Vendor Oversight Under the FTC Safeguards Rule

Your tax software, client portal, cloud storage, and IT provider all handle client data on your behalf. Under the FTC Safeguards Rule (16 CFR 314.4(f)), overseeing those service providers is part of your written information security program. This guide covers how to map your vendors, what to check before you sign, what belongs in the contract, and the records to keep.

Why vendors are part of your WISP

Every tool that touches client data extends your risk. If a portal is misconfigured, a former IT contractor still has access, or a backup service stores files unencrypted, the exposure is your clients' data — and your firm's responsibility. The rule doesn't let you hand off accountability along with the data. Your WISP has to show that you chose providers who can protect the information, required them to do so, and kept checking.

Map your vendors

Start with a list of every service that stores, processes, or can access client information. Most tax and accounting firms will have some version of: tax software, a client portal, e-signature, cloud storage, email, payroll, an IT provider or MSP, a shredding service, and backup. Use a simple table like this one and fill in a row for each:

"Access method" means how the vendor reaches your data — a web login, remote access to your computers, physical pickup of paper, or an integration with another system. That column often shows which vendors carry the most risk.

Before you sign

The rule asks you to select providers capable of maintaining appropriate safeguards. Before adding a vendor, ask:

• How do you protect our data? Ask for a short written description of their security program.
• Do you have a SOC 2 report? Where one is available, request it and keep a copy. Where it isn't, a security questionnaire or written answers serve as your due diligence.
• Do you support MFA? Every account your staff uses to reach client data should be able to require it.
• Is data encrypted? Both in transit and where it's stored.
• Will you notify us of a breach? Get a clear commitment on how quickly and how they'll tell you.

In the contract

The rule requires you to make service providers implement and maintain safeguards by contract. Your agreement, terms of service, or a separate data protection addendum should include the vendor's security obligations for your clients' information and a commitment to prompt breach notification. For services with standard terms you can't negotiate, read those terms, confirm they address security and notification, and keep a copy with the date you accepted them.

Ongoing oversight

• Review annually. Fold vendor review into your annual WISP review: confirm each vendor is still needed, still meets your requirements, and has no unresolved security issues.
• Remove unused vendors. Old trial accounts and abandoned tools often still hold client files.
• Revoke access when you stop using a service. Close the account, remove its connections to your other systems, request deletion or return of your data, and disable any remote-access tools an old IT provider installed.

Evidence to keep

• Your vendor list — the table above, kept current.
• Review dates — when each vendor was last assessed and by whom.
• Security documentation — SOC 2 reports, questionnaires, contracts or accepted terms, and breach-notification commitments.

These records show an insurer, the IRS, or the FTC that vendor oversight actually happens. For the full list of Safeguards Rule elements, see the FTC Safeguards Rule WISP checklist.

Frequently asked questions

Get Your Compliance Score