The FTC Safeguards Rule for tax and accounting firms: what your software can help with, and what it cannot
The rule asks for a program, a person and a set of controls. Software covers some of the controls.
| Rule | FTC Safeguards Rule, 16 CFR Part 314 |
|---|---|
| Applies to | Tax preparers and many accounting firms |
| Core requirement | A written information security program (WISP) |
| Named person | A Qualified Individual who oversees the program |
| Technical controls | Encryption in transit and at rest, multi-factor authentication, logging |
| Breach notice | To the FTC for 500+ consumers, no later than 30 days after discovery |
| Small-firm relief | Firms with fewer than 5,000 consumers are exempt from some written requirements |
Who does the rule apply to?
The rule covers financial institutions under the FTC’s jurisdiction, and its definition includes businesses that complete income tax returns. In practice, most tax preparers and many accounting firms are covered.
What does the rule require?
- A written information security program with administrative, technical and physical safeguards suited to the firm’s size.
- A Qualified Individual to oversee it.
- Risk assessment, repeated periodically.
- Encryption of customer information in transit over external networks and at rest.
- Multi-factor authentication for anyone accessing information systems.
- Monitoring and logging of user activity.
- Oversight of service providers, including contract terms and periodic review.
- Notice to the FTC of a notification event involving at least 500 consumers, as soon as possible and no later than 30 days after discovery.
What is different for small firms?
Firms that maintain customer information on fewer than 5,000 consumers are exempt from a few written requirements, including the written risk assessment, the written incident response plan and the annual report to the board or owner. The rest of the rule still applies.
What can practice software help with?
- Two-step sign-in for staff, which supports the multi-factor authentication requirement
- Encryption in transit and storage practices on the vendor’s side
- Access control, so staff see only the clients they work on
- Activity records, such as e-signature audit trails and portal activity
- A secure client portal in place of email attachments
- Where and how data is hosted, which you document in your WISP as part of service-provider oversight
What software cannot do for you
No software makes a firm compliant on its own. Your firm still writes and maintains its WISP, names its Qualified Individual, assesses risk, trains staff, manages its own devices and decides how to respond to an incident.
Frequently asked questions
Is BytesHood “Safeguards Rule compliant”?
Compliance belongs to the firm, not the software. BytesHood is built to support the rule’s technical requirements; your firm’s program covers the rest.
Does IRS guidance also apply?
Yes. The IRS asks tax professionals to maintain a written information security plan and publishes guidance such as Publication 5708.
Is this legal advice?
No. It is a general summary; read the rule and consult your own advisor.