FTC Safeguards Rule recordkeeping guide
The FTC Safeguards Rule does not just require you to implement security controls. It requires you to prove it. This guide covers every record you need to keep, how long to keep it, and how to organize your documentation.
Overview
Why recordkeeping matters under the Safeguards Rule
The FTC's revised Safeguards Rule (16 CFR Part 314), which took full effect on June 9, 2023, significantly expanded the obligations of financial institutions, a category that explicitly includes tax return preparers. The rule requires not just that you maintain an information security program, but that you can demonstrate compliance through comprehensive documentation.
Under Section 314.4(h), your Qualified Individual must report in writing at least annually to your board of directors or equivalent governing body. That report must cover the overall status of the information security program and your compliance with the rule. Without proper records, that report is impossible to produce accurately.
In an enforcement action, the FTC will ask for documentation. Firms that cannot produce records of their risk assessments, security testing, employee training, and incident responses face significant penalties. The FTC has imposed fines exceeding $100,000 on firms that lacked adequate documentation, even when their actual security posture was reasonable.
$100K+
Potential FTC fines for documentation failures
5-7 yrs
Minimum record retention period
6
Major record categories to maintain
Records Required
What records you must keep
The FTC Safeguards Rule requires documentation across six major categories. Each category below lists the specific records you need.
Risk Assessment Documentation
Retain: Minimum 5 years after completionYour risk assessment is the foundation of your entire information security program. The FTC requires that you document the process, findings, and remediation plans.
- Written risk assessment report identifying internal and external threats
- Inventory of all systems, devices, and locations where customer information is stored
- Vulnerability scan results and penetration test reports
- Risk ratings for each identified threat (likelihood and impact)
- Remediation plans with timelines for addressing identified vulnerabilities
- Evidence of re-assessments conducted after material changes to operations
Security Program Documentation
Retain: Current version plus 5 years of prior versionsThe written information security program itself must be documented and updated regularly. Keep all versions to demonstrate your program has evolved with changing threats.
- Written Information Security Plan (WISP) with all amendments
- Access control policies and role-based permission matrices
- Encryption standards and key management procedures
- Incident response plan with contact lists and escalation procedures
- Change management logs showing when and why the plan was updated
- Board or management approval records for the security program
Training and Awareness Records
Retain: Duration of employment plus 3 yearsThe FTC Safeguards Rule requires that personnel are trained on your security program. You must prove training occurred and that employees understood the material.
- Annual security awareness training completion certificates
- Training materials and presentation slides used in each session
- Attendance records with dates, trainer names, and topics covered
- Signed employee acknowledgment forms for security policies
- Records of specialized training for IT staff and the Qualified Individual
- Phishing simulation results and follow-up remedial training records
Monitoring and Testing Records
Retain: Minimum 5 years from date of testThe amended Safeguards Rule requires continuous monitoring or annual penetration testing and semi-annual vulnerability assessments. Document every test.
- Annual penetration test reports from qualified testing firms
- Semi-annual vulnerability assessment scan results
- Continuous monitoring system logs and alert histories
- Remediation records showing how identified issues were resolved
- Third-party audit reports and compliance certifications
- Access log reviews and anomaly investigation records
Incident Response Records
Retain: Minimum 7 years from incident dateEvery security incident, whether confirmed or suspected, must be documented from detection through resolution and post-incident review.
- Incident detection logs with timestamps and initial classification
- Investigation notes, forensic analysis reports, and evidence preservation records
- Notification records (IRS, FTC, state attorneys general, affected individuals)
- Remediation actions taken and timeline for implementation
- Post-incident review findings and program improvements made
- Law enforcement reports if applicable
Vendor and Service Provider Records
Retain: Duration of relationship plus 5 yearsTax preparers who use third-party services like cloud storage, IT support, or tax software must document their vendor oversight activities.
- Vendor due diligence assessments and security questionnaire responses
- Contracts with data protection and confidentiality clauses
- Service Level Agreements (SLAs) with security requirements
- Annual vendor review reports and compliance certifications
- Records of vendor security incidents and their resolution
- Subprocessor lists and approval records
Retention Schedule
How long to retain each record
The FTC does not specify exact retention periods for every document type. These minimums are derived from the rule, FTC enforcement actions, and industry best practices.
| Document | Minimum | Recommended |
|---|---|---|
| Written Information Security Plan (WISP) | 5 years | Permanently (all versions) |
| Risk assessment reports | 5 years | 7 years |
| Penetration test and vulnerability scan reports | 5 years | 7 years |
| Employee training records | Employment + 3 years | Employment + 5 years |
| Security incident reports | 7 years | 10 years |
| Access logs and audit trails | 3 years | 5 years |
| Vendor assessments and contracts | Relationship + 5 years | Relationship + 7 years |
| Qualified Individual reports to board | 5 years | 7 years |
| Policy change and approval records | 5 years | Permanently |
| Data disposal certificates | 5 years | 7 years |
Best Practices
Documentation best practices
Use a Centralized Document Management System
Store all compliance records in a single, encrypted, access-controlled repository. Avoid scattering documents across shared drives, email inboxes, and paper filing cabinets. A centralized system makes it easy to retrieve records during an audit or investigation.
Version Control Everything
Whenever you update a policy, risk assessment, or procedure, save the previous version with a date stamp. The FTC may ask you to demonstrate how your security program evolved over time. Version control also helps you prove compliance at any given point in the past.
Automate Where Possible
Use automated tools for access logging, training tracking, and vulnerability scanning. Automated records are timestamped, tamper-resistant, and far more reliable than manual logs. They also reduce the administrative burden of maintaining compliance documentation.
Schedule Regular Record Reviews
Set calendar reminders to review your records quarterly. Verify that training records are current, incident logs are complete, and retention schedules are being followed. Assign a specific person to own this process.
Prepare an Audit Response Package
Pre-assemble a package of your most critical documents that you could hand to a regulator or auditor on short notice. Include your current WISP, latest risk assessment, recent test results, and training records. Update this package after every major change.
Protect Your Records with the Same Rigor as Client Data
Your compliance documentation may contain details about your security architecture and vulnerabilities. Treat these records as sensitive. Apply encryption, access controls, and backup procedures to your compliance files just as you would to taxpayer data.
Let us handle your compliance documentation
Managing FTC Safeguards Rule recordkeeping on your own is time-consuming and error-prone. Our compliance team builds, maintains, and organizes your documentation so you can focus on serving your clients.