If you run an accounting firm, tax practice, or financial services office in the Downriver area, the FTC Safeguards Rule applies to you. It went through a major update in 2023, and a lot of smaller firms are still catching up. The requirements are specific, and most of them land squarely on your IT setup.
Groves Technology works with CPA and tax firms in Gibraltar and throughout Downriver to make sure their IT actually meets these requirements instead of hoping for the best.
The Safeguards Rule applies to “financial institutions,” which the FTC defines broadly enough to include tax preparers, accounting firms, and financial advisors. If you’re handling client financial data, this rule is for you.
Here’s what it requires from a technology standpoint:
A designated qualified individual. Someone has to be responsible for your information security program. For a lot of small firms, that responsibility falls to your IT provider.
Access controls. Employees should only have access to the client data they need for their job. No shared logins, no open access to everything.
Encryption. Client financial data has to be encrypted both in transit and at rest. That means encrypted email, encrypted file storage, and encrypted backups.
Multi-factor authentication. MFA is required for anyone accessing client information. If your team is still logging in with just a password, that’s a gap.
Monitoring and logging. You need to be able to detect unauthorized access to client data. That requires active monitoring, not just hoping your antivirus catches something.
Incident response plan. You need a written plan for what happens when something goes wrong. Not a vague idea, a documented process.
Vendor management. Any third party with access to client data needs to be assessed. That includes your IT provider, your cloud storage, and your tax software vendor.
Regular risk assessments. The Safeguards Rule requires periodic assessments of your security program. Not a one-time audit, but ongoing evaluation.
For most accounting firms with 3 to 20 employees, the technology side of the Safeguards Rule is where the biggest gaps are. Shared passwords on a front desk computer. No MFA on the tax software login. Backups that haven’t been tested. Email that isn’t encrypted.
Groves Technology starts with an assessment of where your firm stands against these requirements, then builds a managed plan around closing the gaps. The monitoring, patching, access management, and backup verification happen on a monthly basis as part of the plan, not as a separate project you have to remember to schedule.
Based in Gibraltar, Michigan, serving CPA firms, tax preparers, and financial services offices throughout Downriver and Southeast Michigan. That’s FTC Safeguards Rule IT support Downriver firms count on.
Want to talk about your firm’s IT? Schedule a call or reach out at (734) 230-2360.
The Safeguards Rule applies to “financial institutions,” which the FTC defines broadly enough to include tax preparers, accounting firms, and financial advisors. If you’re handling client financial data, this rule is almost certainly for you.
Someone has to be responsible for your information security program. For a lot of small firms, that responsibility falls to your IT provider. We handle the designated role as part of the managed plan, so you’re not stuck figuring out who owns it internally.
The FTC can pursue enforcement action, and firms have faced real penalties for non-compliance. Beyond that, a lot of cyber-insurance policies now ask about Safeguards Rule compliance directly, so gaps here can affect your coverage too.
Yes. Every managed plan starts with an assessment of where your firm stands against the Safeguards Rule requirements. Shared passwords, no MFA, backups that haven’t been tested, those are the common gaps, and we build the plan around closing them.
Serving CPA and tax firms throughout Downriver Michigan, including Trenton, Rockwood, Brownstown Township, Woodhaven, and Flat Rock.
