The FTC Safeguards Rule checklist

1. Pick the person who will own security, such as the owner, the office manager, or the lead at your managed IT provider.
2. Write a short appointment memo with their name, start date, and duties: oversee, implement, and enforce the program.
3. Have the owner sign it and tell all staff who to go to with security questions.
4. Update the memo right away if this person leaves or changes roles.

Keep on file: A signed and dated memo naming your Qualified Individual and their duties.

1. If your Qualified Individual works for an IT provider or affiliate, name a senior person on your team (for example, the owner) to direct and oversee them.
2. Add a contract clause requiring the provider to keep an information security program that protects you as the FTC Safeguards Rule requires.
3. Write down that your business keeps responsibility for compliance, even with outside help.
4. If your Qualified Individual is your own employee, mark this item as not applicable.

Keep on file: The contract clause plus a memo naming the senior person who oversees your outside Qualified Individual.

1. Create one document or folder titled Information Security Program.
2. Describe your safeguards: who is in charge, who has access, how data is protected, and how it is disposed of.
3. Attach or link your risk assessment, policies, inventory, and vendor list.
4. Store it where your Qualified Individual and staff can find it, such as a shared folder in Microsoft 365 or Google Workspace.

Keep on file: Your current written information security program showing the date it was last updated.

1. List where customer information lives: your tax software, email, file shares, paper files, phones, and backups.
2. For each place, list realistic threats, such as phishing, a stolen laptop, a former employee, ransomware, or a misdirected email.
3. Rate how likely and how harmful each threat is, and note the protections you already have.
4. Decide what to fix first and add those fixes to this tracker.

Keep on file: Your dated risk assessment notes or worksheet listing the risks and planned fixes.

1. Write down the scale you use to rate risks, for example likelihood 1-5 times impact 1-5.
2. Write down how you judge whether each system and data set stays confidential, accurate, and available, and whether current controls are adequate.
3. For each risk, record whether you will reduce it or accept it, who decided, and how your program addresses it.
4. Have your Qualified Individual sign and date the document.

Keep on file: A signed, dated written risk assessment that includes your rating criteria and a decision for each risk.

1. Reopen last year's risk assessment and check every risk and protection.
2. Add new risks, such as new software, remote work, new vendors, or recent scams aimed at your industry.
3. Check whether last year's planned fixes were finished.
4. Save the updated version with the new date.

Keep on file: The dated, updated risk assessment showing what changed since the last one.

1. Give every employee their own username in your tax software, email, and file storage, and never share logins.
2. Set roles so seasonal or front-desk staff see only the client files they work on.
3. Limit admin rights on computers and in Microsoft 365 or Google Workspace to one or two people.
4. If you run a client portal, make sure each client can see only their own documents.

Keep on file: A list of users and their access level for each system that holds customer information.

1. Export or screenshot the user list from your tax software, email system, file storage, and any client portal.
2. Compare it to your current staff and contractors.
3. Remove accounts for people who left and cut access that is more than the job needs.
4. Record the date, who did the review, and what you changed.

Keep on file: A dated access review record listing each system checked and the changes made.

1. Keep a checklist of everything to shut off: email, tax software, file storage, password manager, building keys, and alarm codes.
2. Disable accounts and change any shared passwords on the person's last day.
3. Collect laptops, phones, keys, and badges, and wipe or reassign the devices.
4. Sign and date the checklist.

Keep on file: A completed, dated offboarding checklist for each person who left.

1. Keep paper client files in locked cabinets or a locked room, and lock them at the end of each day.
2. Keep visitors out of areas with client files and computers, or escort them.
3. Set computers to lock the screen after a few minutes of no use.
4. Keep a current list of who has office keys and alarm codes.

Keep on file: A short written description of your physical security practices and a current key and alarm-code list.

1. List every computer, phone, tablet, server, scanner, and storage drive that touches client data.
2. List every system and app that holds client data, such as your tax software, email, cloud storage, and e-signature tool.
3. List the people who use them and the places where data is kept, including home offices and storage rooms.
4. Mark each item high, medium, or low importance, and update the list whenever something changes.

Keep on file: A dated inventory spreadsheet of data, people, devices, systems, and locations with an importance rating.

1. Use a secure client portal or encrypted email (for example, Microsoft 365 Message Encryption) instead of plain email attachments for returns and IDs.
2. Make sure your website and any online upload forms use HTTPS.
3. Have staff who work from home use secure connections, such as a VPN or your tax software's encrypted web access.
4. If something cannot be encrypted, have your Qualified Individual write down and approve the alternative protection.

