CPA firms and tax preparers hold exactly the kind of information criminals want: Social Security numbers, bank account details, income records, and identity documents for every client. Federal rules recognize that. Under the Gramm-Leach-Bliley Act (GLBA), the FTC Safeguards Rule requires covered firms to maintain a formal information security program, and the IRS expects tax professionals to have a written plan to protect taxpayer data.
This guide explains who the rule covers, what it requires, and how the IRS guidance fits in.
This guide is general information, not legal advice. Consult qualified counsel about your firm’s specific obligations.
Who is covered
The Safeguards Rule applies to “financial institutions” under the FTC’s jurisdiction. That definition is broader than banks. It includes many non-bank businesses significantly engaged in providing financial products or services, and the FTC has specifically identified tax preparation firms among them.
For accounting firms, that generally means:
- Tax preparers, including firms and individual practitioners
- CPA firms that provide tax preparation, financial planning, or similar services to individuals
- Bookkeeping and payroll providers that handle customer financial information in connection with those services
The IRS reinforces this. Paid tax return preparers are expected to comply with the Safeguards Rule, and the IRS has tied it to the data security responsibilities of preparers who handle taxpayer information.
Smaller firms
The rule includes limited exemptions for firms that maintain customer information on fewer than a certain number of consumers. Those firms are exempt from a few specific requirements, such as the written risk assessment, the written incident response plan, and the annual report to the board. Most core requirements still apply. Check the current threshold and exemptions against the rule text before relying on them.
The required elements
The Safeguards Rule lays out specific elements every covered firm’s information security program must include.
1. A Qualified Individual
Designate one person to oversee, implement, and enforce your information security program. This can be an employee or someone from a service provider. If you use a service provider, your firm still keeps responsibility for compliance, must designate someone internally to oversee the provider, and must require the provider to maintain an appropriate program.
2. A written risk assessment
Identify reasonably foreseeable internal and external risks to customer information, and evaluate whether your current safeguards control them. The assessment must be written and should include criteria for evaluating risks and how they’ll be addressed. Repeat it periodically.
3. Safeguards to control identified risks
The rule specifies safeguards that must be in place, including:
- Access controls that limit who can see customer information to people who need it
- A data and systems inventory so you know what you have and where it lives
- Encryption of customer information in transit over external networks and at rest
- Secure development practices for any applications you build in-house
- Multi-factor authentication for anyone accessing any information system
- Secure disposal of customer information within a defined period after it’s no longer needed, unless there’s a legitimate business or legal reason to keep it
- Change management procedures
- Monitoring and logging of authorized user activity to detect unauthorized access
4. Regular monitoring and testing
Test or monitor the effectiveness of your safeguards. The rule calls for either continuous monitoring or periodic penetration testing combined with regular vulnerability assessments.
5. Staff training
Provide security awareness training to staff, and make sure the people managing your security program have the knowledge to do it.
6. Service provider oversight
Choose service providers that can maintain appropriate safeguards, require them by contract to do so, and periodically assess them. For CPA firms, that includes IT providers, tax software vendors, cloud storage and portal providers, and document management platforms.
7. Keep the program current
Evaluate and adjust your program as your operations change, as you learn of new risks, and based on the results of testing and monitoring.
8. A written incident response plan
Document how you’ll respond to a security event, including goals, roles and responsibilities, internal and external communications, remediation steps, documentation, and a post-incident review.
9. Annual report to the board or owners
The Qualified Individual must report in writing, at least annually, to the board of directors or equivalent governing body. For many firms, that’s the partners or owners. The report covers the overall status of the program and material matters such as risk assessment results, testing results, security events, and recommended changes.
10. Notification to the FTC
The rule also requires covered firms to notify the FTC of certain security events involving unencrypted customer information affecting a threshold number of consumers. Review the current notification requirements as part of your incident response planning.
IRS Publication 4557 and the WISP
The IRS publishes guidance specifically for tax professionals. IRS Publication 4557, Safeguarding Taxpayer Data, walks through the Safeguards Rule and practical security steps for tax practices.
The Written Information Security Plan (WISP)
The IRS expects tax professionals to have a Written Information Security Plan. The WISP is where the program described above becomes a document you can show to an auditor, an insurer, or a client.
A practical WISP typically includes:
- Firm name, Qualified Individual, and responsible roles
- Scope of the plan and the types of customer information it covers
- Results of the written risk assessment
- An inventory of systems, devices, and locations holding customer data
- Safeguards in place, including MFA, encryption, access controls, and backups
- Policies for remote work, mobile devices, and email
- Employee training requirements and records
- Service provider list and oversight process
- Data retention and secure disposal procedures
- The incident response plan, including how to report data theft to the IRS and state authorities
- How and when the plan will be reviewed and updated
The IRS and the Security Summit partners have published a sample WISP template for small tax practices. It’s a useful starting point, but tailor it to how your firm actually operates.
IRS-specific considerations
- Data theft reporting. Know how to report a suspected data theft to your IRS Stakeholder Liaison and to the appropriate state agencies.
- EFIN and PTIN responsibilities. Protecting the credentials used for e-filing is part of protecting taxpayer data.
- Tax software settings. Enable MFA and other security features offered by your tax software provider.
A practical checklist for CPA firms
- We’ve named a Qualified Individual
- We have a written risk assessment that’s been updated recently
- MFA is enforced on email, tax software, client portals, remote access, and all other systems with client data
- Client data is encrypted on laptops, servers, backups, and in transit
- We have an inventory of where client data lives
- Access is limited to staff who need it, and removed promptly when people leave
- We monitor and log user activity, or perform regular vulnerability scans and penetration tests
- Staff complete security awareness training
- Our vendor contracts address security, and we review key vendors periodically
- We have a written incident response plan
- The Qualified Individual reports to the partners or owners at least annually
- Our WISP is written, current, and reflects how we actually work
How we can help
We help CPA and tax firms build Safeguards Rule programs that hold up: risk assessments, MFA and encryption, monitoring, vendor oversight, and a WISP that matches reality. We can also serve as or support your Qualified Individual and prepare the annual report for your partners.