Background:
- The FTC Safeguards Rule, established under the Gramm-Leach-Bliley Act, mandates financial institutions to develop, implement, and maintain an information security program (ISP) to protect customer information [1] [2].
Definition of Financial Institution:
- CPA firms are considered financial institutions if they engage in activities that are financial in nature or incidental to financial activities, such as tax planning and preparation services [1] [2].
Requirements:
- Designate a Qualified Individual: A person responsible for implementing and supervising the ISP, who may be a partner, employee, or an outside service provider [1].
- Conduct a Risk Assessment: Identify and inventory customer information, assess risks and threats to its security, confidentiality, and integrity [1].
- Implement Safeguards: Administrative, technical, and physical safeguards must be in place to protect customer information [2].
Recent Amendments:
- The FTC amended the Safeguards Rule in 2021 to provide more concrete guidance and expand the definition of financial institutions [1] [2].
- In 2023, further amendments introduced breach notification requirements, effective from May 2024 [2].
For more detailed information, you can refer to the Journal of Accountancy and the FTC's official guidance.
