Financial Services
The Safeguards Rule does not care that you are five people in an office.
A written information security plan that satisfies the FTC Safeguards Rule, client document exchange that is not an email attachment, and systems that hold up through the weeks when everybody files at once.
Tax preparers, brokers and lenders are all "financial institutions" to the FTC. The definition is far broader than most people assume.
Safeguards Rule
Broader than you think.
Written plan
Required, not recommended.
GLBA counts
It qualifies for Ohio 1354 too.
Seasonal load
Built for your busiest six weeks.
Who It Covers
"Financial institution" is an FTC definition, not a description of a bank.
The Gramm-Leach-Bliley Safeguards Rule reaches mortgage brokers and lenders, accountants and tax preparers, financial advisers and anyone else significantly engaged in providing financial products or services to consumers. A great many small firms are covered and do not realise it.
What it asks for is a written information security program with a named person responsible, a risk assessment behind it, access controls, encryption, multi-factor authentication, vendor oversight and an incident response plan. Tax preparers are additionally expected to maintain a written data security plan.
The useful part: GLBA Title V is a qualifying framework under ORC Chapter 1354. Doing this work properly satisfies the federal requirement and earns you Ohio’s safe harbour against civil claims at the same time.
One program. Federal compliance and an Ohio legal defence, together.
Your busiest weeks are the risky ones
Filing season is when staff are tired, volumes are high, and a convincing email about a client return gets clicked. It is also the worst possible time to lose a system.
What We Handle
For firms holding other people’s financial lives
The written security plan
Documented to what the Safeguards Rule actually asks for, with a named responsible person and a review cycle — not a downloaded template.
Multi-factor authentication everywhere
Email, file storage, tax and practice software, and every portal. Explicitly required, and the control that prevents the most damage.
Secure client document exchange
A portal for returns, statements and applications, so the most sensitive documents you handle stop living in mailboxes.
Encryption at rest and in transit
On workstations, laptops, backups and anything leaving the office — which also engages the Ohio encryption exemption.
Vendor oversight
The Rule makes you responsible for your service providers. We help you document the due diligence you are supposed to have done.
Capacity through filing season
Systems and backups sized for your peak weeks rather than a quiet Tuesday in August.
See also secure email and Ohio compliance for how GLBA and ORC 1349.19 interact.
Written, assigned, reviewed. That is what turns good practice into compliance.
Questions
Questions from lenders, CPAs and tax preparers
Are we really covered by the Safeguards Rule?
If you prepare taxes, broker mortgages, lend, or advise on finances for consumers, almost certainly yes. The FTC definition of a financial institution is deliberately broad and catches many firms that think of themselves as small practices.
What does the written plan have to contain?
A named responsible person, a risk assessment, safeguards covering access control, encryption and multi-factor authentication, vendor oversight, staff training and an incident response plan. Scaled to your size, but all present.
We already have antivirus and backups. Is that enough?
Those are controls, not a program. The Rule asks for documentation, assigned responsibility and review — the paperwork is the part most firms are missing.
Does this help us with Ohio law too?
Yes. GLBA Title V is a qualifying framework under ORC Chapter 1354, so a compliant program also earns the Ohio safe harbour against civil claims.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Your One Stop I.T. Shop
Whenever You Are Ready
Let us see what your written plan actually says.
Or establish one if there is not a current version. Either way you end up with a document you could hand to a regulator, an insurer or a client without hesitating.
Compliant federally. Defended in Ohio. Same piece of work.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com