Assurbyte Book a free call
Menu

FTC Safeguards Rule for Tax Preparers: What It Requires

· Assurbyte

A desk with a calculator, binders, a notebook, pencil and glasses, beside the headline: What the rule requires of tax preparers.

When a tax office has a breach, the questions come fast: what was protected, who was in charge, and what did you tell your insurer? The FTC Safeguards Rule for tax preparers is the main federal rule on how tax and accounting firms must protect client information. (FTC is the Federal Trade Commission.) It got a big update in 2021, with most new requirements in effect since June 2023 and a breach-reporting requirement in effect since May 2024. If you last looked at it around the time flip phones were cool, a lot has changed.

Here's what it asks of a small tax firm, in plain English, one piece at a time.

Who does the FTC Safeguards Rule cover?

The Safeguards Rule applies to "financial institutions" under the FTC's watch. That sounds like banks only, but it's a broad term that includes tax preparers and accounting firms that handle clients' financial information. IRS Publication 4557 says it plainly: under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data.

What is the core requirement?

The rule says you must "develop, implement, and maintain" an information security program with administrative, technical and physical safeguards. In everyday terms: office policies, tech protections, and locked doors and cabinets. The rule adds that the program must be "written in one or more readily accessible parts" and must fit your size and complexity and how sensitive the data is (16 CFR 314.3). That written program is what tax pros call a WISP, short for Written Information Security Program (does your tax office need a WISP?).

What are the FTC Safeguards Rule requirements for a small office?

Section 314.4 lists the pieces your program must include. There are nine. Deep breath; they're more manageable than they sound.

1. A Qualified Individual. One named person runs the program. No special degree or title needed. It can be an outside provider, but your firm stays responsible and must name a senior person to keep an eye on them.

2. A risk assessment. Know what data you have and where it lives, then figure out what could reasonably go wrong. Firms with 5,000 or more consumers must put this in writing, with a way to rate each risk. Smaller firms still need to think it through, just not in a formal written report.

3. Safeguards to control those risks. The rule names specific ones:

  • Access controls (who can log in to what), reviewed from time to time, so people only see the client data they need.
  • An inventory, meaning a list of your data, devices, systems and the staff who handle it.
  • Encryption, which scrambles data so only someone with the key can read it, both while it's being sent over outside networks (in transit) and while it's stored (at rest).
  • Multi-factor authentication (MFA, a second lock on the door, like a code on your phone after your password) for anyone accessing any information system, unless your Qualified Individual approves an equivalent control in writing (MFA for tax preparers, explained).
  • Secure disposal of customer information, generally no later than two years after you last used it to serve the client, unless you have a legitimate business or legal reason to keep it. Goodbye, decade-old boxes in the storage closet.
  • Change management procedures, so new software or setup changes get a quick review first.
  • Monitoring and logging of user activity. A log is like a sign-in sheet for your systems.

4. Testing and monitoring. Regularly check that your protections actually work. Firms with 5,000 or more consumers need continuous monitoring, or penetration testing (hiring someone to try to break in, on purpose, to find weak spots) every year plus vulnerability assessments (scans for known weak spots) at least every six months.

5. Staff training and qualified people. Security awareness training for staff, and people (in-house or outside) who know enough to run the program.

6. Vendor oversight. Vendors are the outside companies you hire. Pick ones who can protect the data, require protections in their contracts, and check on them from time to time.

7. Keep the program current. Adjust it after test results, changes in how you work, or new risks.

8. A written incident response plan. Your "what we do if something goes wrong" plan: goals, who does what, who talks to whom, fixes and record-keeping for security problems.

9. An annual report. At least once a year, the Qualified Individual reports in writing to the owner or senior officer on how the program is doing.

Is there a small-firm exemption?

If you keep customer information on fewer than 5,000 consumers, 16 CFR 314.6 lets you skip four items:

  • the written risk assessment,
  • continuous monitoring or penetration testing and vulnerability scans,
  • the written incident response plan, and
  • the annual written report.

Everything else applies no matter your size: the written program, Qualified Individual, access controls, encryption, MFA, disposal, training and vendor oversight. And remember that "consumers" can include past clients whose records you still keep. That client from 2019 who brought a shoebox of receipts? Probably still on the count.

Why does the rule matter in a breach?

It's easy to read a rule like this as a list of boxes to tick. The real point is simpler. Most of these pieces make a breach less likely, and make it smaller and shorter if one happens. MFA can stop a thief who has only a stolen password. Encryption can keep a lost laptop from becoming a reportable event (the FTC notice below applies to unencrypted data). A vendor list tells you who to call.

If you have cyber or data theft insurance, check your policy and application. Make sure anything you told the insurer about MFA, backups, or a written plan is still true. IRS Pub 4557 also tells tax pros to contact their insurer after a breach to see whether the policy covers response costs.

When must you notify the FTC of a breach?

A change that took effect in May 2024 added a reporting duty. If you discover a "notification event" (unauthorized acquisition of unencrypted customer information, meaning someone got readable client data they shouldn't have) involving at least 500 consumers (data also counts as unencrypted if the encryption key was taken too), you must notify the FTC as soon as possible and no later than 30 days after discovery, using the form on the FTC's website. The notice covers what happened, the types of information involved, and how many people were affected.

This is separate from your state's breach notification laws and from the IRS reporting steps tax pros should follow. See what a tax firm should do after a data breach, step by step.

What should a small tax firm do first?

  1. Name your Qualified Individual.
  2. Roughly count how many consumers' records you keep, so you know whether the 5,000 exemption applies.
  3. Turn on MFA everywhere client data lives.
  4. Draft your WISP using IRS Publication 5708, the WISP template for tax practices.
  5. Write a one-page incident plan anyway. It's short, and it's the page you'll want most on a bad day.
Five first steps for a small tax firm: name your Qualified Individual, roughly count consumers' records to see if the 5,000 exemption applies, turn on MFA everywhere client data lives, draft your WISP with IRS Publication 5708, and write a one-page incident plan.

FAQ

When did the updated FTC Safeguards Rule take effect?

Most of the 2021 amendments became effective June 9, 2023. The FTC notification requirement took effect May 13, 2024.

Does the rule require a specific security product?

No. It requires outcomes (encryption, MFA, access control) and a written program, not particular brands.

Can my IT provider be the Qualified Individual?

Yes, but your firm stays responsible and must designate a senior person to oversee them.

What if encryption isn't feasible for some system?

The rule allows effective alternative controls reviewed and approved by your Qualified Individual. Document that decision.

Not sure where you stand?

Take our free Small Office Security Checkup. It takes a few minutes, and every "no" is a gap worth writing down.

This is general information, not legal advice. Check legal questions with your own counsel. Assurbyte helps offices get ready; we don't give legal sign-off.

Sources