The Federal Trade Commission's Safeguards Rule, 16 CFR Part 314, is the data-security regulation most CPA firms have not mapped to their own practice. It reaches firms that prepare tax returns, and it contains specific duties for the vendors those firms use. A firm that sends client data to a staffing partner, an offshore team or a cloud tool has obligations under the rule for each of them.
Who the rule covers
Section 314.1 applies the rule to financial institutions under FTC jurisdiction. Section 314.2(h) defines a financial institution as an entity significantly engaged in financial activities, and its list of examples includes tax preparation firms. The rule covers customer information, defined in 314.2 as any record in any format containing nonpublic personal information about a customer of a financial institution, handled by or on behalf of the firm or its affiliates.
A firm that prepares individual or business returns holds that information: Social Security numbers, bank account numbers, income detail. Treat the tax practice as in scope and design one security program for the whole firm, because the same network and the same vendors serve the audit practice.
Effective dates
The FTC amended the rule in 2021 and extended the compliance date for most of the amended provisions to June 9, 2023 (FTC press release, November 2022). The breach notification requirement in 314.4(j) took effect on May 13, 2024. Both dates are in the past, and all current requirements apply today.
The information security program
Section 314.4 requires a written information security program. The FTC's guidance lists its elements:
- A Qualified Individual who oversees the program. The role can be filled by an employee, or by a service provider's or affiliate's staff member, but the firm remains responsible for supervising that person.
- A written risk assessment with evaluation criteria, reassessed periodically.
- Safeguards: access controls, a data inventory, encryption of customer information in transit and at rest or approved alternatives, multi-factor authentication, secure disposal of data within two years of last use, change management and activity logging.
- Testing: continuous monitoring, or annual penetration testing plus vulnerability scans every six months.
- Training: security awareness for all staff, and specialized training for staff with hands-on security duties.
- Incident response: a written plan covering goals, roles, communications, remediation, documentation and post-incident review.
- Board reporting: the Qualified Individual reports in writing at least annually to the board or a senior officer. Where the firm has no board, the report goes to a senior officer.
The firm's WISP, its written information security program, is the document that holds these elements. Smaller firms use a template, and the work that matters is filling it with the firm's actual systems, vendors and owners.
Small-firm exemptions
Section 314.6 exempts institutions that maintain customer information on fewer than 5,000 consumers from several provisions: 314.4(b)(1), (d)(2), (h) and (i). Those cover the written risk assessment, the testing requirement, the written incident response plan and the board report. The exemption does not reach 314.4(f), the service provider duty, or 314.4(j), the FTC notice. Every firm, whatever its client count, oversees vendors and notifies the FTC of qualifying events.
Service provider oversight: 314.4(f)
Section 314.4(f) sets three duties for the firm's service providers:
- Select providers capable of maintaining appropriate safeguards for the customer information at issue.
- Require by contract that the provider implements and maintains those safeguards.
- Assess periodically the provider.
For a CPA firm, the service providers are the tax software host, the document portal, the cloud storage, the IT support firm, any offshore or contract preparers and any workpaper-preparation partner. Each one gets a row in a vendor register with: data touched, location, contract date, the security terms in the contract, the evidence the firm reviewed, the date of the last assessment and the next one.
The contract clauses mirror the ones the AICPA confidentiality interpretation calls for. The list in ET 1.700 confidentiality and client data offshore works for both: use limits, security controls, incident notice, subcontractor controls, return and deletion, and assurance rights. One contract serves both regimes.
Periodic assessment needs evidence. Ask for an independent assurance report where one exists, and read it: SOC 1, SOC 2 and SOC 3 differ in subject and audience. Where no report exists, use a security questionnaire and a documented call. File the conclusion each year.
The 30-day FTC notice: 314.4(j)
A notification event under 314.2 is the acquisition of unencrypted customer information without the authorization of the individual. Unauthorized acquisition is presumed unless the firm has reliable evidence to the contrary. When a notification event involves at least 500 consumers, section 314.4(j) requires the firm to notify the FTC electronically as soon as possible and no later than 30 days after discovery. The FTC may make reports public. A law enforcement official may request a delay of the notice for up to 30 days.
Write the 30-day clock into the incident response plan and into every vendor contract. Section 314.4(j) counts the 30 days from discovery of the event, so a long vendor notice period eats into the firm's window. A contract that gives the vendor 30 days to tell the firm leaves the firm no time. Require notice within a short fixed period, such as 72 hours, and count it as part of the firm's plan.
How this fits with the other rules
- Tax data: IRC 7216 limits disclosure of tax return information and requires written consent for disclosure to a preparer outside the United States. See Section 7216 consent for offshore tax return preparation.
- Ethics: the AICPA third-party service provider interpretations cover notice, qualification and confidentiality. See the offshore ethics overview.
- Circular 230: section 10.36 requires adequate firm procedures. See Circular 230 section 10.35 and delegation.
- Quality management: for audit practices, SQMS 1 treats service provider resources as part of the firm's system. See the outsourced audit support guide.
Sources
- 16 CFR Part 314, Standards for Safeguarding Customer Information (sections 314.1, 314.2, 314.4(f), 314.4(j), 314.5, 314.6; 314.5 gives May 13, 2024 for 314.4(j)) on eCFR: https://www.ecfr.gov/current/title-16/part-314
- FTC, FTC Safeguards Rule: What Your Business Needs to Know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- FTC press release, "FTC Extends Deadline by Six Months for Compliance with Some Changes to Financial Data Security Rule" (November 2022; new date June 9, 2023): https://www.ftc.gov/news-events/news/press-releases/2022/11/ftc-extends-deadline-six-months-compliance-some-changes-financial-data-security-rule
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error