---
title: "What is ftc safeguards rule?"
description: "Ftc Safeguards Rule explained in plain English: definition, how it works, an example, and how it appears in QuickBooks and Xero."
url: https://ledgerbpo.com/glossary/ftc-safeguards-rule/
updated: 2026-09-11
publisher: LedgerBPO (SS Support Network LLC)
language: en-US
---

# What is ftc safeguards rule?

Glossary

The FTC Safeguards Rule is a US Federal Trade Commission regulation requiring financial institutions, a category that includes tax preparers and accounting firms, to maintain a written information security program protecting customer financial data. It sets specific requirements including access controls, encryption and multi-factor authentication.

Updated September 2026

## How ftc safeguards rule works

The rule requires a designated qualified individual to oversee a written information security program, often called a WISP, covering risk assessment, access controls, encryption of customer data at rest and in transit, and monitoring for unauthorized access. Firms must also require multi-factor authentication for anyone accessing customer information systems.

Beyond internal controls, the rule requires firms to oversee service providers that handle customer data on their behalf, including contractual requirements to maintain adequate safeguards, and to have an incident response plan for security events. Regular testing and monitoring of the program, along with staff training, are also part of maintaining compliance. Smaller firms sometimes assume the rule only applies to banks or large lenders, but the FTC's definition of a financial institution specifically includes tax preparation services and any business that regularly provides financial advice or handles customer financial information as part of its services.

## Example

A tax preparation firm implements MFA for all staff accessing its client portal and tax software, encrypts client files stored in the cloud, and documents its WISP covering these controls plus an incident response plan. When it brings on an outsourced bookkeeping team, it adds a written requirement that the vendor maintain equivalent safeguards over shared client data. The firm's qualified individual reviews the WISP annually, updating it whenever a new tool, vendor or significant change to how customer data is handled is introduced during the year.

## FTC Safeguards Rule in QuickBooks Online vs Xero

Not software-specific: the Safeguards Rule is a compliance framework rather than a feature inside QuickBooks Online or Xero, though both platforms support the underlying controls, such as MFA, user-level permissions and encrypted data storage, that a WISP typically relies on. Firms document how their software configuration meets each requirement as part of the written program.

## Related terms

- [IRS Section 7216](https://ledgerbpo.com/glossary/irs-section-7216/)
- [SOC 2](https://ledgerbpo.com/glossary/soc-2/)
- [ISO 27001](https://ledgerbpo.com/glossary/iso-27001/)
- [All terms](https://ledgerbpo.com/glossary/)

## How LedgerBPO handles ftc safeguards rule

We maintain MFA, encrypted data handling and access controls across our own systems, so accounting firms bringing us on as a service provider have the documentation they need to meet their own Safeguards Rule obligations. Details on our specific controls are covered on our security page.

[How we protect your financial data](https://ledgerbpo.com/security/)

Next step

## Books closed. Invoices paid. Every month.

Tell us what is going on with your books or billing. You will hear from a named person within 1 business day, with a custom quote and a plan for the first close.

- Reply from a named person within 1 business day
- No setup fee, month-to-month
- Your software, your data, no lock-in

Start with a custom quote

[Get a custom quote](https://ledgerbpo.com/get-a-quote/) [Book a 20-minute call](https://ledgerbpo.com/book-a-call/) Or call [+1-657-777-0006](tel:+16577770006) during US, UK or Australian business hours.

---

Source: https://ledgerbpo.com/glossary/ftc-safeguards-rule/ · Contact: https://ledgerbpo.com/contact/ · Full site map for agents: https://ledgerbpo.com/llms.txt