
The FTC Safeguards Rule requirements give you a choice: implement continuous monitoring of your systems or, if you do not, perform annual penetration testing and vulnerability assessments at least every six months and whenever there is a material change. For most small firms, a managed detection and response service plus scheduled vulnerability scanning is the practical way to meet this element.
5. Train staff and keep security personnel current
Under the FTC Safeguards Rule requirements, all personnel need security awareness training, updated as risks change, and the people running the program need enough ongoing education to keep up with threats. Documented training with dates and attendance is what an examiner will ask for.
6. Oversee service providers
You must select providers capable of protecting customer information, require those protections by contract, and periodically assess them. That covers your tax software vendor, cloud document portal, email provider, IT company, payroll service, and shredding company. Keep a vendor list with the agreement and the date of last review for each.
7. Evaluate and adjust the program
The FTC Safeguards Rule requirements expect the program to change as your business, technology, and threats change. In practice this means revisiting the risk assessment and the written program at least annually and after any significant event.
8. Maintain a written incident response plan
The plan must state its goals, the internal processes for responding, roles and decision-making authority, communications and information sharing, how weaknesses will be remediated, how the incident will be documented, and how the plan will be revised afterward. Our article on what to do after a cyberattack maps to this structure.
9. Report to the board or senior management annually
The Qualified Individual must deliver a written report at least once a year covering the overall status of the program, compliance with the rule, risk assessment results, testing results, security events, service provider arrangements, and recommended changes. For a small firm without a board, the report goes to the owner or managing partner and is kept on file.
The FTC Safeguards Rule Breach Notification Requirement
The newest of the FTC Safeguards Rule requirements is the Safeguards Rule breach notification obligation. Since May 13, 2024, covered businesses must notify the FTC of a “notification event” involving the unencrypted customer information of 500 or more consumers. A notification event is the unauthorized acquisition of unencrypted customer information, and the clock runs from discovery: the report is due as soon as possible and no later than 30 days after the event is discovered. It is filed through an online form on the FTC’s website and includes the type of information involved, the date or date range, the number of consumers affected, and a description of the event.
The FTC publishes these reports, which means a breach becomes public record. This requirement sits on top of New Jersey’s own breach notification statute and any obligations to clients, so your incident response plan should list every party that must be told and the deadline for each.
The Under-5,000-Consumer Exemption
Businesses that maintain customer information on fewer than 5,000 consumers are exempt from four of the nine FTC Safeguards Rule requirements: the written risk assessment, the continuous monitoring or annual penetration testing requirement, the written incident response plan, and the annual written report. Everything else still applies, including the Qualified Individual, the eight specific safeguards (MFA, encryption, access controls, disposal, logging, and the rest), training, and service provider oversight.
Two cautions. First, “consumers” counts people, not clients, over time; a tax practice with 1,500 returns a year that keeps records for seven years can pass 5,000 quickly. Second, exempt firms still need to protect customer information in practice, and most find that doing the exempt items informally, a simple risk assessment and a one-page incident plan, is cheaper than explaining their absence after a breach.
Penalties and Enforcement
The FTC enforces the Safeguards Rule through investigations and consent orders. A typical order requires a comprehensive security program, independent third-party assessments every two years for twenty years, and compliance reporting to the FTC. Violating an order triggers civil penalties that adjust annually for inflation and now exceed $50,000 per violation. Beyond the FTC, a failure to meet the FTC Safeguards Rule requirements can be cited by state attorneys general, used against you in client lawsuits after a breach, and relied on by a cyber insurer to deny a claim. For tax preparers, the IRS separately expects a Written Information Security Plan and can revoke e-file privileges.
How to Build an FTC Safeguards Rule Compliance Program in 90 Days
The FTC Safeguards Rule requirements look long, but they map cleanly onto a short project when the right pieces are already in place. This is the FTC Safeguards Rule compliance program sequence we use with New Jersey firms.
- Days 1 to 15: Assign and assess. Name the Qualified Individual. Build the data inventory. Complete the written risk assessment.
- Days 16 to 45: Close the technical gaps. Enforce MFA everywhere, confirm encryption on devices, email, and storage, tighten access permissions, enable logging and monitoring, and set up vulnerability scanning.
- Days 46 to 70: Write and train. Document the written information security program and the incident response plan. Deliver and record staff training. Collect vendor agreements and build the vendor list.
- Days 71 to 90: Test and report. Run the first vulnerability assessment or penetration test, walk through the incident plan as a tabletop exercise, and deliver the first annual report to ownership.
