If your business prepares tax returns, brokers mortgages, arranges car financing, collects debts or does bookkeeping for clients, the FTC probably counts you as a financial institution. That puts you under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314). A lot of Florida firms in that group have a written security plan somewhere in a shared drive. Far fewer can answer the first question the rule asks: who is your Qualified Individual?
The rule requires you to designate one person who is responsible for overseeing and implementing your information security program. Not a committee, not "our IT company." One named person. In a 12 person CPA office in Boca Raton or a family owned dealership in Ocala, that question tends to land on the managing partner or the office manager by default, and nobody writes it down.
The Qualified Individual owns the program. In practice that means the written risk assessment, the safeguards that come out of it (access controls, encryption of customer data, multi factor authentication for anyone accessing customer information, secure disposal, change management, logging), staff training, oversight of service providers, and the incident response plan.
They also have to report in writing, at least once a year, to your board or, if you have no board, to a senior officer. The report covers the overall status of the program and material issues like risk assessment results, testing, security events and recommended changes. Since May 2024 there is also a reporting duty to the FTC itself: if unencrypted customer information for 500 or more consumers is acquired without authorization, you have 30 days from discovery to file a notice through the FTC's online form.
Some relief exists for smaller shops. If you hold customer information on fewer than 5,000 consumers, you are exempt from the written risk assessment, the penetration testing and vulnerability scanning requirement, the written incident response plan and the annual report. You still need the Qualified Individual and the rest of the program. Plenty of tax practices cross 5,000 consumers once you count every return filed over the years that is still sitting on a server or in a cloud portal, so check that number carefully before you lean on the exemption.
Tax professionals have one more reason to care. The IRS PTIN application and renewal form has asked preparers for several years to acknowledge their data security responsibilities under the Safeguards Rule, and IRS Publication 5708 walks through building a written plan. If you checked that box, someone at your firm already signed up to be accountable.
The rule lets the Qualified Individual work for you, an affiliate or a service provider. That is where a fractional CISO fits. But read the conditions. If you use an outside person, your firm keeps responsibility for compliance, you have to name a senior member of your own staff to direct and oversee that person, and you have to require the provider to maintain a program that protects you.
Here is the mistake we see most. A firm assumes its managed IT provider is the Qualified Individual because the MSP handles the firewall and backups. Then nobody can produce a designation letter, a risk assessment or last year's report to the owners. The MSP was never asked to take the role, never agreed to it, and is usually the vendor the Qualified Individual is supposed to be overseeing. The person checking the work should not be the one doing it.
If you go outside, put it in writing. A short engagement letter or contract clause that names the person, describes the duties above, names your internal senior contact, and sets a date for the annual written report gives you something concrete to show an examiner, a cyber insurer or the IRS.
If you are not sure where you stand, start here:
None of this takes a large budget. It takes someone who owns it.
CMBNetworks serves as the outside Qualified Individual and fractional CISO for financial services firms, CPA practices and other businesses across South and Central Florida. Our practice is led by a former CISO of WMATA (the 2nd largest transportation organization in the United States) who holds the CISSP and C-CISO. If you want a second set of eyes on your Safeguards program or need someone to own it, get in touch.