The FTC Safeguards Rule, for a small tax firm

The Federal Trade Commission's Safeguards Rule requires financial institutions under its jurisdiction, which the FTC says includes tax preparation firms and accountants who prepare income tax returns, to keep a program that protects customer information. The rule was updated in 2021 with specific requirements, most of which took effect in June 2023. The FTC's own guidance page, "FTC Safeguards Rule, what your business needs to know," is the source for everything below.

The exemption that matters for small firms

Firms that maintain customer information on fewer than 5,000 consumers are exempt from several of the written requirements. They do not have to produce a written risk assessment, a written incident response plan, or an annual written report to the board. They still have to do the practical things. Designate a qualified individual, control access, encrypt data, use multi-factor authentication, train staff, and oversee service providers. Count your clients honestly, including former clients whose returns you still hold.

Checklist for a firm under 5,000 records

1. Designate a Qualified Individual. The rule requires a named individual to be responsible for the program. It can be the owner, and the technical work can be done by an outside firm. Write the name down.
2. Multi-factor authentication for anyone who accesses client information. Email, the tax software, the file share, and remote access all require a second step.
3. Encrypt customer information in transit and at rest. Laptops and workstations encrypted, backups encrypted, and client documents sent through an encrypted portal or encrypted email rather than as plain attachments.
4. Access controls. Each person has their own login, access is limited to what their job needs, and former staff are removed the day they leave.
5. Keep an inventory of where client data lives. The tax software, email, the file share, backups, any cloud service, and any paper files.
6. Train staff on security, with a record. Fake IRS notices and fake client emails are the ones that hit tax firms.
7. Dispose of client data you no longer need, on a schedule that respects your retention obligations.
8. Oversee service providers. Your tax software vendor, your IT provider, and your cloud storage should be able to show they protect the data too. Keep their security statements on file.
9. Change management. When something changes, a new system, a new location, a new vendor, revisit the list.
10. Report a notification event. Since May 2024 the rule requires notifying the FTC within 30 days of discovering unauthorized access to unencrypted information on 500 or more consumers.

Checklist additions for a firm at or over 5,000 records

• A written risk assessment that names the risks to client data and how they are addressed.
• A written incident response plan that says who does what if data is exposed.
• An annual written report from the Qualified Individual to the owner or board.
• Continuous monitoring or annual penetration testing plus vulnerability assessments every six months.

The IRS angle

The written information security plan (a WISP) comes from the Safeguards Rule. The IRS reminds preparers of it at PTIN renewal and publishes a template, Publication 5708, through its Security Summit materials. The Safeguards checklist above is the substance of that plan. Write it down, date it, and keep it with your renewal records.

What this looks like in practice

For a two to ten person tax office, meeting the rule is usually a short project. Two-step login turned on everywhere, laptops encrypted, a tested backup, a password manager, a staff session before tax season, and a few pages of written plan. That is exactly what our CPA and tax office setup covers, and the cyber insurance readiness project produces the same proof folder your carrier wants.

This guide describes the rule as published by the FTC and is not legal advice. Confirm your obligations with your attorney or professional association.