Keep on file: A note of the tools you use to send data securely, plus any signed Qualified Individual approvals for exceptions.

1. Turn on BitLocker (Windows) or FileVault (Mac) on every computer that holds client data.
2. Require a passcode, which turns on encryption, on every phone and tablet used for work.
3. Use encrypted backups and encrypted USB drives, or stop using USB drives.
4. Confirm your cloud services encrypt stored data, and keep recovery keys somewhere safe, such as a password manager.

Keep on file: A device list showing encryption is on for each device, plus any Qualified Individual approvals for exceptions.

1. List each outside app that handles client data, such as your tax software, client portal, e-signature tool, and cloud storage.
2. For each one, check for multi-factor authentication, encryption, and a published security report or page (such as SOC 2).
3. Turn on each app's security settings and remove apps you no longer use.
4. Do this check before adopting any new app, and review the whole list once a year.

Keep on file: A dated app security checklist showing each app, what you checked, and your decision.

1. List any in-house tools, scripts, spreadsheets with macros, or website forms that send, access, or store client data.
2. If you have none, record that and revisit this item if that changes.
3. If you do, require whoever builds them to follow a secure coding guide (such as the OWASP Top 10), review the code, and keep passwords out of it.
4. Test new or changed tools for security problems before they go live.

Keep on file: A note listing your in-house tools (or stating there are none) and the secure development practices you follow.

1. Turn on MFA in Microsoft 365 or Google Workspace, your tax software, your client portal, your password manager, and any remote access tool.
2. Use an authenticator app or security key instead of text-message codes where you can.
3. Make sure contractors and remote workers use MFA too.
4. List any system that cannot do MFA, along with your Qualified Individual's written approval of the replacement control.

Keep on file: A list of systems with MFA status for each, plus any written Qualified Individual approvals for exceptions.

1. Shred paper with a cross-cut shredder, or use a shredding service that gives you a certificate.
2. Wipe or destroy hard drives, copier drives, and phones before you sell, recycle, or throw them away.
3. Set a yearly cleanup to delete client files and emails that are past your retention period.
4. Write down the reason for anything you keep longer, such as IRS record-keeping rules for tax preparers.

Keep on file: Shredding or device destruction certificates and a dated log of each data cleanup.

1. Write a simple retention schedule listing each type of record, how long you keep it, and why.
2. Each year, compare it to what is actually in your files, email, and backups.
3. Shorten any keep-periods that are longer than you need.
4. Have your Qualified Individual approve and date the updated policy.

Keep on file: Your dated data retention policy with notes from the latest review.

1. Keep a simple change log with the date, what changed, who approved it, and the security impact.
2. Before big changes, like new tax software, a new Wi-Fi router, or an office move, have your Qualified Individual review the security impact.
3. Test changes and keep a way to undo them, such as a recent backup.
4. Update your inventory after each change.

Keep on file: A change log showing approved changes and their security review.

1. Turn on audit logging in Microsoft 365 or Google Workspace and in your tax software, if it offers it.
2. Turn on alerts for risky sign-ins, mass downloads or deletions, and new email forwarding rules.
3. Each month, look over alerts and sign-in reports for anything unusual, such as logins from other countries or at odd hours.
4. Write down what you reviewed and any follow-up.

Keep on file: Screenshots of your audit logging settings and a monthly log review record.

1. Confirm antivirus or endpoint protection (such as Microsoft Defender) is on and reporting on every computer.
2. Restore a test file from your backup to prove backups work.
3. Spot-check that MFA, screen locks, encryption, and automatic updates are still turned on.
4. Record what you tested, what failed, and how you fixed it.

Keep on file: A dated test checklist with results and fixes.

1. Ask your IT provider whether you have tools that watch your systems all the time for changes that create weak spots, such as a managed detection and response service.
2. If yes, document what the tool covers and who responds to its alerts.
3. If no, plan a yearly penetration test and vulnerability scans at least every six months.
4. Have your Qualified Individual sign off on the choice.

Keep on file: A signed memo stating your chosen approach and the tools or vendors that provide it.

1. Hire a qualified outside tester and aim the test at the highest risks in your risk assessment.
2. Include your internet-facing systems, such as your website, client portal, and remote access.
3. Fix the findings, starting with the most serious, and have them retested.

Keep on file: The penetration test report and a record of how each finding was fixed.

1. Use a vulnerability scanner, or have your IT provider scan your computers, servers, network gear, and website.
2. Schedule scans every six months, plus after big changes such as new systems or a new office.
3. Patch or fix high-risk findings first, then rescan to confirm.

