What does the FTC Safeguards Rule ask a small tax firm to write down?

A consumer is a person, and the service is for personal use. An individual who comes to you for a tax return is one. The rule's own list of customer relationships names a client who "becomes your client for the purpose of obtaining tax preparation or credit counseling services from you" (16 CFR 314.2(e)(2)(i)(H)). A business entity's return isn't a service for personal, family or household purposes, so a firm that prepares only business returns may hold few consumers in the rule's sense. Most tax firms prepare at least some individual returns, and each of those clients counts.

Former clients count while you keep their files. The definition says "obtains or has obtained", and the exception turns on whose information you "maintain". So a client who left three years ago still counts for as long as the file sits on your server. How to count a joint return, or a dependent whose details sit on a parent's return, is a question for your counsel, because the rule doesn't say.

The number is yours to keep, and it can go down. Nobody else keeps this count for you. Disposing of files you no longer need lowers it, and the rule asks for that anyway under 314.4(c)(6). Our brief on how long a tax firm keeps client files covers the disposal side. A firm near the line should count once, write the figure down and date it, and count again after each filing season.

The role has a name, and the rule uses it. The person in charge of the program is the Qualified Individual. In a firm of fifteen people that is often a partner or the office manager, and the rule doesn't require a security background. It requires someone who is responsible, by name.

If that person is outside the firm, three conditions follow. The rule says that where the role is filled through a service provider or an affiliate, you shall "(1) Retain responsibility for compliance with this part; (2) Designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual; and (3) Require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this part." So an outside Qualified Individual doesn't take the duty off the firm. A partner still owns it, and the provider's contract has to say what the provider runs.

None of this is switched off below 5,000. Section 314.6 names (b)(1), (d)(2), (h) and (i). Paragraph (a) isn't among them, so the smallest covered firm still names its Qualified Individual, and it still writes that name down somewhere a partner can find it.

The duty to test stays. Paragraph (d)(1) is not on the 314.6 list, so every covered firm regularly tests or monitors its key controls. What the rule leaves to the firm is how, and how often.

The fixed schedule is what falls away. Paragraph (d)(2) sets that schedule: "Annual penetration testing of your information systems" and vulnerability assessments "at least every six months". The schedule only applies "Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities", and under 5,000 consumers it doesn't apply at all. A small firm can still choose a yearly test; the rule just stops requiring one.

Keep a record either way. Whatever the firm does under (d)(1), the useful thing is a dated note of what was tested, by whom and what was found. Paragraph (g) asks the firm to "Evaluate and adjust" the program in light of that testing, and (g) applies at every size.

Two factors, from two different types. The rule defines multi-factor authentication at 314.2(k) as "authentication through verification of at least two of the following types of authentication factors": something you know, such as a password, something you have, such as a token, and something you are, such as a fingerprint. A password plus a second password is one type twice, so it isn't multi-factor under the definition.

The exception is the one place the rule asks for a signature. A firm can use "reasonably equivalent or more secure access controls" instead, but only where the Qualified Individual "has approved in writing". Nowhere else in 314.4 does an exception turn on a written approval from that person. So if any account in the firm signs in without a second factor, the file should hold the written approval that covers it. Otherwise the account gets the second factor.

It applies at every size, to any system. Paragraph (c)(5) isn't on the 314.6 list, and it says "any individual accessing any information system". In practice that means email, the tax software, the file share, the portal and remote access. Most of these offer a second factor at no extra cost, and your IT administrator can turn it on in an afternoon. The harder part is the handful of accounts that can't, which is where the written approval comes in.

Above 5,000 consumers the risk assessment "shall be written and shall include" three things:

1. "Criteria for the evaluation and categorization of identified security risks or threats you face;"
2. "Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and"
3. "Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks."

Under 5,000 the assessment still has to exist and the program still has to rest on it, under (b) and (b)(2). The set criteria and the written form are what fall away. Most firms find it easier to write the assessment down anyway, because an unwritten one can't be shown to an insurer or a client.

Above 5,000 consumers the plan is written and "shall address the following areas":

1. "The goals of the incident response plan;"
2. "The internal processes for responding to a security event;"
3. "The definition of clear roles, responsibilities, and levels of decision-making authority;"
4. "External and internal communications and information sharing;"
5. "Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;"
6. "Documentation and reporting regarding security events and related incident response activities; and"
7. "The evaluation and revision as necessary of the incident response plan following a security event."

Under 5,000 no written plan is required. The 30-day notice to the FTC still is, which is why the next section suggests writing one page anyway.

Above 5,000 consumers the Qualified Individual reports "in writing, regularly and at least annually, to your board of directors or equivalent governing body", or, where there is none, to "a senior officer responsible for your information security program". The report covers "The overall status of the information security program and your compliance with this part" and "Material matters related to the information security program", which the rule lists as risk assessment, control decisions, service provider arrangements, test results, security events and recommended changes.

Under 5,000 no report is required. A firm that wants one anyway has the outline above.

Paragraph (j) isn't on the 314.6 list. Take a firm with 600 consumers in its files that loses unencrypted information on 500 of them. It owes the FTC a notice within 30 days of discovery, and the rule never asked it for a written incident response plan. The two thresholds are different numbers for different purposes: 5,000 switches four paragraphs off, and 500 switches the notice on.

Discovery is the first day anyone at the firm knows. Under (j)(2) the event is treated as discovered "as of the first day on which such event is known to you", and the firm knows when "any person, other than the person committing the breach, who is your employee, officer, or other agent" knows. Our brief How long does a firm have to notify the FTC after a data breach? goes through the clock, what the notice says and how encryption changes the answer.