Cybersecurity Exemptions for Orgs with Less than 5,000 Clients

You may be off the hook, but not out of the woods.

By Donny Shimamoto

Management consulting company AON described an exemption for some of the FTC requirements for firms that handle the personal identifiable information (PII) of less than 5,000 consumers.[i]

The Safeguards Rule provides an exception from certain requirements if the covered financial institution maintains customer information concerning fewer than 5,000 consumers. A consumer is defined in Section 314.2(b)(1) of the Safeguards Rule as “an individual who obtains or has obtained a financial product or service from the financial institution that is used primarily for personal, family, or household purposes, or that individual’s legal representative.”

MORE: How Hacker-Proof Is Your Firm? | Unleashing the Power of Technology: Transforming Accountants into Trusted Advisors | Future Firm Growth Requires a Mindshift | AI, OCR, NLP & CPAs: Oh My! | Accounting Nerds, Unlock Your Super Powers | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | Staff Retention for Remote Workers | Why the Future is in Risk Advisory | Ready for Non-CPA “CPA” Firms?
Exclusively for PRO Members. Log in here or upgrade to PRO today.

Essentially if you handle less than 5,000 social security numbers, then it would appear that you can take advantage of this exemption. AON went on to report that if you fall under this exemption, then you do not need to address the following requirements:

Posted on August 21, 2023

Donny Shimamoto

About the Author

Donny C. Shimamoto, CPA.CITP, CGMA, is the founder and managing director of IntrapriseTechKnowlogies LLC, a specialized CPA firm dedicated to helping small businesses and middle market organizations leverage strategic technologies, proactively manage their business and technical risks, and enable balanced organizational growth and development. Donny also works with larger organizations as a trusted business advisor, facilitating organizational strategic planning and execution, IT governance and planning, enterprise architecture, information architecture and assurance, business process improvement, and business intelligence initiatives.

Click here for more by Donny Shimamoto

As the founder of The Center for Accounting Transformation, Shimamoto is leading a movement to change the world for the better by empowering and equipping accountants with the leading-edge tools and techniques.

Donny was the first Certified Information Technology Professional (CPA.CITP) in the State of Hawaii and is one of only four in the state. The CITP credential is a specialty designation of the American Institute of Certified Public Accountants (AICPA), that identifies Certified Public Accountants (CPAs) with the unique ability to bridge between business and technology; meeting the strict requirements for a CPA license as well as additional training and experience in technology strategic planning, IT architecture, business process enablement, system development and acquisition, IT audit and control, and IT governance.

The immediate past chairman of the AICPA’s IMTA Executive Committee, Donny has been both influential and critical in several AICPA initiatives including the development of an IT Competency Model for CPAs, and redesign of the CITP Credential. Donny previously co-chaired the AICPA’s Business Intelligence Working Group, researching and creating practice aids in the area of Evidence-based Management, Application & Data Integration, and Information Assurance. Donny has also been involved in the authoring of guidance published by the AICPA on IT Considerations for Risk-Based Auditing and Enterprise Business Intelligence. As a subject matter expert, Donny is often an invited speaker at national and international webinars and a familiar key-note speaker at national-level conferences.

Donny obtained invaluable knowledge and exposure to a wide range of industries and sectors (retail, hospitality, state government, defense, and higher education) while earning his CPA license as a member of PricewaterhouseCoopers LLP's Business Assurance Services, Operational & Systems Risk Management Services, and Management Consulting Services lines of business. With ITK he has expanded his industry expertise to include not-for-profit (social services, foundations, and membership organizations), professional services, small businesses, technology, and mobile professionals.

Click here for more by Donny Shimamoto

TO READ THE FULL ARTICLE

Continue reading your article with a CPA Trendlines Pro membership.