Question 1

Designate a Qualified Individual (16 CFR 314.4(a))

Accepted Answer

Name one person, the Qualified Individual, who is responsible for overseeing, implementing, and enforcing your information security program, so there is a single point of accountability. They do not have to be an employee; the role can be filled by an affiliate or an outside service provider. What satisfies it: Name one person as the Qualified Individual. It can be you, or an outside IT or security firm you bring in, and you keep a short written note of who holds the role.

Question 2

Written risk assessment (16 CFR 314.4(b))

Accepted Answer

Build your program on a risk assessment that identifies reasonably foreseeable internal and external risks to customer information and judges whether your safeguards are sufficient. Under 314.4(b)(1) it must be written and state how you evaluate and categorize risks, assess confidentiality, integrity, and availability, and reduce or accept each risk. Under 314.4(b)(2) you periodically reassess. What satisfies it: A written document listing where client data lives (email, your tax or practice software, cloud storage, paper files), the realistic threats to it, and for each one whether you have a safeguard or are accepting the risk, reviewed on a set schedule.

Question 3

Access controls (16 CFR 314.4(c)(1))

Accepted Answer

Put access controls in place and review them periodically. They authenticate who a person is before letting them in, and restrict each authorized person to only the customer information they need for their work. What satisfies it: Each person has their own login (no shared accounts), files with client tax returns or policy details are restricted to the people working those accounts, and old logins are removed promptly when someone leaves.

Question 4

Inventory and classify data (16 CFR 314.4(c)(2))

Accepted Answer

Identify and manage the data, personnel, devices, systems, and facilities that let you do business, ranked by their importance to your objectives and risk strategy. You cannot protect or limit access to information you have not located. What satisfies it: A written list of where client data lives, covering each system and location (tax or bookkeeping software, email, cloud storage, laptops, the locked file cabinet), with a note of how sensitive each is.

Question 5

Encrypt customer information at rest and in transit (16 CFR 314.4(c)(3))

Accepted Answer

Protect all customer information by encryption both while stored (at rest) and while traveling over external networks (in transit), so an intercepted file or stolen laptop is unreadable. What satisfies it: Full-disk encryption on laptops and phones (BitLocker or FileVault), a client portal or encrypted email instead of plain attachments for tax returns or statements, and confirming your file storage and backups are encrypted.

Question 6

Secure development practices (16 CFR 314.4(c)(4))

Accepted Answer

If you build your own software that handles client information, use secure development practices. For externally developed applications you use to transmit, access, or store customer information, have a way to evaluate, assess, or test their security. What satisfies it: If you do not write your own software, keep a short note on how you vet vendor tools before adopting them: confirm the portal or tax software comes from a reputable provider, read its security documentation, and keep it updated.

Question 7

Multi-factor authentication (16 CFR 314.4(c)(5))

Accepted Answer

Use multi-factor authentication for any individual accessing any of your information systems. It verifies identity with at least two different factors, so a stolen password alone is not enough to get in. What satisfies it: MFA turned on for the accounts that touch client information: email, remote access or VPN, and the tax, accounting, advisory, or policy software where client records live.

Question 8

Secure disposal and retention (16 CFR 314.4(c)(6))

Accepted Answer

Have written procedures to securely dispose of customer information, in any format, no later than two years after you last used it for that customer, and periodically review your retention practices so you do not hold records longer than needed. What satisfies it: A short written retention-and-disposal note saying when old client files get deleted or shredded, plus actually doing it: shredding paper you no longer need and permanently wiping old client files and the drives or laptops they sat on.

Question 9

Change management (16 CFR 314.4(c)(7))

Accepted Answer

Adopt change-management procedures: a planned way to review and approve changes to the systems and software that touch client information, instead of ad hoc changes that could quietly weaken your security. What satisfies it: A short written routine before changing anything that handles client data (new tax software, switching cloud storage, changing who can access a system): note what is changing, check it does not open a hole, and keep a dated record.

Question 10

Logging and monitoring of authorized users (16 CFR 314.4(c)(8))

Accepted Answer

Put policies, procedures, and controls in place to monitor and log what your authorized users do, so you can detect unauthorized access, misuse, or tampering by those users. Even people allowed into your systems can err or act improperly. What satisfies it: Turn on activity and sign-in logs in the software where client data lives (tax or accounting program, document portal, Microsoft 365 admin center) and periodically review them for unusual access.

Question 11

Test safeguards and reassess (16 CFR 314.4(d) and (g))

Accepted Answer

Regularly test or monitor whether your safeguards work, including controls that detect attacks and intrusions, and evaluate and adjust the program over time in light of test results, material changes, risk-assessment results, or anything else that may materially affect it. What satisfies it: A recurring schedule to review and test protections (confirm backups restore, account access lists are accurate, monitoring is running), then write down and fix what needs to change.

Question 12

Staff security awareness training (16 CFR 314.4(e))

Accepted Answer

Make sure your people can actually carry out the program. The rule requires security awareness training for staff, updated to reflect the risks found in your risk assessment, and the use of qualified security personnel (your own or a provider’s) who keep their knowledge current as threats change. What satisfies it: Regular security-awareness training for everyone who handles client data, covering things like spotting phishing and handling files safely, refreshed as new risks come up.

Question 13

Vendor and service-provider oversight (16 CFR 314.4(f))

Accepted Answer

Oversee the vendors that handle client information: take reasonable steps to select and keep providers capable of protecting it, require safeguards by contract, and periodically assess them based on their risk and continued adequacy. Handing data to a vendor does not hand off your responsibility. What satisfies it: Keep a list of vendors that touch client data (cloud storage, tax or practice-management software, email host, backup service), confirm each contract commits them to safeguards, and review them on a set schedule.

Question 14

Written incident response plan (16 CFR 314.4(h))

Accepted Answer

Have a written plan, prepared in advance, for responding to and recovering from a security event that materially affects customer information: goals, response steps, roles and decision authority, internal and external communications, remediation, documentation and reporting, and revising the plan afterward. What satisfies it: A short written document, kept where you can find it, listing what counts as a security event, the exact steps you would take (disconnect an affected computer, change passwords, call your IT contact), who you would notify, and a reminder to update it after any incident.

Question 15

Regular reporting to leadership (16 CFR 314.4(i))

Accepted Answer

The Qualified Individual must report in writing regularly and at least annually to your board or governing body (or a senior officer if you have no board), covering the program status and compliance, plus material matters such as risk assessments, key decisions, service-provider arrangements, testing results, any security events or violations and management responses, and recommended changes. What satisfies it: At least once a year, and regularly as needed, the person running your program writes a status report covering compliance, incidents, and what should change, and gives it to the office’s top decision-maker.

Question 16

Notify the FTC of a breach (16 CFR 314.4(j))

Accepted Answer

Notify the FTC of a notification event: the unauthorized acquisition of unencrypted customer information of at least 500 consumers. File the notice electronically through the form on the FTC website as soon as possible and no later than 30 days after you discover the event. What satisfies it: If you discover unauthorized access to unencrypted client information affecting 500 or more people, file notice with the FTC within 30 days. Encryption can keep an event from meeting this trigger in the first place.

FTC Safeguards Rule requirements.