Glossary
FTC Safeguards Rule
Also called: GLBA Safeguards Rule, 16 CFR Part 314
In one sentence
A Federal Trade Commission rule requiring non-bank financial businesses — including tax preparers and many accounting firms — to run a written information security program.
The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act and is enforced by the Federal Trade Commission. It applies to “financial institutions” that aren’t banks, which is broader than it sounds: tax preparers, many CPA firms, mortgage brokers, auto dealers that arrange financing, and similar businesses.
The FTC strengthened the rule in 2021, with most new requirements taking effect in June 2023. Covered businesses must designate a qualified individual to oversee security, base their program on a written risk assessment, and put specific safeguards in place, including access controls, encryption of customer information, MFA for anyone accessing information systems, staff training, vendor oversight, monitoring or testing, and a written incident response plan. The whole thing must be documented in a WISP.
A further amendment took effect on May 13, 2024: if unencrypted customer information about 500 or more people is acquired without authorization, the business must notify the FTC as soon as possible and no later than 30 days after discovering it. Encryption matters here — the trigger is unencrypted information.
Example: a five-person tax practice enables MFA on Microsoft 365 and its tax software, encrypts every laptop with BitLocker, writes its WISP using IRS Publication 5708, and names the owner as qualified individual. For a plain-English walk-through, read our CPA firm security guide. This is general information, not legal advice — confirm your obligations with the FTC’s own guidance or your advisor.
Related terms
- WISP (written information security plan)A written document describing how your business protects sensitive customer information — required for tax and accounting professionals under federal rules.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- Encryption at restScrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.