FTC Safeguards Rule Audit Checklist for Tax Professionals: Are You Actually Ready?
The FTC Safeguards Rule does not give you advance notice before an examination. When a data breach occurs — or when the FTC decides to audit your compliance — you either have your documentation or you don't.
The Eight Sections to Check
- Your Written Information Security Plan itself — does it exist, is it current, is it signed?
- Your qualified individual, the designated security coordinator named under §314.4(a)
- All seven required written policy areas
- Your documented risk assessment
- Employee security awareness training and its completion records
- Vendor management — who touches client data and under what contract
- Annual review documentation
- Incident history and how each one was handled
Scoring Your Results
The checklist is scored so you can see whether you are examination-ready, partially documented, or exposed — and which specific gaps to close first.