The FTC Already Wrote Your Firm's Password Rules — Most Firms Fail Them

Your firm probably has a password policy. It may be a sticky note, a shared spreadsheet, or a verbal rule that the front desk login is “the same as always.” The FTC has already published what it expects instead, in plain language, and it takes about ten minutes to read. Put the two side by side, and the gaps show up quickly.

This post scores a small CPA firm against the FTC’s own password guidance and the Safeguards Rule duties behind it. The checklist groups the FTC’s examples into five practices: long, unique passwords; no shared logins; secure credential storage; brute-force lockout; and multi-factor authentication for sensitive accounts. Shared logins get their own section, because they fail the Rule itself.

What Password Rules Has the FTC Actually Published?

The source is the FTC’s Stick with Security blog post on passwords and authentication. It expands one chapter of the FTC’s Start with Security guide, which draws its lessons from the agency’s data security enforcement cases.

The post covers the following points:

• Long, unique passwords. The FTC calls obvious choices like “qwerty” a “hack me” sign and says passphrases and longer passwords are generally harder to crack. It also says to change default passwords on new software and hardware immediately.
• Secure storage. Even a strong password fails if someone writes it on a sticky note or shares it. The FTC’s example of a failure is a company keeping credentials in a plain-text word processing file on its network.
• Brute-force protection. Automated programs guess passwords at scale, so systems should suspend or disable credentials after a set number of failed attempts.
• More than a password on sensitive accounts. Because people reuse passwords, the FTC says accounts with access to sensitive data should combine multiple authentication techniques. Its examples include an authenticator app code and a key fob.
• No shared credentials. The FTC describes a business where everyone types the same shared password to reach the network, and it calls the more prudent policy strong, unique passwords for each employee.

The FTC does not number these “the five rules.” That grouping is a working checklist built from its own examples, and it covers most of what the agency has said about passwords.

How Do the FTC’s Password Rules Map to the Safeguards Rule?

The Safeguards Rule is the binding part. The FTC’s compliance guide lists tax preparation firms among the financial institutions it covers. The IRS has reminded tax professionals that federal law requires a written information security plan and that FTC standards now require multi-factor authentication to protect client information.

Section 314.4 of the Rule sets out what that plan must include, and three items bear directly on sign-in habits.

1. Access controls. You must determine who has access to customer information and periodically reconsider whether each person still has a business need for it.
2. Multi-factor authentication. Anyone accessing customer information on your system needs at least two factor types, such as a password plus a token or a biometric. The only exception is an equivalent control that your Qualified Individual approves in writing.
3. Activity logging. You must maintain a log of authorized users’ activity and watch for unauthorized access.

There is a distinction to keep straight. MFA, access review, and logging come from the Rule itself. Password length, lockout, and storage are based on FTC guidance. Still, that guidance describes what the agency has treated as security failures in its cases, and the Rule asks for a program that fits your firm’s size and the sensitivity of the data. Tax returns are about as sensitive as client data gets, so a firm that ignores the FTC’s own examples will have a hard time calling its program reasonable.

Why Are Shared Logins a Safeguards Rule Problem?

The FTC’s blog also warns against passwords that people share, and the Rule’s definition of an authorized user covers any employee, contractor, or agent allowed into your systems. Each of those people needs their own credential.

Which Password Rules Do Small CPA Firms Usually Fail?

To score the firm, give each of the five a pass, partial, or fail, and write down what evidence you checked and when. Unless the firm holds customer information on fewer than 5,000 consumers, former clients included while their files are kept, the Rule expects a Qualified Individual to report in writing at least annually to a board or senior officer on the program's compliance, and a dated one-page scorecard fits directly into that report. A firm under the line is exempt from the report (§ 314.6) but still owes every item scored here. The remediation list is usually shorter than owners expect, and most items are a setting to change or a subscription to add.

Key Takeaways

• The FTC has already published the authentication baseline: long, unique passwords; no shared logins; secure credential storage; brute-force lockout; and MFA on sensitive accounts.
• Shared logins and missing MFA fail the Safeguards Rule’s access-control, logging and MFA duties directly; weak length, lockout and storage fall short of the FTC’s own published examples.
• Shared logins are the item that small firms most often keep, and they defeat both attribution and revocation.
• Score the firm against the five points in writing, with the evidence checked and the date; the remediation list is usually shorter than owners expect.

For CPA firms

Score your firm’s logins with PK Tech

PK Tech has worked with CPA firms as a managed IT provider for more than 16 years, and holds AICPA SOC 2 Type II attestation from an independent audit. Bring a list of the accounts more than one person signs in to.

Schedule a compliance review →