Does the FTC Safeguards Rule apply to our tax or accounting firm?
If you prepare tax returns, very likely yes. The FTC lists tax preparation firms among the non-bank financial institutions covered by the rule, and the IRS states that tax and accounting professionals must have a written information security plan under federal law. Firms that keep data on fewer than 5,000 consumers are exempt from some provisions, such as the written risk assessment and the annual report, but not from the rule itself. Your counsel confirms the details for your firm.
What must a written information security program contain?
Under the FTC Safeguards Rule it names a Qualified Individual, is based on a written risk assessment and describes the safeguards in place. These include access controls, a data inventory, encryption, multi-factor authentication, secure disposal, change management, monitoring of user activity, staff training, oversight of service providers, regular testing and a written incident response plan. The Qualified Individual reports in writing at least once a year to the board or a senior officer.
Can FNLY IT be our Qualified Individual?
The rule allows the Qualified Individual to work for a service provider. Your firm then remains responsible for compliance, must designate a senior person to oversee the provider and must require the provider to maintain a suitable program. We can take on this role in the Complete plan, or support your own Qualified Individual with the technical work.
What happens if customer data is stolen?
Under the FTC Safeguards Rule, you must notify the FTC no later than 30 days after discovery if unencrypted information of 500 or more consumers was acquired without authorization. Regulation S-P requires notice to affected customers within 30 days for covered SEC-registered firms, and state breach laws can require notices to individuals and state agencies. We contain the incident, secure the evidence and give your counsel the technical facts for the notices.
We are a registered investment adviser. What changed under Regulation S-P?
The 2024 amendments require a written incident response program, written policies for overseeing service providers and notice to affected customers within 30 days. Service providers must tell you within 72 hours if a breach affects a system they maintain for you. Larger advisers had to comply by December 3, 2025, and advisers with less than $1.5 billion in assets under management by June 3, 2026. We commit to the 72-hour notice in our contract.
Does NYDFS Part 500 apply to us?
It applies to entities licensed or chartered by the New York Department of Financial Services, such as many banks, insurers, lenders and money transmitters. Since November 1, 2025 it requires multi-factor authentication for access to information systems and written asset inventory procedures, with limited exemptions for small entities. If you are not licensed by NYDFS, it does not apply directly, but customers or partners may still ask for similar controls.
How do you work with our auditors and compliance officer?
Openly. We give them access to our documentation, answer their technical questions and fix findings in the agreed timeframe. Because we document during the work, most evidence already exists when they ask for it.
What does this cost for a small firm?
Managed IT costs $99, $149 or $219 per user per month, with a minimum of 5 users. Financial firms usually choose Standard or Complete, because multi-factor authentication, conditional access and documentation are included, and Complete adds compliance support and a dedicated contact. Onboarding for up to 25 users costs $2,500 one time.
