ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An FTC Safeguards Rule checklist is a practical list of what a covered business must have in place to protect customer financial information, and the evidence that proves it. The rule is codified at 16 CFR Part 314 and applies to many non-bank financial institutions, including tax preparers, accountants, mortgage brokers and auto dealers.
The FTC summarizes the requirements as nine elements, from designating a Qualified Individual to reporting to the board. Since 13 May 2024, covered firms must also notify the FTC within 30 days of discovering a notification event that involves the information of at least 500 consumers.
This checklist turns those elements into tasks. It is general guidance, not legal advice, and some requirements are relaxed for firms holding information on fewer than 5,000 consumers, so confirm how the exemptions apply to you.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
The rule covers financial institutions under FTC jurisdiction. Tax return preparers, accounting firms that handle client financial data, finance companies, mortgage brokers and many others fall within it. If you collect Social Security numbers, bank details or income information from clients, you should assume it applies and check the definitions.
A common misconception is that small practices are exempt. Some provisions, such as the written risk assessment details, board reporting and incident response plan, are relaxed for firms holding information on fewer than 5,000 consumers, but the core duty to protect information is not optional.
Also note that state law can add requirements, such as the Massachusetts regulation covered in 201 CMR 17 WISP. See who the FTC Safeguards Rule applies to for a full list.
The first item on the FTC Safeguards Rule checklist is to name a Qualified Individual to implement and oversee the program. This can be an employee or, for small firms, a service provider, though you remain responsible for compliance and must supervise the provider.
Record the appointment in writing, including the person’s duties and authority. The role is explained in qualified individual. If a sole practitioner holds the role, say so; the guidance in WISP for sole practitioners shows how to document it.
The Qualified Individual must report in writing to the board or equivalent, at least annually, on the status of the program and material matters. Put the report date in your calendar now.
| Element | What to have | Evidence |
|---|---|---|
| Qualified Individual | Named person overseeing the program | Appointment record |
| Risk assessment | Written assessment of threats and controls | Dated risk assessment |
| Safeguards | Access control, MFA, encryption, disposal | Configuration and policy records |
| Testing | Monitoring, annual pen test, vulnerability scans | Test reports |
| Training and vendors | Staff training, service provider oversight | Attendance logs, contracts |
| Response and reporting | Incident plan, annual board report | Plan, report, notice procedure |
The rule requires a written risk assessment that identifies reasonably foreseeable internal and external risks to customer information, sets criteria for evaluating them and describes how risks will be mitigated. It has to be done before you pick safeguards, not as an afterthought.
Start with an inventory of where customer information lives: tax software, email, file shares, laptops, mobile phones, paper files and cloud storage. For each location, list threats such as phishing, lost devices, insider misuse and vendor breach. Rate each risk and record the safeguard that addresses it.
Update the assessment periodically and after major changes, such as a new software platform or office move. Keep each version with its date.
The rule requires specific safeguards. They include access controls so employees reach only what they need, an inventory of data and systems, encryption of customer information in transit and at rest, secure development practices for in-house applications, multi-factor authentication for anyone accessing an information system, secure disposal of data, change management and logging of authorized user activity.
Encryption and MFA receive the most attention in practice. See FTC Safeguards Rule encryption and MFA for how to apply them and for the allowance for equivalent controls approved in writing by the Qualified Individual.
Disposal is often missed. Customer information must generally be disposed of securely no later than two years after it was last used to serve the customer, unless there is a business or legal reason to keep it, so set retention rules and schedule deletions.
Test your safeguards. The rule calls for continuous monitoring or, failing that, annual penetration testing and vulnerability assessments at least every six months. Keep the reports and the records showing that findings were fixed.
Train staff. Provide security awareness training to all employees and keep attendance records, plus specialized training for those with security roles. Include phishing examples drawn from tax season, when attacks peak.
Oversee service providers. Choose providers who can protect the data, require safeguards by contract and reassess them periodically. The approach is explained in WISP service provider oversight.
Every covered firm should have a written incident response plan that sets goals, roles, communication steps, remediation and documentation, along with post-incident review. Firms with information on fewer than 5,000 consumers have relaxed documentation requirements, but planning still pays off.
The notification duty is specific: if unencrypted information of at least 500 consumers was acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. The details, including what counts as a notification event, are in FTC Safeguards Rule breach notification.
Also check state breach laws and your obligations to affected customers. The FTC rule is one of several notification duties you may face, and deadlines can differ.
The FTC can seek civil penalties and injunctive relief for violations, and firms have faced enforcement over poor safeguards. The overview in FTC Safeguards Rule penalties explains what to expect. Because penalty amounts are adjusted for inflation, check current figures rather than relying on old numbers.
Beyond regulatory risk, tax preparers also face IRS expectations for protecting client data, and a breach can damage client trust.
Good documentation helps in any review. When you can show a dated risk assessment, training logs and test reports, the conversation starts from a stronger position. The FTC publishes its own guidance at FTC Safeguards Rule guide.
Picture a five-person tax practice. It names the managing partner as Qualified Individual, inventories its tax software, email, a file server and three laptops, and writes a short risk assessment. The top risks are phishing during filing season and a lost laptop. Safeguards follow: multi-factor authentication on the tax software and email, full-disk encryption on laptops, a written retention rule that deletes old client folders after the required period and a yearly training session before filing season.
The firm hires a provider to run a vulnerability scan every six months and keeps the reports. It adds a one-page incident plan with phone numbers for the IT provider, the insurer and counsel. Each item on the FTC Safeguards Rule checklist now has an owner, a date and a piece of evidence. The firm is invented for illustration, but the steps are realistic for a small practice.
The most common gap is the risk assessment: firms have a policy but no dated assessment. Next comes multi-factor authentication, which is often applied to email but not to the tax software or remote access. Third is data disposal, because client files pile up for years. Fourth is the vendor list, where firms cannot name every provider holding client data.
A fifth gap is the annual report to the board or owners, which is forgotten because nobody owns it. A sixth is testing: firms buy a scan once and never repeat it. Walk through your FTC Safeguards Rule checklist each quarter during the first year, fix what fails and then move to a twice-yearly review once the habits are in place.
Writing the plan, the policies and the supporting forms from scratch is a large task for a small practice. A prepared set of documents gives you a written information security plan, policies and evidence trackers to edit.
The WISP Toolkit provides 74 editable templates covering the FTC Safeguards Rule in 16 CFR Part 314, including the notification obligation effective 13 May 2024. See written information security plan template for what the core document contains, and FTC Safeguards Rule for tax preparers for sector detail.
Work through the nine elements in order, assigning an owner and a date to each, and keep the completed checklist with your plan.
Non-bank financial institutions under FTC jurisdiction, including tax preparers, accountants, mortgage brokers and many lenders and dealers.
A Qualified Individual, a written risk assessment, safeguards, testing, training, service provider oversight, program updates, an incident response plan and annual board reporting.
As soon as possible and no later than 30 days after discovery of a notification event involving the unencrypted information of at least 500 consumers.
No, but some requirements are relaxed for firms holding information on fewer than 5,000 consumers.
Yes. The program must be in writing, and a written plan is the usual way to document it.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026