Compliance
Systems Support ยท Boston, MA
If your CPA firm collects tax returns, handles payroll data, or processes loan applications, the FTC's updated Safeguards Rule already applies to you — and a breach that exposes a gap in your written information security program can cost you your license. Here is exactly what the Rule requires and how managed IT helps Boston-area firms meet it.
What the FTC Safeguards Rule Actually Requires from CPA Firms
The FTC Safeguards Rule — updated in 2023 under the Gramm-Leach-Bliley Act — classifies tax preparers and CPA firms that handle nonpublic personal information (NPI) as "financial institutions," making full compliance mandatory. The Rule defines nine specific program elements every covered firm must implement.
- Written information security program: A formal, documented policy — not a verbal agreement or a vendor's terms of service
- Designated qualified individual: A named person responsible for overseeing the program
- Risk assessments: Documented evaluations of threats to NPI, conducted regularly
- Access controls: Limits on who can view or modify client data
- Encryption: Required for NPI both in transit and at rest
- Multi-factor authentication (MFA): Required for any system containing NPI
- Incident response plan: A written procedure for responding to a security event
- Vendor oversight: Documented review of service providers who touch NPI
- Annual board-level reporting: A written report to the firm's governing body on program status
The element Boston CPA firms most commonly lack is a documented risk assessment. Telling an FTC examiner "we use antivirus software" does not satisfy this requirement — the Rule expects a written analysis of specific threats to specific systems, signed off by a responsible individual.
The Gap Most Boston CPA Firms Don't Know They Have
Most small CPA firms in Boston operate with informal IT arrangements — a part-time tech contact, a cloud platform like QuickBooks Online, and an assumption that vendors handle security. The Safeguards Rule does not share that assumption: the firm itself is responsible for its information security program, regardless of what any vendor does.
Vendor oversight is itself a named requirement — a firm must produce documentation showing it reviewed the security practices of every service provider that touches NPI. A QuickBooks Online subscription doesn't satisfy that on its own. Firms seeking IT support for accounting firms in Boston often discover during an initial assessment that informal arrangements leave multiple Safeguards elements completely unaddressed.
How Managed IT Maps Directly to Safeguards Rule Requirements
A managed IT provider addresses Safeguards Rule obligations as ongoing operations, not one-time audit prep. Systems Support delivers managed IT services for Boston-area businesses that map directly to named Rule requirements — enforcement, documentation, and monitoring included.
- Multi-factor authentication enforcement: MFA is configured and enforced across all Microsoft 365 accounts — not left as an optional user setting
- Role-based access controls: Permissions scoped so staff access only files their role requires
- Encrypted endpoints: Laptops and workstations encrypted at rest, satisfying the Rule's encryption requirement
- Dark web monitoring: Credential exposure detected before an attacker can use a stolen password — part of Systems Support's broader cybersecurity services
- Documented change logs: Activity records satisfy the Rule's continuous monitoring requirement
Most Boston CPA firms already use Microsoft 365, but few have configured its Conditional Access policies — the feature that enforces MFA, blocks sign-ins from unrecognized locations, and restricts access to compliant devices. Proper Microsoft 365 configuration is one of the fastest Safeguards compliance levers available.
The Qualified Individual Requirement: Who's Actually Responsible at Your Firm?
The Safeguards Rule requires every covered firm to designate a "qualified individual" — a named person responsible for overseeing the information security program. For a small CPA firm without a CTO or IT director, this is often the hardest requirement to satisfy on paper.
A managed IT provider can serve in a virtual CISO capacity, supplying the documentation, oversight, and annual reporting the Rule requires without the firm hiring a dedicated security executive. Systems Support's IT compliance services are structured to support this deliverable. The break-fix model fails here: a consultant who shows up after something breaks cannot produce a program oversight record or sign off on an annual security report. The Safeguards Rule requires documented, ongoing oversight — not an ad-hoc arrangement.
What to Look for in a Managed IT Partner If You're a CPA Firm
Not every managed IT provider is equipped to support Safeguards Rule compliance. CPA firms in Quincy, Braintree, Hingham, and Dedham should evaluate candidates against these specific, verifiable criteria before signing.
- Financial services experience: Look for dedicated financial services IT support in Boston as a named service, not a generic claim
- Written risk assessments: The provider must deliver a documented risk assessment — not just run a scan
- Familiarity with all nine Safeguards elements: A provider who can name them without looking them up is prepared; one who can't isn't
- MFA and encryption as standard: Included in the base engagement, not quoted as add-ons
- Documented incident response process: A written IR plan adapted for your firm — not a verbal assurance they'll "handle it"
Getting Your CPA Firm Compliant: Where to Start
A Boston CPA firm behind on Safeguards compliance should start with a technology risk assessment to document current gaps, then move to MFA enforcement and access controls as the fastest wins, then build toward a complete written information security program and incident response plan.
Firms with fewer than five employees have a slightly simplified path — some requirements are scoped to firm size — but small firms are not exempt. Every covered firm must still designate a qualified individual, conduct risk assessments, and maintain a written program. Waiting for an FTC complaint or a client data breach is not a compliance strategy.
Frequently Asked Questions
Does the FTC Safeguards Rule apply to small CPA firms in Massachusetts?
Yes. The FTC Safeguards Rule applies to any "financial institution" under the Gramm-Leach-Bliley Act, which explicitly includes tax preparers and CPA firms that handle nonpublic personal financial information — regardless of firm size or number of employees. Small firms in Massachusetts are covered.
What does a written information security program need to include for a CPA firm?
A compliant written information security program must address all nine Safeguards Rule elements: risk assessments, access controls, encryption, MFA, incident response, vendor oversight, a designated qualified individual, and annual board-level reporting. A generic IT policy or a vendor's terms of service does not satisfy this requirement.
Can a managed IT provider serve as the 'qualified individual' required by the FTC Safeguards Rule?
Yes. The Safeguards Rule permits the qualified individual to be an external service provider. A managed IT provider acting in a virtual CISO capacity can oversee the information security program, maintain required documentation, and produce the annual written report the Rule requires — without the firm hiring a full-time security executive.
What happens if a CPA firm is found non-compliant with the FTC Safeguards Rule?
The FTC can pursue civil penalties for Safeguards Rule violations. A data breach that exposes gaps in a firm's written security program can also trigger regulatory scrutiny, client notification obligations, and reputational harm. Non-compliance identified during an examination typically requires remediation under an FTC consent order.
Find Out If Your CPA Firm's IT Setup Actually Meets FTC Safeguards Rule Requirements
In a free 15-minute discovery call, our team will walk through your current IT environment and show you exactly where your information security program has gaps — before an examiner or a breach does it for you.
Book Your Free Discovery Call
