Compliance · FTC Safeguards
FTC Safeguards Rule requirements, explained
The FTC Safeguards Rule requires non-bank financial institutions, including tax preparers, to run a written information security program with specific elements such as a qualified individual, risk assessments, MFA, encryption, staff training and incident response.
- MBE certifiedNMSDC
- i-SIGMA memberSecure data destruction
- CSDS-ledCertified Secure Data Specialist
- NIST SP 800-88 Rev. 2Aligned media sanitization
What you get
Who is covered
Non-bank financial institutions, including tax preparers, mortgage brokers and certain auto dealers.
Core safeguards
Access controls, encryption, MFA, secure disposal of customer data, monitoring and training.
Reporting
Certain security events affecting customer information must be reported to the FTC.
Find your gaps before an auditor does
A free IT & security assessment: we review your devices, Microsoft 365, backups and policies, then give you a plain-English action list.
Frequently asked questions
Does the FTC Safeguards Rule apply to CPA firms?
Firms that prepare tax returns are covered as financial institutions under the rule.
Does the rule cover data disposal?
Yes. Customer information must be securely disposed of when no longer needed, which includes data on retired devices.
Related
Find your gaps before an auditor does
A free IT & security assessment: we review your devices, Microsoft 365, backups and policies, then give you a plain-English action list.