FTC Safeguards Rule Checklist for CPAs & Tax Preparers

This checklist covers all 9 updated FTC Safeguards Rule requirements as they apply to CPA firms and tax preparers. Use this as a starting point — then run a Cyber Defense Agent scan to verify your technical controls. The FTC Safeguards Rule applies to every CPA firm and tax preparer in the United States. Over 300,000 tax preparers must comply, and the FTC has actively pursued enforcement actions against accounting practices.

Designate someone to oversee your information security program. For small CPA firms, this is typically the managing partner or a qualified IT provider. Action items: - Formally designate your Qualified Individual in writing - Document their qualifications and responsibilities - If outsourcing, ensure the third party is contractually obligated - This person must report to the board/partners at least annually

Perform a written risk assessment identifying threats to client financial data. Action items: - Inventory all systems that store or process client data (practice management, email, file storage) - Identify internal risks (employee access, lost devices) - Identify external risks (phishing, ransomware, unauthorized access) - Assess likelihood and impact of each risk - Document current safeguards and identify gaps - Run a Cyber Defense Agent scan to identify external technical risks automatically

Based on your risk assessment, implement controls for identified risks. Action items: - Enable MFA on all systems accessing client data - Encrypt client data at rest and in transit - Implement email authentication (SPF/DKIM/DMARC) - Configure access controls (least privilege) - Deploy endpoint protection (EDR/antivirus) - Secure your website with proper TLS configuration - Implement a firewall and network segmentation

Continuously monitor your safeguards and test them regularly. Action items: - Use Cyber Defense Agent for continuous external monitoring (weekly/daily scans) - Conduct annual penetration testing or continuous monitoring - Perform biannual vulnerability assessments - Review access logs regularly - Test incident response procedures annually

Complete the remaining requirements: 5. Train all employees on security awareness, with specialized training for the Qualified Individual. 6. Monitor service providers (cloud software, IT providers) — require contractual security obligations. 7. Keep your security program current — review and update when operations, threats, or vulnerabilities change. 8. Create a written incident response plan — include detection, containment, notification, and recovery procedures. 9. Report to partners/board annually on the overall status of the security program, including material matters and recommendations.