The FTC Safeguards Rule for CPA and tax firms: a plain-English checklist

If you prepare tax returns for a fee, federal law treats your practice as a financial institution. That isn't a figure of speech. The FTC's Safeguards Rule lists "an accountant or other tax preparation service that is in the business of completing income tax returns" among its examples, next to mortgage brokers and check-cashing businesses.

The rule as a whole has no small-practice exemption. A sole practitioner working from a home office is covered. And each year, when you renew your PTIN, you check a box confirming you know you're legally required to have a data security plan.

Here is the rule in the order it's written, as a checklist. This is general information, not legal advice. The full text is 16 CFR Part 314, and the FTC publishes its own guide.

Read this first: the small-firm exemption

A practice that holds customer information on fewer than 5,000 consumers is excused from four items:

• Putting the risk assessment in writing
• Continuous monitoring, or else a yearly penetration test with vulnerability assessments every six months
• A written incident response plan
• An annual written report to the board or owners

Everything else applies in full. Three cautions before you rely on it:

1. Count people, not engagements. Both spouses on a joint return count, and so do former clients whose files you still hold. If you're anywhere near the line, ask your adviser how to count, or simply meet the full rule.
2. The IRS still expects a written plan. Its guidance for tax professionals, Publication 4557 and the sample plan in Publication 5708, is written for practices of every size.
3. Your insurer will ask anyway. Cyber insurance applications ask about incident plans and testing whatever your headcount.

The checklist

1. Name a Qualified Individual. One person is responsible for the security program. They don't need a title or a certification. It can be someone at your practice or an outside provider. If it's a provider, a senior person at your practice must oversee them, and the practice stays responsible.

2. Assess your risks. Work out where customer information is, who can reach it, and what could go wrong. Exempt practices don't have to write it down. Write it down anyway; everything else is built on it.

3. Put safeguards in place. The rule lists them:

• Limit access to the people who need it, and review it.
• Keep an inventory of the data you hold and the devices and systems it sits on.
• Encrypt customer information, both stored and in transit.
• Check the security of the software you use to handle it.
• Use multi-factor authentication for anyone accessing your systems.
• Dispose of customer information securely, no later than two years after you last used it, unless you need it for business or legal reasons. Most practices keep returns longer for good reason. Put the reason and the period in your retention policy.
• Manage changes, so a new system or a moved server doesn't open a gap.
• Log activity and watch for unauthorized access.

4. Test that the safeguards work. Every practice has to test or monitor regularly. Above the exemption, that means continuous monitoring, or a penetration test every year plus vulnerability assessments at least every six months.

5. Train your people. Security awareness training for everyone, kept up to date.

6. Oversee your service providers. Choose providers who can protect the data, put the security requirements in the contract, and check on them periodically. That means your tax software, your client portal, your cloud storage and your IT provider.

7. Keep the program current. Update it when your practice changes, when testing finds something, or when the threats change.

8. Write an incident response plan. Who does what, who is told, how it's documented.

9. Report to the owners in writing at least once a year on the state of the program.

The 30-day report to the FTC

Since May 2024 the rule has had a breach report of its own. If unencrypted customer information on 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible, and no later than 30 days after you discover it, using the form on the FTC's website.

Two details matter:

• Access is presumed to be acquisition. If someone got into unencrypted customer information, the rule presumes they took it, unless you have reliable evidence that they didn't or couldn't have.
• Encrypted data counts as unencrypted if the key was accessed as well.

This report sits alongside Florida's 30-day notice to the people affected. It doesn't replace it. The IRS also asks tax professionals to report client data theft to their local Stakeholder Liaison straight away, so it can block fraudulent returns.

What happens if you ignore it

• The FTC enforces the rule.
• The IRS has warned preparers that it may treat a Safeguards Rule violation as a violation of its e-file rules (news release IR-2018-175). Sanctions under those rules run from a written reprimand to expulsion from e-file.
• Your insurer asks about most of these items on the application, and a wrong answer can cost you the claim.
• A breach in season. If you earn most of your year in ten weeks, one week offline in March is a tenth of your revenue, before a single client is notified.

Where small practices usually fall short

The items that tend to get left are the dull ones:

• Multi-factor authentication on email, but not on the tax software, the portal or remote access
• A laptop that was never encrypted
• No list of devices, or of where client data sits
• Client files from a decade ago, kept because nobody decided otherwise
• Vendor contracts that say nothing about security
• Training that happened once
• No record of who signed in, or from where

Each one is a line in the rule, and each can be fixed inside a month.

What each item takes

Rule item	What covers it
Qualified Individual	A named person at your practice. A provider can do the work under their oversight.
Risk assessment and written plan	A written information security plan, included and kept current in our Secure plan
Multi-factor authentication, encryption, access	Microsoft 365 or Google Workspace security setup, in every plan
Inventory and updates	Device monitoring and patching, in every plan
Logging and monitoring	A 24/7 security team on every computer, in every plan. Account monitoring from Business. SIEM in Secure.
Testing	A quarterly vulnerability scan, in every plan. A full penetration test is quoted separately.
Training	Phishing simulations and staff training, from Business
Incident plan	Part of the written security plan, in Secure
Report to the owners	A quarterly review with a written report, in every plan. Compliance reporting in Secure.

No plan makes you compliant on its own. The rule puts the responsibility on your practice, and you still name the Qualified Individual and make the decisions. What a provider supplies is the work, and the evidence that it was done.

The cost, against what it protects

	What it comes to
Ten-person practice on Business	$1,490 a month, $17,880 a year
Ten-person practice on Secure, with the written plan and compliance reporting	$2,340 a month, $28,080 a year
One week offline in filing season	A tenth of the year, if you earn it in ten weeks
A breach of client returns	Notices to clients, a report to the FTC, a call to the IRS, fraudulent returns filed in your clients' names, and the clients who don't come back next January

Few practice owners doubt the rule applies to them. What they doubt is having time for it between February and April. That's the case for paying someone every month: the work gets done in the quiet months, and in the worst week of the year there's somebody whose job it is to pick up the phone.

Where to start

1. Decide who your Qualified Individual is, and write it down.
2. Count your consumers to see whether the exemption applies.
3. Tick the list above honestly. Yes with proof, partly, or no.
4. Close the cheap gaps first: multi-factor authentication everywhere, encryption on every laptop.
5. Before the season starts, work through our tax season security checklist and read tax-season phishing.

If you'd rather go through it with someone, book a free review. We work with accounting and CPA firms and tax preparers, and the review is yours to keep whether or not you hire us.