Safeguards Rule Evidence Binder
Firm contact: owner@example-tax-practice.comProgram start: 2025-11-04Consumer information held: Fewer than 5,000 consumersCompiled: 2026-10-11
This binder records the steps this firm has taken under the FTC Safeguards Rule, 16 CFR Part 314. Each entry is dated and cites the subsection it relates to. Entries were recorded by the firm; Policywright compiles them and does not verify that the underlying work was performed. This is a compliance record, not legal advice, and it does not constitute an audit or certification.
1. Duty register
| Duty | Citation | Status | Last performed | Next due | Record |
|---|---|---|---|---|---|
| Confirm your Qualified Individual | 16 CFR 314.4(a) | Current | 2026-01-12 | 2027-01-12 | Confirmed the owner remains the Qualified Individual. No change of personnel. |
| Redo your risk assessment | 16 CFR 314.4(b) | Current | 2026-02-03 | 2027-02-03 | Walked the risk list. New this year: moved client intake to a portal, removed the shared office scanner from the network. |
| Review who has access | 16 CFR 314.4(c)(1) | Current | 2026-07-21 | 2027-01-21 | Reviewed logins to Drake, the portal, Google Workspace and the bank. Removed the seasonal preparer who left in May. |
| Verify multi-factor authentication | 16 CFR 314.4(c)(5) | Current | 2026-08-02 | 2027-08-02 | MFA confirmed on all four systems holding client data. Bank was the last one, switched on 2 August. |
| Dispose of stale client data | 16 CFR 314.4(c)(6) | Current | 2026-05-30 | 2027-05-30 | Shredded 2018 and 2019 paper returns past the retention period. Two boxes, witnessed by the owner. |
| Train your people | 16 CFR 314.4(e) | Current | 2026-03-18 | 2027-03-18 | Annual security awareness session. Phishing, portal use, and what to do on a suspected breach. |
| Assess your service providers | 16 CFR 314.4(f) | Overdue | 2025-12-09 | 2026-09-09 | Initial assessment of the three providers below at program start. |
| Evaluate and adjust the program | 16 CFR 314.4(g) | Due within 30 days | — | 2026-11-04 | — |
| Check your breach notification readiness | 16 CFR 314.5 | Overdue | 2026-02-03 | 2026-08-03 | Read the notification deadlines for Colorado and confirmed who gets called first. |
1 of the duties above has no recorded performance date. They are listed here rather than omitted, because a binder that hides its own gaps is worth less than no binder at all.
2. Duties not required at this firm's size
16 CFR 314.6 exempts a financial institution that maintains customer information concerning fewer than five thousand consumers from the following requirements, and from no others. This firm has recorded that it falls below that threshold.
| Requirement | Citation |
|---|---|
| Written risk assessment with required contents | 16 CFR 314.4(b)(1) |
| Penetration test and vulnerability assessments | 16 CFR 314.4(d)(2) |
| Written incident response plan | 16 CFR 314.4(h) |
| Annual written report to the board | 16 CFR 314.4(i) |
Written incident response plan (16 CFR 314.4(h)). Your Policywright packet includes this plan anyway. At your size the rule does not require it — we include it because the first hour of a real incident is not the time to be inventing a process.
3. Security awareness training
Recorded under 16 CFR 314.4(e).
| Date | Person | Topic | Note |
|---|---|---|---|
| 2026-03-18 | Owner | Phishing and client-portal handling | Covered the two fake-IRS emails received in February. |
| 2026-03-18 | Seasonal preparer | Phishing and client-portal handling | Completed before first client file was opened. |
4. Service provider register
Recorded under 16 CFR 314.4(f), which requires the firm to select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them based on the risk they present.
| Provider | What they access | Last assessed | Contract requires safeguards | Note |
|---|---|---|---|---|
| Tax preparation software provider | Return data, SSNs, bank details for refunds | 2025-12-09 | Yes | SOC 2 report requested and read. Terms include a security addendum. |
| Cloud office and email provider | Email, documents in shared drives | 2025-12-09 | Yes | Standard data processing terms accepted. |
| Offsite backup provider | Encrypted backups of the whole file store | — | No | Added in June. Contract does not yet require safeguards. Flagged for the overdue assessment. |
1 provider has no assessment date recorded.
5. Activity log
Every entry below was written when the action was recorded and is never edited or deleted. This is the audit trail behind the tables above.
| When | Event | Detail |
|---|---|---|
| 2025-11-04T16:20:00Z | Compliance Year began | — |
| 2025-11-04T16:22:00Z | Firm recorded its consumer count band | band: under_5000 |
| 2025-12-09T14:02:00Z | Service provider added to the register | vendor: Tax preparation software provider |
| 2025-12-09T14:11:00Z | Service provider assessed | vendor: Tax preparation software provider |
| 2026-01-12T09:40:00Z | Duty recorded as performed | duty: qualified_individual |
| 2026-02-03T11:05:00Z | Duty recorded as performed | duty: risk_assessment |
| 2026-02-03T11:28:00Z | Duty recorded as performed | duty: breach_readiness |
| 2026-03-18T15:00:00Z | Training session logged | people: 2 |
| 2026-03-18T15:04:00Z | Duty recorded as performed | duty: training |
| 2026-05-30T17:12:00Z | Duty recorded as performed | duty: disposal_and_retention |
| 2026-06-14T10:33:00Z | Service provider added to the register | vendor: Offsite backup provider |
| 2026-07-21T08:55:00Z | Duty recorded as performed | duty: access_review |
| 2026-08-02T13:47:00Z | Duty recorded as performed | duty: mfa |
Compiled by Policywright (Native Group LLC, Colorado entity 20261433373) from records entered by the firm. Regulatory citations are to 16 CFR Part 314 as published on eCFR. Policywright is not a law firm and this document is not legal advice.