The Safeguards Rule (16 CFR Part 314) applies to tax preparers, CPA firms and other businesses the FTC treats as financial institutions. Hiring a managed service provider (MSP) to run your IT can make the work easier, but it does not hand over your obligations. The rule says so directly when a provider supplies your Qualified Individual: your firm must “retain responsibility for compliance with this part.”
Is your MSP a “service provider” under the rule?
Usually, yes, if it can reach client data. The rule defines a service provider as “any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution” (16 CFR 314.2). An MSP that manages your computers, servers, email, backups or tax software can typically access that information. Whether a particular provider fits the definition is a question for your attorney.
What must your firm do with any service provider?
16 CFR 314.4(f) lists three duties. In the rule’s words, oversee service providers by:
- “Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue.” In practice: ask how the MSP protects your data before you sign, and keep its answers.
- “Requiring your service providers by contract to implement and maintain such safeguards.” In practice: the safeguards belong in the written agreement, not only in a sales conversation.
- “Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.” In practice: review the provider on a schedule (for example, at contract renewal) and write down what you checked.
What changes if someone at your MSP is your Qualified Individual?
The rule lets your Qualified Individual, the person who oversees and enforces your information security program, be “employed by you, an affiliate, or a service provider” (16 CFR 314.4(a)). If you use a service provider for this role, your firm must:
- “Retain responsibility for compliance with this part”;
- “Designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual”; and
- “Require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this part.”
The Qualified Individual must also report in writing, “regularly and at least annually,” to your board or, if there is none, to a senior officer responsible for the program (16 CFR 314.4(i)). Firms that maintain customer information on fewer than 5,000 consumers are exempt from that written report, and from three other provisions (16 CFR 314.6); the duties in 314.4(a) and (f) still apply. Our guide to the 5,000-consumer exception explains which ones.
Who notifies the FTC if your MSP has a breach?
Your firm does. If a “notification event” involves the information of at least 500 consumers, the firm must notify the FTC “as soon as possible, and no later than 30 days after discovery” (16 CFR 314.4(j)). A notification event is, in short, acquisition of unencrypted customer information without the person’s authorization (16 CFR 314.2).
The timing matters with an MSP. The rule treats an event as known to you if it “is known to any person, other than the person committing the breach, who is your employee, officer, or other agent.” Whether your MSP counts as your agent is a legal question, but either way your contract should require the MSP to tell you promptly, so the clock never runs without you knowing.
Questions to ask your MSP
| Ask | Why it matters | Rule |
|---|---|---|
| Which of our systems and client data can your staff access, and from where? | Shows whether the MSP is a service provider and what its safeguards must cover. | 314.2, 314.4(f)(1) |
| Will the safeguards you describe be written into our contract? | The rule requires safeguards “by contract”. | 314.4(f)(2) |
| Is multi-factor authentication on for every account that can reach our systems, including your technicians’? | The rule requires MFA “for any individual accessing any information system”, unless the Qualified Individual approves an equivalent control in writing. | 314.4(c)(5) |
| How quickly will you tell us about a security incident, and how? | Our FTC notice clock may start when you know. | 314.4(j) |
| If you provide our Qualified Individual, who at our firm will you report to, and when will we get the written annual report? | Our firm must name a senior person to direct and oversee the Qualified Individual. | 314.4(a), 314.4(i) |
| What evidence can you give us each year for our provider review? | We must assess you periodically. | 314.4(f)(3) |
What to keep in your WISP
Your written information security plan should show how your firm meets these duties: who your Qualified Individual is (and, if it’s someone at the MSP, the senior person at your firm who oversees them), which providers can access client data, where the contract safeguards are, and the date and outcome of each provider review. If you haven’t written your WISP yet, our comparison of the three ways to get one is a good place to start, and our Qualified Individual guide covers that role in more detail.
How CPA Security helps
CPA Security builds your WISP around how your office actually works, including your MSP and other providers, and keeps dated training records for your staff. Whether you keep your current MSP or not, the plan documents what the rule asks of your firm.
General information only, not legal or tax advice. Whether and how the Safeguards Rule applies to your firm, and whether a provider is your agent, are questions for your attorney.