GLBA Compliance Checklist for CPA Firms: You're a "Financial Institution" — Here's What That Requires

Most CPAs think of the Gramm-Leach-Bliley Act (GLBA) as a banking law. For a firm that prepares tax returns, it is also a data security law.

This GLBA compliance checklist walks through each requirement in the FTC’s Safeguards Rule in plain terms, so you can see what your firm already does and what it still needs to build.

Why Your CPA Firm Counts as a Financial Institution

The Safeguards Rule defines a financial institution as any business engaged in financial activities, and the federal regulations it references include tax planning and tax preparation for personal, family, or household purposes. The FTC’s own Safeguards Rule guidance tells businesses to check whether they fall under this definition, because many firms never realized they do.

The rule itself is codified at 16 CFR Part 314. The FTC finalized major amendments in October 2021, and most of the new requirements became fully effective on June 9, 2023. If your firm has not documented its program since then, you are working from an older standard than the one regulators will use.

You may also know this territory through the IRS. Publication 4557 covers safeguarding taxpayer data, and the IRS expects preparers to maintain a Written Information Security Plan (WISP). The two overlap heavily. A well-built WISP demonstrates that your Safeguards Rule program exists on paper and in practice.

Step 1: Designate a Qualified Individual

Your firm needs one person responsible for the information security program. The FTC says this Qualified Individual can be an employee or someone who works for an affiliate or service provider, and it ties the requirement to real-world know-how suited to your circumstances rather than a specific credential.

For a five-person firm, that can be a partner who works closely with your IT provider. If you outsource the role, you still own the outcome. The rule then requires you to name a senior person at the firm to direct and oversee the outside Qualified Individual, and the provider must maintain its own security program that protects your business.

Step 2: Complete a Written Risk Assessment

Everything else in the rule rests on this document. The FTC requires that your risk assessment be written and include criteria for evaluating the risks and threats your firm faces.

For a CPA firm, the risks are specific. Think about client Social Security numbers sitting in tax software such as Drake, UltraTax CS, or ProSystem fx Tax, bank statements arriving by email, a staff laptop that travels home, a shared drive nobody has audited in two years, and the client portal where clients upload documents. Write down where client data lives, who can reach it, and what could go wrong at each point. Then match each risk to a safeguard from the steps below.

Step 3: Lock Down Access, Add MFA, and Encrypt

This step carries the most technical weight. The rule requires access controls that limit who can reach customer information, and the Journal of Accountancy describes the obligation as regularly reevaluating whether each person’s access reflects a legitimate business need. A departed intern with an active login fails that test.

Multi-factor authentication (MFA) is now a baseline requirement. According to the FTC, the rule calls for at least two of the three factor types: something you know, such as a password; something you have, such as a token; and something you are, such as a fingerprint. It applies to anyone accessing customer information on your systems. If you use Microsoft 365, you can enable MFA in Microsoft Entra in an afternoon.

Encryption comes next. Customer information must be encrypted both when stored and when it travels over external networks. If encryption is not feasible for a given system, the FTC says you must secure the data with effective alternative controls approved by your Qualified Individual. Document that approval. An undocumented exception is just a gap.

Step 4: Know Your Data and Dispose of It on Schedule

You cannot protect what you have not mapped. Build an inventory of the systems, devices, and cloud services that handle client information, and keep it up to date as you add tools.

Disposal matters just as much. The rule directs firms to securely dispose of customer information no later than two years after the last time it was used to serve the client, unless a legitimate business or legal reason requires keeping it. Your retention policy should reflect that. Many firms keep every client file indefinitely out of habit, which widens the damage if a breach ever happens. Check your state board’s record-retention rules and engagement letter terms before you shorten anything, and write the reasoning into your WISP.

Step 5: Test and Monitor Your Safeguards

A program that has never been tested is a hypothesis. The rule requires regular testing of your safeguards, either continuous monitoring or, in its place, an annual penetration test plus a vulnerability assessment at least every six months and after any material change to your systems. Review the rule’s text with your IT provider to decide which route fits your firm.

Pair testing with change management. When you migrate to a new tax platform or open a remote office, revisit your risk assessment before the change goes live, not after.

Step 6: Train Your People and Oversee Your Vendors

The rule treats training as a requirement. The FTC expects security awareness training for your personnel, updated to reflect the risks identified in your assessment. Run it at onboarding and at least once a year. Teach phishing recognition with examples from tax season, such as a fake client email asking you to open a “corrected W-2.”

Vendors count too. Your tax software provider, cloud storage host, payroll processor, and outsourced IT support all handle client data on your behalf. The rule requires you to choose service providers that can maintain appropriate safeguards, put those expectations in your contracts, and periodically check that they deliver. Ask each vendor for a recent security report or attestation, and file the response with your WISP.

Step 7: Write an Incident Response Plan and Know the FTC Reporting Rule

The rule requires a written incident response plan that covers what your firm will do if something goes wrong. It should define roles, internal and external communication, how you will contain and investigate an event, and how you will fix weaknesses afterward.

Since 2024, the plan also needs to account for FTC reporting. The FTC requires financial institutions to notify the Commission as soon as possible, and no later than 30 days after discovery, of a security breach involving the information of at least 500 consumers. The trigger is the unauthorized acquisition of unencrypted customer information, and the rule presumes unauthorized acquisition unless you have reliable evidence to the contrary. That presumption means more incidents will qualify than many firms expect.

Notice to the FTC does not replace your state obligations. Firms still rely on state breach notification laws to determine whether and how to notify affected individuals. Your plan should name the people who will make both calls, as well as your cyber insurance carrier and legal counsel.

Step 8: Report to Leadership and Keep the Program Current

The Qualified Individual must report in writing to the firm’s board of directors or equivalent governing body, at least annually. In a partnership, that means a written update to the partners covering the program's status, risk assessment findings, security events, and recommended changes. The report creates a paper trail and forces the conversation about budget and priorities.

Treat the program as a living document. Because your systems and networks change, the FTC warns that your safeguards can’t be static. Revisit the risk assessment when you adopt a new application, lose a key employee, or learn about a new fraud pattern aimed at tax professionals.

Small-Firm Exemption: Fewer Than 5,000 Consumers

The rule relaxes four requirements for firms that maintain customer information on fewer than 5,000 consumers. The rest applies to every firm, and that includes the FTC breach notice.

Count carefully. Five thousand consumers is a total, not an annual figure, and a firm with years of accumulated returns and former clients can pass the line without noticing. Even if you qualify, writing the risk assessment and response plan is the smarter move anyway, since the IRS expects a WISP from every preparer, regardless of size.

Where to Start Your GLBA Compliance Checklist This Month

Pick your Qualified Individual first, because every other task needs an owner. Next, run through your client data and list every place it lives. Turn on MFA everywhere it is missing, since that closes the largest gap fastest. Then draft your WISP using the FTC’s compliance guide and the IRS’s Publication 5708 as a template, and tailor it to how your firm actually works.

This checklist gives you a map, not legal advice. Have your IT provider test your technical controls, and your attorney confirm how the rule applies to your specific services and client base. A strong firm can hand a regulator a current written program, a dated risk assessment, and a record of annual training. Don’t wait until after busy season.