Our WISP compliance services cover the documentation half of that plan, and our IT support for accounting firms covers the technical half.
What Evidence an Examiner, Insurer, or Client Will Ask For
Meeting the FTC Safeguards Rule requirements is only half the job; proving it is the other half. Whether the request comes from an FTC investigator after a complaint, a cyber insurance underwriter at renewal, a bank partner’s vendor review, or a prospective client’s due diligence, the documents requested are remarkably consistent:
- The written information security program, with the Qualified Individual named and a revision date within the last year.
- The most recent written risk assessment and the data inventory it is based on.
- Evidence of MFA enforcement, usually a screenshot or export from Microsoft 365 or your identity provider showing coverage for all users.
- Encryption status reports for laptops and desktops, and confirmation that email and client portals use TLS.
- Access review records showing who has access to customer information and when it was last reviewed.
- Vulnerability scan and penetration test reports, or evidence of continuous monitoring.
- Training logs with dates, content, and attendance.
- The vendor list with signed agreements and review dates.
- The incident response plan and notes from the most recent tabletop exercise.
- The annual report to ownership or the board.
Keep these in a single compliance folder, updated on a schedule, and the FTC Safeguards Rule requirements become a routine rather than a scramble every time someone asks.
Common Gaps We Find at New Jersey Firms
When eMDTec assesses a firm that believes it already meets the FTC Safeguards Rule requirements, the same handful of gaps appear again and again:
- No named Qualified Individual. Everyone assumes the IT company has it covered, but nothing in writing says so.
- A WISP template downloaded and never customized, describing controls the firm does not actually have.
- MFA on email but not on the tax software, the client portal, or the remote desktop server.
- Client documents sent and received as email attachments instead of through an encrypted portal.
- Returns from 2012 still on the server because nobody set a retention and disposal schedule.
- Seasonal staff onboarded without training and offboarded without their accounts being disabled.
- No logging retained, so when something looks wrong there is no way to tell what happened.
- Vendor contracts that say nothing about security, especially with smaller software and shredding vendors.
None of these is expensive to fix. Each is expensive to explain after a breach.
What Meeting the FTC Safeguards Rule Requirements Costs
For a firm already running Microsoft 365 Business Premium with business-class computers, most of the technical FTC Safeguards Rule requirements are configuration rather than new purchases: MFA, Conditional Access, BitLocker, audit logging, and retention policies are included. The incremental costs are typically endpoint detection and response on each device, vulnerability scanning or monitoring, a secure client portal if you do not have one, and the professional time to write the program, run the risk assessment, and train staff. Spread across a year, a 10- to 25-person firm usually finds the full program costs less than a single month of a managing partner’s billable time, and far less than the first day of a breach response.
FTC Safeguards Rule Requirements: Frequently Asked Questions
Does the FTC Safeguards Rule apply to CPA firms?
Yes. The FTC Safeguards Rule requirements apply if the firm prepares tax returns or otherwise handles consumer financial information as part of its services. Most CPA firms, enrolled agents, and bookkeeping practices are covered.
Can our IT provider be the Qualified Individual?
Yes. The rule allows a service provider to fill the role, but your business must designate a senior person to oversee them and retains responsibility for compliance.
Is MFA required for everyone or just administrators?
Everyone. The FTC Safeguards Rule requirements call for MFA for any individual accessing any information system that contains customer information, which in practice means every employee with email or access to client files.
What counts as encryption in transit and at rest?
TLS for email and web traffic, encrypted client portals instead of email attachments for documents, full-disk encryption such as BitLocker on every computer, and encryption of cloud storage and backups.
How is the Safeguards Rule different from an IRS WISP?
The IRS requires tax professionals to have a Written Information Security Plan and points to the Safeguards Rule as the standard. A program that meets the FTC Safeguards Rule requirements will satisfy the IRS WISP expectation; the WISP is essentially the written form of the program.
Get Your Safeguards Program Documented and Enforced
The FTC Safeguards Rule requirements are specific, but they are achievable for a small firm with the right partner. eMDTec has helped New Jersey accounting firms, tax preparers, mortgage brokers, and financial services businesses build and maintain Safeguards programs since the rule was amended, serving as Qualified Individual where needed and delivering the MFA, encryption, monitoring, and documentation the rule demands, as part of our financial services IT support and managed IT services. Schedule a free consultation and we will assess your current program against all nine elements.