A GDS Technology resource · Serving businesses since 2005 GA 404-719-5222 IN 317-663-9743
Free assessment
Security & Compliance

Financial data rules apply to more businesses than you might think

If you prepare tax returns, offer financing, or accept credit cards, you likely have specific security obligations. We help you understand which rules apply, put the required controls in place, and keep them working.

Book a discovery call
Sound familiar?

You probably need this if…

  • You are a CPA firm or tax preparer without a written information security program
  • No one at your firm has been formally designated to oversee information security
  • Multi-factor authentication is not enforced for everyone who accesses client data
  • Your annual PCI self-assessment questionnaire feels like a guessing game
  • Card payments run on the same network as your office computers and guest Wi-Fi

The FTC Safeguards Rule: who it covers

The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, applies to non-bank financial institutions. That category is broader than many owners realize. It includes tax preparers and CPA firms, mortgage brokers, auto dealers that offer financing, and other businesses that handle consumer financial information. If your firm prepares individual tax returns, the Safeguards Rule very likely applies to you, and the IRS reinforces that expectation for tax professionals.

The rule requires a written information security program built around a risk assessment. It also calls for specific elements, including designating a qualified individual to oversee the program, implementing access controls, encrypting customer information in transit and at rest, using multi-factor authentication for anyone accessing customer information, monitoring and testing your safeguards, training staff, overseeing service providers, and having an incident response plan. Certain notification obligations can also apply after a security event.

PCI DSS: protecting cardholder data

The Payment Card Industry Data Security Standard is a set of requirements set by the major card brands and enforced through your merchant agreement. It applies to any business that stores, processes, or transmits cardholder data. The current version, PCI DSS v4.0, places greater emphasis on continuous security, stronger authentication, and clearly defined roles and responsibilities, rather than a once-a-year checkbox exercise.

For most small and mid-sized merchants, the biggest lever is reducing scope. Using validated point-to-point encryption terminals, hosted payment pages, or tokenization can keep card data out of your systems entirely, which simplifies your obligations considerably. Network segmentation, which keeps payment systems separate from office computers and guest Wi-Fi, is another practical step. The right approach depends on how you take payments today.

How we help you get there and stay there

We start by identifying which requirements apply and where you stand. For Safeguards Rule clients, that means a documented risk assessment and a gap analysis against the rule's required elements. For PCI, it means mapping how card data flows through your business and determining which self-assessment questionnaire fits. Many firms are subject to both, and we address them together so the work is not duplicated.

Then we close the gaps. We help you draft a written information security program that reflects reality, roll out multi-factor authentication, encrypt laptops and file storage, segment your network, configure logging and monitoring, and train staff to spot phishing during busy season. Because our team also provides managed IT, your controls are maintained as part of daily operations, not left to drift until the next questionnaire.

Compliance is your organization's responsibility, and we cannot guarantee the outcome of any audit, examination, or assessment. What we bring is GC3-certified compliance expertise, experience supporting CPA firms and professional services businesses, and a practical approach that protects your clients' financial information while letting your team keep working. Security controls that get in the way during tax season tend to get bypassed, so we design them to hold up under real pressure.

What's included

What you get with FTC Safeguards & PCI Compliance

  • Applicability review for the FTC Safeguards Rule and PCI DSS
  • Documented risk assessment and gap analysis
  • Written information security program development
  • Support for your designated qualified individual
  • Multi-factor authentication and encryption implementation
  • Cardholder data flow mapping and scope reduction recommendations
  • Network segmentation for payment systems
  • Staff security training and ongoing control monitoring
Talk to an engineer, not a salesperson

Book a 15-minute discovery call

Tell us what is frustrating you about your IT today. We will tell you honestly whether we can fix it — and how.

  1. 1A 15-minute call with an engineer — no sales script.
  2. 2We listen to what is broken and what you need.
  3. 3You get an honest recommendation, even if it is not us.
Prefer to talk now? 404-719-5222 IN 317-663-9743

Delivered by GDS Technology. Learn more about GDS Technology ↗

Reply within one business day · No obligation

Frequently asked questions

Does the FTC Safeguards Rule really apply to small CPA firms?

In most cases, yes. Tax preparers and accounting firms that handle consumer financial information are generally treated as financial institutions under the rule. Some requirements scale with the number of consumers whose information you maintain, so we help you determine exactly what applies to your firm.

Who should be our qualified individual?

The qualified individual oversees and enforces your information security program. It can be someone on your staff or someone at a service provider, but your firm remains responsible for compliance and must provide oversight. We can support whoever fills that role with the expertise and reporting they need.

We use a payment processor. Doesn't that make us PCI compliant?

Not automatically. A processor can reduce your scope significantly, especially with hosted payment pages or encrypted terminals, but you still have responsibilities, including completing the appropriate self-assessment and securing any systems that interact with payments.

Can one program cover both the Safeguards Rule and PCI DSS?

Much of the work overlaps, including risk assessment, access control, MFA, encryption, logging, and training. We build one coherent security program and map it to each set of requirements so you are not maintaining two parallel efforts.

Popular with

CPA & Accounting Firms

Related solutions

Cybersecurity & 24/7 Monitoring

Layered protection and around-the-clock monitoring that catch threats early, backed by certified incident responders when it matters most.

Learn more

Managed IT Services

Proactive, fully managed IT with US-based, in-house support, so your team stops fighting technology and gets back to work.

Learn more

Backup & Disaster Recovery

Backups that are monitored, protected from ransomware, and actually tested, plus a recovery plan your team can follow on a bad day.

Learn more
Call Book a free call