Who’s covered by the FTC Safeguards Rule?

The FTC Safeguards Rule serves to safeguard consumers’ sensitive personal information held by financial service firms.

This mandate extends to Certified Public Accountants (CPAs) who handle such data during their professional services.

Adhering to the FTC Safeguards Rule not only protects consumers’ privacy, but also fosters trust in the CPA profession by ensuring the security of client information.

CPAs are required to establish and maintain comprehensive information security programs to ensure the confidentiality and integrity of client information.

This includes protecting data such as financial records, tax returns, and other confidential documents from unauthorized access or disclosure.

accountant-tax-preparation-service

Accountant or
Tax Preparation Service

What does the Safeguards Rule require companies to do?

Safeguards designed to protect customer information

develop

Develop

implement

Implement

maintain

Maintain

administrative

Administrative

technical

Technical

physical

Physical

What Customer Information needs to be protected?

“any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates.”

Your information security program must be written and it must be appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information at issue.

Cybersecurity & Compliance for CPA Firms | CyberGryphon

What are the requirements of “Information security program”?

7 elements that your company’s information security program must include:

qi
Designate a (QI) to implement and supervise an information security program. The QI maybe an MSSP.
monitor test
Regularly monitor and test the effectiveness of your safeguards.
cpa risk assessment
Design and implement safeguards to control the risks identified through your risk assessment.
qi bod
Require your Qualified Individual to report to your Board of Directors.
security program
Keep your information security program current.
security awareness training
Keep your information security program current.
incident response plan
Create a written incident response plan.
IRS WISP Guide

Find how Cyber Gryphon can help you become compliant, InExpensively!

Schedule Demo