Qualified Individual
One person oversees and enforces the program. It can be an employee or someone at a service provider, as long as a senior person at your firm supervises them.
For tax, accounting, mortgage and lending firms
The FTC Safeguards Rule in your ITCustomer data, protected and documented
The Safeguards Rule under the Gramm-Leach-Bliley Act requires non-bank financial institutions to run a written information security program. That includes tax preparers, CPA firms that prepare returns, mortgage brokers and many lenders. We implement the technical safeguards, such as MFA and encryption, and help you build the documentation the rule asks for.
Who the rule applies to
The Safeguards Rule, 16 CFR Part 314, applies to financial institutions under FTC jurisdiction that are not banks. The FTC lists examples such as tax preparation firms, mortgage lenders and brokers, payday lenders, finance companies, collection agencies, credit counselors, financial advisors and investment advisors that are not required to register with the SEC. Car dealers that arrange financing or leases are covered as well.
What counts is the activity, not the label. A CPA firm that prepares tax returns, or an insurance agency that also arranges financing, can fall under the rule. If you are not sure, your legal counsel can tell you. The IRS also expects paid tax preparers to have a written information security plan.
The nine elements of your security program
Written risk assessment
You identify risks to customer information in writing, with criteria for evaluating them, and repeat the assessment periodically.
Safeguards
Access controls, a data inventory, encryption in storage and in transit, multi-factor authentication for anyone who accesses customer information, secure disposal, change management and activity logging.
Monitoring and testing
Continuous monitoring, or else an annual penetration test and a vulnerability scan at least every six months.
Staff training
Security awareness training for all staff and specific training for people who run the security program.
Service provider oversight
You choose providers that can protect the data, require safeguards in the contract and review them periodically.
Keeping the program current
You adjust the program when your business, systems or risks change.
Incident response plan
A written plan that sets goals, roles, communication, remediation and documentation for a security event.
Report to the board
The Qualified Individual reports in writing at least once a year to the board or, if there is none, to a senior officer.
Notice to the FTC within 30 days
Since May 2024 you must notify the FTC when unencrypted customer information of at least 500 consumers is acquired without authorization. The notice goes through the FTC online form as soon as possible and no later than 30 days after discovery. Information counts as unencrypted if the encryption key was also compromised. Consistent encryption is the best way to avoid this situation.
Smaller firms get some relief
If you hold customer information on fewer than 5,000 consumers, four requirements do not apply:
| Written risk assessment | Not required in writing, but you still need to assess risks |
| Continuous monitoring or annual penetration test | Not required |
| Written incident response plan | Not required |
| Annual written report to the board | Not required |
All other elements apply to every covered firm, including MFA, encryption, training and service provider oversight.
What the rule means in daily IT
These are the technical points we set up and document most often:
- MFA for email, remote access, tax and accounting software and every admin account
- Encryption of laptops, file shares, backups and email that contains customer data
- An inventory of where customer information is stored, including cloud services and portals
- Access rights based on job role, removed promptly when someone leaves
- Logging of who accessed customer information, kept for review
- Regular vulnerability scans and patching on a fixed schedule
- Secure disposal of customer information no later than two years after the last use, unless you have a business or legal reason to keep it
How we work with you
- 01
Security check
We review your IT against the nine elements for a fixed $2,950. Larger firms start with a security assessment from $7,900, which we credit toward the follow-up project.
- 02
Plan
You receive a list of gaps ordered by risk, with an estimate of the effort and a draft structure for your written program.
- 03
Implementation
We set up MFA, encryption, logging, backup and access rights, and we provide the technical input for your risk assessment and incident response plan.
- 04
Ongoing support
We run the safeguards, document changes and supply the technical facts your Qualified Individual needs for the annual report.
Experience in financial services
Banking · 250 users, Germany
Design and rollout of a new IT service management solution in close cooperation with the bank. We supported the project from implementation through go-live into post-launch support.
Result: Twelve months from project start to go-live, followed by a phase of close support in daily operation.
Updated:
FAQ
Frequently asked questions
Does the FTC Safeguards Rule apply to my tax or accounting firm?
If your firm prepares tax returns or offers other financial services to consumers, it is likely a financial institution under the rule. The FTC names tax preparation firms explicitly. Whether your specific services are covered is a question for your legal counsel.
What is a Qualified Individual?
It is the person responsible for overseeing and enforcing your information security program. It can be an employee or a person at a service provider. If you use a service provider, you remain responsible, and a senior member of your firm must supervise that person.
Is MFA required?
Yes. The rule requires multi-factor authentication for any individual accessing any information system that holds customer information. The only alternative is an equally secure access control that your Qualified Individual approves in writing.
When do we have to notify the FTC?
When unencrypted customer information of at least 500 consumers is acquired without authorization. You must file the notice through the FTC online form as soon as possible and no later than 30 days after discovery. This requirement has applied since May 2024. State breach laws may add separate duties toward customers.
Are small firms exempt?
Partly. Firms that hold customer information on fewer than 5,000 consumers do not need a written risk assessment, continuous monitoring or penetration testing, a written incident response plan or the annual board report. All other safeguards, including MFA and encryption, still apply.
Can FNLY IT act as our Qualified Individual?
We implement and run the technical safeguards and provide the reports and evidence your Qualified Individual needs. Who takes on that role in your firm, and how it is supervised, is a decision for your management together with your legal counsel.
FTC Safeguards Rule
Let us review your safeguards
Tell us what your firm does and which systems hold customer data. We will show you which of the nine elements are in place and which ones still need work.