The controls the FTC Safeguards Rule and your IRS written security plan expect, run for you every day, with reports to prove it.
The FTC Safeguards Rule and IRS Publication 4557 ask for the same core safeguards. Here is how each one is covered.
| Safeguard | What we do | Your evidence |
|---|---|---|
| Monitor for attacks | Managed EDR on every computer, watched 24/7 by the Huntress SOC | Monthly security report, incident history |
| Keep systems updated | Automated patching for Windows, macOS and tax/office apps | Patch compliance report, live portal view |
| Multi-factor authentication | MFA on email, Microsoft 365 and remote access | MFA coverage list |
| Encrypt client data | BitLocker / FileVault on laptops and desktops | Encryption status per device |
| Back up and recover | Hybrid cloud backup with restore tests | Backup and restore-test log |
| Filter malicious sites | DNS web filtering on every device | Blocked-threat summary |
| Incident response | Automatic tickets and our response steps when the SOC finds something | Ticket and response record |
We provide technical safeguards and documentation. We are not attorneys, and using our services does not by itself make a firm compliant.
Add seasonal staff for January to April and remove them after. Ring the front desk and your cell at the same time, queue callers in the April rush, and send faxes from email.
Business phone serviceThe FTC treats tax preparers and many accounting firms as financial institutions under the Gramm-Leach-Bliley Act, so the Safeguards Rule applies. It requires a written information security program and specific controls such as MFA, encryption and monitoring. Your attorney or professional association can confirm how it applies to you.
A written information security plan. The IRS asks tax professionals to keep one (IRS Publication 5708 is a template), and the PTIN renewal asks whether you have one. It describes how you protect client data; we put the technical parts in place and give you the evidence.
We fill in the technical sections (endpoint protection, patching, MFA, backups, access) and give you the reports that back them up. The policy decisions and staff sections stay with you, and we can walk you through them.
Yes. Cloud phones let you add seasonal staff for a few months, ring calls to cell phones, and set up a queue or after-hours message for the April rush.
Book a free review. We will check your current setup against the Safeguards Rule controls and tell you what is missing.
Book a free audit