GLBA
You're a "financial institution"
The FTC Safeguards Rule names tax preparation firms as covered financial institutions. Your security program must be written and fit your firm's size and complexity.
FTC Safeguards guide · 16 CFR 314For CPA & tax firms · Plymouth, Norfolk & Bristol Counties
Is your firm Safeguards-ready, or just hoping?
Under the Gramm-Leach-Bliley Act, the FTC treats tax and accounting firms as financial institutions, regardless of size. Take the 6-minute readiness check built on the FTC Safeguards Rule and IRS Publication 4557, and get a scored report you can act on today.
Why it matters
30 days
New breach-notice clock
Since May 13, 2024, a breach of unencrypted data involving 500+ consumers must be reported to the FTC within 30 days of discovery.
16 CFR 314.4(j)PTIN
Your PTIN renewal asks about it
Form W-12 line 11 asks paid preparers to acknowledge that they are required by law to create and maintain a written information security plan (WISP). IRS Pub 5708 shows how.
Form W-12 instructions · IRS Pub 4557 & 570801
Answer 25 questions
Yes, partial or no, mapped to each Safeguards Rule element and Pub 4557 practice.
02
See your score
Overall readiness, scores by area, and a risk level.
03
Get your 90-day plan
Prioritized gaps in plain English, a 30/60/90-day plan, an evidence checklist and a branded PDF to share with your partners.
Private by design: your answers stay in this browser. Nothing is sent anywhere.
Provided by All Business Technologies. Not affiliated with or endorsed by the FTC or IRS.
Question 1
Question
Why this matters
All 25 answered
Your report is ready to unlock
Tell us who the report is for. We'll put these details on your results and the PDF.
- Overall readiness score & risk level
- Scores for all 7 control areas
- Prioritized fix-list and 30/60/90-day plan
- Evidence binder checklist
- Branded, shareable PDF report
Stays in your browser. Nothing is submitted or stored on a server.
Readiness report ·
Your firm
Prepared for
-
0In place
0Partial
0Gaps
Control area profile
7 areas · weightedScores by control area
Critical gap
MFA, a written security program (WISP) and encryption are critical safeguards. While any of them is answered No or Not sure, your risk level cannot be Low.
How your score works
- Weights. Each question is weighted by impact: core and critical controls count 3, high-impact controls 2, standard controls 1.
- Answers. Yes earns full credit, Partially earns half, and No or Not sure earn zero. "Not sure" counts as a gap because you can't rely on a control you can't verify.
- Critical-control cap. If MFA, your written security program (WISP) or encryption at rest or in transit is No or Not sure, your score is capped at 84 and your risk level cannot be Low.
- Risk levels. 85 to 100 is Low, 65 to 84 Moderate, 40 to 64 High, and below 40 Critical. ABT set these weights and bands; they are not defined by the FTC or IRS.
- Small firms. With customer information on fewer than 5,000 consumers, 16 CFR 314.6 exempts four elements: the written risk assessment, pen testing and vulnerability scans, the written incident response plan, and the annual report. They are shown as "Best practice at your size" and left out of your score. Everything else, including assessing risk and testing or monitoring your safeguards, still applies. This was applied to your report.
Your prioritized fix-list
What you're doing well
Your 30/60/90-day plan
Critical gaps and quick wins come first, then larger projects, then the documents and policies that tie it together. Each item is tagged with the effort it usually takes.
Evidence binder
The documents a regulator, cyber insurer or client is likely to ask for, based on your answers. Ready means you answered Yes; Incomplete means partly in place; Missing means No or Not sure.
Want these gaps closed before your next tax season?
ABT has run IT and cybersecurity for Boston-area businesses since 2003, including CPA and tax practices. We'll walk through this report with you and build a practical plan to close the gaps.
ABT handles every item on this list as a managed service.