The FTC Safeguards Rule for accountants and outsourcing vendors

Section 314.2(h)(2)(viii) gives as an example of a financial institution an accountant or other tax preparation service that is in the business of completing income tax returns. The FTC’s business guide lists tax preparation firms the same way.

The IRS says the same thing from its side: IR-2026-92 states that federal law requires tax and accounting professionals to create and maintain a written information security plan.

The FTC guide walks through the elements of the program. Among them: designate a Qualified Individual, conduct a written risk assessment, put safeguards in place, regularly monitor and test them, oversee service providers, and have the Qualified Individual report in writing at least annually to the board or governing body.

• Encrypt customer information at rest and in transit over external networks (314.4(c)(3))
• Multi-factor authentication for anyone accessing an information system, unless the Qualified Individual approves an equivalent control in writing (314.4(c)(5))
• Dispose of customer information no later than two years after last use, with stated exceptions
• Without continuous monitoring, annual penetration testing and vulnerability scans every six months

Section 314.4(f) is the outsourcing clause: select capable providers, require safeguards by contract and periodically assess them. An outsourcing contract that is silent on security does not meet it.

The FTC guide also requires notice to the FTC for a notification event involving the unencrypted information of at least 500 consumers, as soon as possible and no later than 30 days after discovery.