Tax preparers, many accounting firms, mortgage brokers and non-SEC-registered advisers are "financial institutions" under the FTC's Safeguards Rule. It requires a written information security program with nine elements, MFA for anyone accessing customer information, and since May 2024 a notice to the FTC within 30 days of a breach affecting 500 or more people. What is required and a practical setup for a small firm.
The FTC's definition of a financial institution is wider than most firms expect. The guidance lists tax preparation firms, mortgage lenders and brokers, finance companies, collection agencies, credit counsellors and investment advisers not registered with the SEC, among others, and says "what matters are the types of activities your business undertakes".
A qualified individual who oversees the program (can be an outside provider, with someone in the firm supervising).
A written risk assessment, updated periodically.
Safeguards: access controls, encryption of customer information, MFA for anyone accessing customer information, secure disposal within two years of last use unless needed, and change management.
Testing: continuous monitoring, or annual penetration tests plus vulnerability assessments every six months.
Staff security training.
Oversight of service providers.
Keeping the program current as the business changes.
A written incident response plan.
An annual written report to the board or owners.
Firms holding information on fewer than 5,000 consumers are exempt from some of these, including the written risk assessment, the incident response plan and the annual report. MFA and encryption still apply.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Since May 2024, a firm must notify the FTC through its online form as soon as possible, and no later than 30 days after discovery, when unencrypted information of at least 500 consumers is acquired without authorization. State breach laws and IRS reporting for tax professionals apply in addition.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
AI in Accounting and Tax Firms: Document Intake, Close Support, and What Stays Human
The parts of accounting work that AI helps with today are clear: reading client documents, matching transactions, drafting explanations and searching past work. Judgment, sign-off and client advice stay with people. Where it pays off, the confidentiality rules to check first (including Section 7216 for tax return information), and how we would build it.
Read
NYDFS Part 500 After November 2025: What Insurers Must Have in Place, Mapped to AWS
The amended Part 500 finished phasing in on November 1, 2025 with MFA for every user of every information system and a full asset inventory that records owner, location, classification, support end date and recovery time. What licensees must now have, the reporting clocks, and how each requirement maps to AWS services.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.