IT Support and Safeguards Rule Compliance for Financial Firms
A written information security program is a legal requirement for many financial practices. We build it, run it, and keep the evidence current.
What the Safeguards Rule Requires, and How We Support It
The FTC’s Safeguards Rule, issued under the Gramm-Leach-Bliley Act, sets specific technical and administrative requirements. These are the main ones.
| Requirement | What it asks | How we support it |
|---|---|---|
| 16 CFR §314.4(a)Qualified Individual | Designate someone to oversee and enforce the information security program. | Program design support and guidance for your designated individual. |
| 16 CFR §314.4(b)Written risk assessment | Identify and assess risks to customer information in writing. | We conduct and document the assessment and the resulting action plan. |
| 16 CFR §314.4(c)(3) and (c)(5)Encryption and MFA | Encrypt customer information in transit and at rest, and require multi-factor authentication. | Device and email encryption, and MFA across Microsoft 365 and remote access. |
| 16 CFR §314.4(d)(2)Testing and monitoring | Continuous monitoring, or annual penetration testing and periodic vulnerability assessments. | Vulnerability scanning and monitoring, with independent testing coordinated as needed. |
| 16 CFR §314.4(f)Service providers | Select capable providers, require safeguards by contract, and oversee them. | Vendor inventory and documented oversight of the services that touch your data. |
| 16 CFR §314.4(h)Incident response plan | A written plan for responding to security events. | A tailored plan, tabletop walkthrough, and documented roles. |
Who We Serve
- CPAs and accounting firms
- Tax preparers and enrolled agents
- Mortgage brokers and lenders
- Independent financial advisors and planners subject to FTC jurisdiction
What We Handle for You
- Written information security program (WISP)
- Risk assessment and remediation tracking
- Encryption, MFA, and device management
- Security awareness training for staff
- Backups, logging, and incident response planning
- Help Desk through tax season and beyond
Common Questions
Does the FTC Safeguards Rule apply to me?
It applies to financial institutions under FTC jurisdiction, which includes many tax preparation firms, accountants, mortgage brokers, and similar businesses. SEC-registered advisers and broker-dealers are generally covered by SEC rules such as Regulation S-P instead. If you are unsure, ask your attorney or compliance advisor, and we will help you with the technical side either way.
What changed in the Safeguards Rule?
The 2021 amendments made the rule far more prescriptive: a designated Qualified Individual, a written risk assessment, encryption, multi-factor authentication, testing, training, and an incident response plan. Later amendments added a requirement to notify the FTC of certain security breaches affecting 500 or more consumers.
We are a small firm. Are there exemptions?
Institutions that maintain customer information on fewer than 5,000 consumers are exempt from some of the more formal requirements, such as the written risk assessment, the written incident response plan, and board reporting. The core safeguards, including access controls, encryption, MFA, and training, still apply.
Can you act as our Qualified Individual?
The rule allows a Qualified Individual to be an employee or a service provider, but your organization stays responsible for compliance and must oversee the provider. We can discuss what support model fits your firm.
Talk Through Your Compliance and IT Needs
Tell us about your practice. We will reply with an honest read on where you stand and what to fix first. Support hours are 7 a.m. to 7 p.m. MST, Monday through Friday, and we are available 24/7 for emergencies.