FTC Safeguards Rule Checklist for CPA Firms, Tax Preparers and Auto Dealers

Double Technologies

42 minutes ago

5 min read

If your business prepares tax returns, or sells cars and arranges the financing, the federal government considers you a financial institution. That surprises a lot of owners. It also means the Federal Trade Commission's Safeguards Rule applies to you, whether you run a two-person tax office in Levelland or a busy dealership in Lubbock, Amarillo or Midland-Odessa.

This checklist walks through what the rule requires in plain English, so you can see where you stand. It's general information, not legal advice. Your attorney or compliance adviser should have the final word on how the rule applies to your business.

Who the Safeguards Rule covers

The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It applies to businesses the FTC oversees that are "significantly engaged" in financial activities. In its small business guide to the rule, the FTC lists examples that include mortgage brokers, finance companies, collection agencies, investment advisers that aren't required to register with the SEC, and tax preparation firms.

For two common West Texas business types, the picture is clear:

CPA firms and tax preparers. The IRS says that under the Gramm-Leach-Bliley Act and the Safeguards Rule, tax and accounting professionals are considered financial institutions regardless of size (IRS Publication 5708). The PTIN application and renewal form also asks preparers to acknowledge that they're required by law to keep a written information security plan (Form W-12 instructions).
Auto dealers. The FTC says the rule covers most dealers that finance or lease vehicles. Dealers that finance or help arrange financing count as financial institutions, and so do dealers that lease vehicles for longer than 90 days (FTC auto dealer FAQs).

The rule protects "customer information," meaning nonpublic personal financial information, whether it's on a computer, in email or in a paper file.

The nine required elements

The core of the rule is section 314.4, which lists nine things your written information security program has to include. Use these as your checklist.

1. Name a Qualified Individual

One person has to be in charge of your security program. The FTC says that person doesn't need a particular degree or title, and they can be an employee or work for an outside provider. If you use an outside provider, your business still has to designate a senior employee to oversee them.

2. Do a written risk assessment

Start with an inventory of what customer information you have and where it lives: tax software, the dealer management system, email, file shares, scanners, laptops and paper files. Then write down the foreseeable risks to that information and the criteria you use to judge them. The rule expects you to revisit this when your operations change or new threats show up.

3. Put safeguards in place

The rule names specific safeguards. Check each one:

Access controls, reviewed regularly, so people only reach the customer data their job requires.
A current inventory of data, systems, devices and the people who use them.
Encryption of customer information stored on your systems and sent over networks.
A process for checking the security of the apps you use to handle customer data.
Multifactor authentication for anyone accessing customer information on your systems.
Secure disposal of customer information no later than two years after you last used it to serve the customer, unless you have a legitimate business need or legal reason to keep it.
Change management, so a new server, software package or network change doesn't quietly open a hole.
Logging of authorized users' activity and monitoring for unauthorized access.

4. Monitor and test regularly

You have two paths. You can continuously monitor your systems, or you can do annual penetration testing plus vulnerability scans at least every six months. In practice, continuous monitoring usually means tools such as a SIEM, which collects and reviews security logs in one place, and IDS/IPS, which detect and block suspicious network traffic.

5. Train your staff

Everyone who touches customer information needs security awareness training, with regular refreshers. Keep dated attendance records.

6. Oversee your service providers

Pick vendors who can protect your data, put your security expectations in their contracts, and check on them periodically. That includes your tax software vendor, your dealer management system provider, your cloud storage and your IT provider.

7. Keep the program current

Update your program when you add a location, switch software, change staff or learn something from a risk assessment.

8. Write an incident response plan

The plan has to cover its goals, who does what, who makes decisions, how you communicate inside and outside the business, how you fix weaknesses, how you document what happened, and how you review and improve the plan afterward.

9. Report to leadership at least once a year

Your Qualified Individual has to report in writing at least annually to your board. If you don't have one, the report goes to a senior officer responsible for the program. It should cover overall compliance, risk decisions, test results, security events and recommended changes.

The small-firm exception, and what it doesn't cover

If your business keeps customer information on fewer than 5,000 consumers, section 314.6 exempts you from four items: the written risk assessment, the penetration testing and vulnerability scanning requirement, the written incident response plan, and the annual written report.

Everything else still applies. A small tax office still needs a Qualified Individual, multifactor authentication, encryption, access controls, secure disposal, training, vendor oversight and a written program. Count carefully, too. Ten years of client files can add up faster than you'd expect.

Breach reporting to the FTC

Since May 13, 2024, covered businesses must notify the FTC as soon as possible, and no later than 30 days after discovery, when a breach involves unencrypted information of at least 500 consumers. The report is filed through the FTC's online form. Texas businesses also have separate notification duties under state law, so a breach can mean more than one report.

Your Safeguards Rule document checklist

If the FTC, your cyber insurer or a client asked tomorrow, could you produce these?

The name of your Qualified Individual and the senior employee overseeing them, if that person is outside the company.
Your written information security program. Tax offices can start from the template in IRS Publication 5708.
A written risk assessment and data inventory, unless you qualify for the small-firm exception.
Proof that multifactor authentication is turned on for email, remote access and line-of-business software.
Encryption settings for laptops, servers, backups and email.
An access review log showing who has access to what.
Monitoring records, or penetration test and vulnerability scan reports.
Staff training dates and attendance.
Vendor contracts with security terms.
An incident response plan and notes from a practice run.
Your annual report to leadership.

Local help for West Texas offices

Tax season and busy sales months leave little time for paperwork. The technical safeguards are where an IT partner can help the most, and the records those safeguards produce become a big part of your evidence.

Double Technologies works with small and mid-size businesses across Lubbock and West Texas, with 30 years of combined experience. Our cybersecurity services in Lubbock cover multifactor authentication, endpoint protection and email security, and our managed firewall and security monitoring includes SIEM and IDS/IPS. If you run a CPA firm, tax practice or other finance-related business, see our page on IT and cybersecurity for financial services. If you'd like help planning where to start, our IT consulting services can map out what you have today and what to tackle first.

Want to talk through where your office stands on the Safeguards Rule? Call us at (806) 319-8521. We can come to you in Lubbock and across West Texas. We're available Monday through Friday from 8 AM to 7 PM and Saturday from 9 AM to 5 PM Central.

This article is general information about the FTC Safeguards Rule and isn't legal advice. Talk with your attorney or compliance adviser about how the rule applies to your business.