The Reality of FTC Safeguards Enforcement

Many tax practitioners operating mid-sized firms assume they are too small to attract the attention of the Federal Trade Commission (FTC). This assumption is a mathematically unsound bet against a federal regulatory apparatus that is increasingly aggressive following the June 2023 Safeguards Rule deadline.

The Catalyst for Audits

The FTC does not generally perform random audits of 30-person accounting firms. Enforcement is almost entirely reactive. The trigger is typically a breach notification.

If your firm experiences a ransomware event where client data (SSNs, W-2s, financial statements) is exfiltrated, you are legally required to notify the affected clients and, depending on state laws, the Attorney General. These public breach notifications act as a flare to federal regulators. Once the FTC is involved, they initiate an investigation into the firm's security posture prior to the breach.

The "Template WISP" Trap

The most common failure mode we observe during post-breach forensics is the "Template WISP." A partner purchases a $199 Written Information Security Plan template online, fills in the firm's name, signs it, and places it in a drawer. This fulfills the requirement to have a document, but fails the requirement to implement it.

When FTC investigators review the environment, they compare the technical reality against the firm's WISP. If the WISP mandates "all remote access shall be secured by Multi-Factor Authentication (MFA)," but the breach occurred because a partner was using RDP without MFA to access a legacy Lacerte server from home, the firm is guilty of deceptive practices and negligence.

"A policy that is not enforced via technical controls is not a policy; it is a liability document used against you in court."

Immediate Remediation Priorities

To establish a defensible posture before an incident occurs, firm leadership must prioritize three technical controls:

1. Universal MFA Enforcement: At the Identity Provider level (e.g., Azure AD/Entra ID). No exceptions for senior staff.
2. Endpoint Detection and Response (EDR): Replacing legacy, signature-based antivirus with behavior-analyzing EDR (e.g., SentinelOne, CrowdStrike) managed by a 24/7 Security Operations Center (SOC).
3. Immutable Backups: Ensuring backups are stored in a repository isolated from the primary network domain and cannot be modified or deleted by an administrator account that has been compromised.

Need a forensic review of your firm's compliance? Commission an audit.

Common Mistakes in Infrastructure

Empirical Data & Metrics

Frequently Asked Questions