What is Evolving Technology Solutions?

Evolving Technology Solutions manages 5 data types including leads. Helps you organize, track, and share your work in 1 place for teams and solo users.

Who needs to comply with the FTC Safeguards Rule?

The FTC Safeguards Rule applies to all financial institutions not subject to another regulator's safeguard rules, which includes CPA firms, tax preparers, mortgage brokers, auto dealers, payday lenders, and others that handle non-public financial information. The 2023 amendments substantially strengthened requirements, adding encryption, MFA, access controls, and the Qualified Individual obligation.

What is a WISP and what must it include?

A Written Information Security Program (WISP) is a documented, board- or management-approved security policy that describes how the organization protects client information. Under the FTC Safeguards Rule, a WISP must include: a risk assessment process, safeguard controls (technical, physical, administrative), vendor oversight procedures, an incident response plan, and an employee training program. The IRS Publication 4557 WISP requirements for tax preparers closely parallel the Safeguards Rule.

What is a Qualified Individual under the Safeguards Rule?

The FTC Safeguards Rule (16 CFR Part 314) requires covered institutions to designate a Qualified Individual responsible for overseeing, implementing, and enforcing the information security program. The Qualified Individual must report to senior management or the board at least annually. This role can be filled by an internal employee or an external service provider, which is exactly the function Evolv's vCISO serves.

How is managed IT priced vs break-fix?

Break-fix pricing is reactive: you pay per incident, which creates misaligned incentives and unpredictable costs. Managed IT is a fixed monthly fee per user or device, covering monitoring, patching, help desk, and security. For most 10-50-person firms, managed IT costs 20-40% less annually than equivalent break-fix spending, primarily because proactive maintenance prevents the expensive incidents that break-fix budgets absorb reactively.

⚠ DRAFT, Update with real client metrics and obtain written client approval before publishing. Metrics shown are placeholders.

Back to Case Studies

AccountingFTC Safeguards & IRS Pub 4557WISP

FTC Safeguards Rule Compliance: A Michigan CPA Firm's Path to Security

FTC Compliant

Safeguards Rule

WISP

Documented & Active

30% Lower

IT Cost vs Break-Fix

100%

Tax-Season Uptime

The Challenge

A Michigan CPA firm with 15 staff faced FTC Safeguards Rule and IRS Publication 4557 obligations, had no Written Information Security Program (WISP), and was relying on reactive break-fix IT, a structural risk during tax season when system downtime directly translates to missed client deadlines and revenue loss.

The Solution

Evolv's vCISO served as the firm's Qualified Individual under the FTC Safeguards Rule, owning the security program from documentation through ongoing operations.

✓vCISO appointed as Qualified Individual; annual board-level security report delivered on schedule
✓Developed a complete WISP aligned to FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557
✓Migrated from break-fix to managed IT with 24/7 SOC monitoring and SLA-backed response
✓Deployed MFA, EDR, and encrypted immutable backups across all workstations and tax-prep systems
✓Conducted annual risk assessment with documented risk register and remediation tracking

The Results

FTC Safeguards Compliant

The firm now has a documented WISP, a designated Qualified Individual, annual risk assessments, and technical controls that satisfy every element of the FTC Safeguards Rule.

WISP Documented

A complete, board-approved Written Information Security Program was delivered in the engagement's first 30 days, satisfying both FTC Safeguards and IRS Pub 4557 requirements.

30% Lower IT Cost vs Break-Fix

The predictable monthly managed IT fee replaced unpredictable break-fix invoices. Total annual IT spend fell roughly 30% while service quality and coverage increased substantially.

100% Tax-Season Uptime

Proactive monitoring and patch management eliminated the downtime incidents the firm had previously experienced during peak filing periods.

Frequently Asked Questions

Ready to check your FTC Safeguards compliance posture?

Get an FTC Safeguards Readiness Check from an Evolv vCISO.

Get a FTC Safeguards Readiness Check