What the FTC Safeguards Rule means for your CPA practice

Accounting practices are often surprised to learn that the FTC treats them as financial institutions under the Gramm-Leach-Bliley Act. The Safeguards Rule then requires a written information security program, and the 2021 amendments made that program considerably more specific.

The nine elements you need in writing

A designated qualified individual, a written risk assessment, controls designed to meet the risks you identified, regular testing and monitoring, staff training, oversight of service providers, an incident response plan, periodic evaluation, and a written report to your leadership at least annually. Practices below the 5,000-customer threshold have some relief on the continuous monitoring requirement, but not on the program itself.

Where practices fall short

In our reviews, the gaps cluster predictably: no documented risk assessment, no vendor contracts with security terms, no tested incident response plan, and no record of training. These are paperwork failures rather than technology failures, which means they are cheap to fix and expensive to explain to a regulator.

Build it once, maintain it lightly

A compliance calendar is the difference between a program and a scramble. We maintain the evidence — patching records, backup test logs, training completions, vendor reviews — in one place, and produce an annual report your managing partner can sign without a week of archaeology.

If your practice has grown past ten staff and you have not looked at this since 2023, a two-hour review will tell you where you stand.