FTC Safeguards Rule and IRS Publication 4557: A Security Compliance Guide for Accounting Firms

The FTC Safeguards Rule, in plain terms

Under Section 314.4(f), a covered firm must oversee its service providers by contract: requiring any provider with access to customer information to take appropriate steps against unauthorized access or use. The firm has to vet providers before engaging them and keep only ones capable of maintaining appropriate safeguards, as ongoing due diligence, not a one-time check at signing.

The rule also requires a named “Qualified Individual” who owns security oversight. A vendor can fill that role under the rule’s provisions, but the covered firm stays ultimately responsible for compliance either way.

Offshore outsourcing is explicitly within scope here: using offshore employees counts as offshore outsourcing even when the contracting company is itself based in the US.

IRS Publication 4557’s 6 baseline controls

Pub 4557 was developed with the IRS Security Summit as outreach material to help preparers meet the FTC rule. It names 6 baseline protections every preparer is expected to have in place:

• Antivirus software
• Firewalls
• Multi-factor authentication
• Regular backups
• Drive encryption
• A VPN for any remote access

What a vendor contract needs to cover

1. A written requirement that the provider implement specific, named security measures, not a general promise to “keep data safe.”
2. Documented due diligence before the engagement starts: security questionnaires, and ideally a remote or on-site assessment of the provider’s controls.
3. Clear incident-notification terms: what counts as an incident, and how fast the provider must tell the firm.
4. Confidentiality and data-handling terms that survive the end of the engagement, not just while it’s active.

Where this is separate from the consent requirement

This is a different legal question from whether a specific tax return can be sent offshore at all, which is governed by IRC Section 7216 and covered in our separate guide to that requirement. A firm can have a fully compliant vendor-security contract under the FTC rule and still violate Section 7216 by sending a specific return offshore without the taxpayer’s consent on file. The two requirements are independent and both apply.

How to evaluate whether a provider actually meets this bar

See our buyer’s checklist for evaluating an offshore accounting provider for the specific questions to ask about a provider’s security controls, access model and data location before signing.

Sources

• 16 CFR Part 314 (FTC Safeguards Rule), primary text not fetched directly in this research; summarized from CPA-practice compliance coverage (CPA Practice Advisor) and a Norton Rose Fulbright summary
• IRS Publication 4557, Safeguarding Taxpayer Data

This guide is general information, not legal advice. Confirm current requirements and your own firm’s compliance status with qualified counsel.