Tax preparers & CPAs
The FTC Safeguards Rule for tax preparers
Paid preparers must keep a written information security plan. Here's what the rule asks, in plain English, and a way to keep it current all year.
By Tyler Milam, founder of Golden Rock · Updated
Are you covered?
An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution under the rule.
What the rule asks
(a) Qualified Individual
Put one named person in charge of overseeing, running, and enforcing your information security program. They can be an employee or work for an affiliate or outside IT company, but your business stays responsible.
(b) Risk assessment
Base your program on a risk assessment of what could go wrong with customer information and whether your protections are enough, and redo it periodically. Only firms with customer information on 5,000 or more consumers must write it down with formal criteria.
16 CFR 314.4(b) · small-firm exemption 16 CFR 314.6
(c) Safeguards
Put protections in place for the risks you found: access controls, an inventory, encryption, app security, multi-factor authentication, secure disposal, change management, and activity monitoring.
(d) Testing and monitoring
Regularly test or monitor whether your protections actually work. Firms with customer information on 5,000 or more consumers must also use continuous monitoring or do a yearly penetration test plus vulnerability scans at least every six months.
16 CFR 314.4(d) · small-firm exemption 16 CFR 314.6
(e) Staff and training
Make sure your people can carry out the program: train all staff, use qualified security help, and keep that help trained and up to date.
(f) Service providers
Choose vendors that can protect your customers' data, require safeguards in their contracts, and check on them periodically based on their risk.
(g) Evaluate and adjust
Update your program based on testing results, changes to your business, new risk assessments, and anything else that could seriously affect your security.
(h) Incident response plan
Keep a written plan for responding to and recovering from security events that affect customer information. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(h) · small-firm exemption 16 CFR 314.6
(i) Annual report to the board
Your Qualified Individual reports in writing, at least once a year, to your board or, if you have none, to the senior officer responsible for security. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(i) · small-firm exemption 16 CFR 314.6
(j) Notify the FTC
If unencrypted customer information about 500 or more consumers is acquired without permission, tell the FTC as soon as possible and no later than 30 days after you discover it. This applies to firms of every size.
Breach notice: if unencrypted information on 500 or more consumers is taken, tell the FTC within 30 days of discovery (16 CFR 314.4(j)).
Where your customer information lives
- Tax software and e-file accounts
- Client portals and email
- Scanned IDs and paper returns
- Remote access and office Wi-Fi
Each of these needs access controls, multi-factor sign-in, encryption and a place in your risk assessment.
What does the IRS have to do with it?
The IRS reminds preparers that federal law requires a written information security plan, asks them to acknowledge it on the PTIN application (Form W-12), and publishes a sample plan (Publication 5708) and a security guide (Publication 4557).
I'm a one-person office. Does it apply?
Yes. There's no exemption for being small. Offices with customer information on fewer than 5,000 consumers skip four items (16 CFR 314.6), but still need the written program, a Qualified Individual, multi-factor sign-in and encryption.
Not ready for a trial?
Get the printable checklist by email, with two short tips emails over the next two weeks.
Plain-language guidance from the rule text, not legal advice. Prefer to have it done for you? See Golden Rock's done-for-you options.