Keep on file: Dated scan reports and a record of the fixes made.

1. Train every employee and seasonal worker when they start and at least once a year.
2. Cover phishing, strong passwords and a password manager, safe handling of client documents, and how to report problems.
3. Add topics from your risk assessment, such as fake IRS emails or new client scams.
4. Keep a sign-in sheet or certificate for each person.

Keep on file: Training materials plus dated attendance records or certificates for every staff member.

1. Decide who handles day-to-day security: an employee, your managed IT provider, or both.
2. Confirm they have relevant experience or certifications and enough time to do the work.
3. Write down their names, roles, and how to reach them.

Keep on file: A list of the people or provider managing your security, with their qualifications.

1. Have your Qualified Individual and IT contact complete at least one security course, webinar, or certification activity each year.
2. Sign them up for security alerts, such as CISA alerts and IRS e-News for Tax Professionals.
3. Keep certificates or notes of what they completed.

Keep on file: Certificates or a dated log of security training completed by your security personnel.

1. Once a year, ask your Qualified Individual and IT provider what they did to stay current, such as training, alerts, or conferences.
2. For outside providers, ask for proof, like certifications or training records.
3. Record their answers and any gaps you asked them to close.

Keep on file: A dated note or email confirming how your key security staff stayed current this year.

1. List every vendor that can see or store client data, such as your IT provider, tax software, cloud storage, shredding service, and payroll company.
2. Before hiring a new one, ask about their security: MFA, encryption, staff background checks, and past breaches.
3. Prefer vendors with an independent security report (such as SOC 2) or a clear written security policy.
4. Keep your notes for each vendor.

Keep on file: A vendor list with dated security due-diligence notes for each provider.

1. Check each vendor's contract or terms of service for a clause requiring them to protect your customer information.
2. Where it is missing, ask for an addendum that requires appropriate safeguards and prompt notice to you of any breach.
3. Store signed contracts or accepted terms with your vendor list.

Keep on file: Signed contracts or accepted terms for each vendor showing the security clause.

1. Rank vendors by risk, putting those that hold the most client data first.
2. Each year, ask higher-risk vendors for an updated security report or a short questionnaire, and check for news of breaches.
3. Add protections or replace any vendor that no longer meets your standards.
4. Record the date and result of each review.

Keep on file: Dated vendor review notes or questionnaires with your conclusion for each vendor.

1. Each year, look at your test results, risk assessment, security events, and vendor reviews together.
2. Also review after material changes, such as a merger, a new office, new software, or a move to remote work.
3. Update your written program and policies to match, and add any new fixes to this tracker.
4. Date the updated program and note what changed.

Keep on file: The updated written program with a dated summary of changes.

1. Write the plan's goals and the steps your team follows when something goes wrong, from the first report to recovery.
2. Name who is in charge, who can make which decisions, and who contacts customers, vendors, your insurer, law enforcement, and the FTC.
3. Explain how you will fix the weaknesses that caused an event, and how you will document and report it.
4. Keep a printed copy and contact list where staff can reach them even if your systems are down.

Keep on file: Your written, dated incident response plan covering all seven required areas.

1. Once a year, walk through a realistic scenario, such as a stolen laptop or a hacked email account, using the plan.
2. After any real security event, review what worked and what did not.
3. Update the plan, contacts, and roles based on what you learned.

Keep on file: Dated notes from each exercise or post-event review and the revised plan.

1. Have your Qualified Individual write a report on the program's overall status and your compliance with the rule.
2. Include risk assessment results, risk and control decisions, vendor arrangements, test results, security events and how you responded, and recommended changes.
3. Present it to the board, or to the owner or senior officer if there is no board, and record the date it was delivered.

Keep on file: The signed, dated written report and a record of when it was presented.

1. Bookmark the FTC's Safeguards Rule Security Event Reporting Form and save the link with your emergency contacts.
2. If data may have been taken, write down the first day anyone at your business (other than the person who caused it) knew about it, because the 30-day clock starts then.
3. Check whether the data was unencrypted or the encryption key was exposed, and count the consumers involved; unauthorized access counts as acquisition unless you have reliable evidence the data was not taken.
4. Gather what the form asks for: your contact information, the types of data, the dates, the number of people affected, a short description, and any law enforcement delay request.
5. If 500 or more consumers are involved, submit the form and keep a copy, then check your state's breach laws, which may require separate notices to customers.

Keep on file: A saved link to the FTC form, your written reporting steps, and copies of any reports you filed.