FTC Safeguards assessment.

Most CPA firms and tax preparers are covered. The FTC Safeguards Rule (16 CFR Part 314) was enacted under the Gramm-Leach-Bliley Act, which defines "financial institution" broadly to include tax preparation firms, accounting firms that handle customer financial information, insurance agencies, investment advisors, and real estate settlement services companies. If your firm prepares tax returns or manages client financial records, the rule almost certainly applies. The free 14-Point Safeguards Gap Report reviews your current environment against the rule requirements and shows you where the gaps are.

The FTC Safeguards Rule requires a written information security program that covers: a Qualified Individual to oversee the program, a documented risk assessment, safeguards based on that assessment (access controls, encryption, MFA, secure disposal), workforce training, service provider oversight with written agreements, a regular review process, and an incident response plan. Firms with customer information on fewer than 5,000 consumers are not required to keep a written risk assessment, perform penetration testing or vulnerability assessments, maintain a written incident response plan, or file the annual report to the board, but still need the program itself, a Qualified Individual, and the core safeguards.

Managed IT covers your network, devices, servers, and software: monitoring, updates, patching, backup, email security, endpoint protection, and response when something breaks. For financial offices, the compliance layer is included: written information security program, documented risk assessment, Qualified Individual documentation, MFA, encrypted backup, and vendor agreement review. These run together because they overlap in practice and should not be managed as separate projects.

CPA and tax firms, insurance agencies, registered investment advisers, and title and settlement offices. These are all financial institutions under the Gramm-Leach-Bliley Act with FTC Safeguards Rule obligations. Healthcare practices are also served under a separate HIPAA compliance framework at arainsystems.com/healthcare. If your office type is not listed, reach out.

You call or text 832-907-5594, and urgent issues get a response within hours during business hours, and everything else within one business day.

The free 14-Point Safeguards Gap Report is a one-time review that shows where you stand today against the FTC Safeguards Rule requirements. It produces a written findings report and a prioritized fix list. Managed IT is an ongoing relationship: monitoring, maintenance, compliance documentation, and response. Most offices need both because a written security program requires ongoing maintenance as the business changes.