CASE STUDIES - FTC SAFEGUARDS RULE COMPLIANCE
Case Studies
FTC Safeguards Rule Compliance for a California CPA Firm
A California accounting firm built a practical written information security program before later FTC Safeguards Rule revisions expanded compliance expectations.
Project Name
FTC Safeguards Rule Compliance Program
Our Role
Information Security Governance, Assessment, and Training
Client / Case Background
A partner from a mid-sized California CPA firm attended an annual conference and learned about the FTC Safeguards Rule requirement for covered tax preparers to maintain a written information security program.
Challenge and Approach
Maryman was engaged not only to conduct an information security assessment, but also to review the IT infrastructure for compliance with commercially reasonable IT standards as they related to the FTC requirements.
Maryman provided policies and standards that made up the written information security program (WISP), a formal framework for managing information security; provided awareness training designed to comply with those policies and standards; and conducted a comprehensive 200-item gap analysis of the management of the IT infrastructure.
Key Findings
- The firm promptly created an information security committee.
- One of the partners was designated as the Information Security Manager.
- Maryman provided ongoing monthly support for the committee.
Outcome and Impact
An unexpected benefit was that, when the FTC later updated and revised the Safeguards Rule, the CPA firm was already in compliance with most of the revisions.