What the Safeguards Rule Requires
The FTC Safeguards Rule requires every tax preparation business to maintain a written incident response plan as part of its information security program. That requirement comes from 16 CFR 314.4(h), a provision of the Federal Trade Commission's Safeguards Rule, which implements the Gramm-Leach-Bliley Act and applies to tax preparers because the FTC classifies them as "financial institutions" that handle consumer tax return information.
Compliance with the incident response plan requirement became mandatory on June 9, 2023, when the FTC's extended deadline for several 2021 rule amendments took effect. For the full set of obligations beyond incident response, see our FTC Safeguards Rule checklist.
Quick Answer
16 CFR 314.4(h) requires tax preparers to put a written incident response plan in place covering seven elements: response goals, internal processes, defined roles and decision authority, internal and external communication, remediation of weaknesses, documentation of events, and post-incident evaluation. There is no FTC-approved template; the plan has to match your firm's actual systems and staff. It belongs inside your broader Written Information Security Plan (WISP), the same document the IRS requires under Publication 4557.
The 7 Elements 16 CFR 314.4(h) Requires
Response goals
State what your firm is trying to accomplish: contain the incident, protect client data, and restore normal operations.
Internal processes
Document exactly what happens the moment someone suspects unauthorized access or a lost device.
Roles and decision authority
Name who can declare an incident, who can take a system offline, and who has final say on next steps.
Internal and external communication
Define how staff escalate internally and when to notify clients, the IRS, state regulators, law enforcement, and your cyber insurer.
Remediation
Require that every security gap exposed by the incident gets fixed, not just that the ticket gets closed.
Documentation
Keep a written record of what happened, when, and how you responded, since the FTC can request it during an investigation.
Evaluation and revision
Review the plan after every real incident and at least once a year, and update it when your systems or staff change.
Most incidents that trigger this plan start small. A compromised email account or a stolen password is a far more common opening move than a sophisticated network intrusion; see our breakdown of phishing attacks on tax professionals for how these usually begin. Your plan should assume a compromised credential as the likely first alert, not a dramatic breach notification.
Verizon's annual Data Breach Investigations Report consistently lists stolen credentials among the top ways attackers first gain access to a network, which is one reason the FTC's rule asks for a defined process rather than a one-page memo. A plan that only addresses ransomware won't cover the scenario your firm is statistically more likely to face.
30-Day FTC Breach Notification Deadline
Since May 13, 2024, a separate Safeguards Rule amendment (16 CFR 314.4(j)) has required non-banking financial institutions, including many tax preparers, to notify the FTC within 30 days of discovering a security event involving the unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. This notification duty depends on your incident response plan working: you cannot hit a 30-day deadline if the plan doesn't already define who investigates and who decides whether the event is reportable.
Your Incident Response Plan Lives Inside a Larger WISP
The FTC doesn't expect a stand-alone incident response document. It expects the plan to sit inside your Written Information Security Plan (WISP), the same document the IRS requires under Publication 4557 and the IRS WISP template (Publication 5708). If you're starting from scratch, review the general WISP requirements first, since the incident response section needs to use the same role names and escalation path as the rest of the document.
Firms that have designated a Qualified Individual under the Safeguards Rule, covered in our guide to the FTC Safeguards Rule qualified individual requirement, should make the incident response plan that person's direct responsibility, not a document that only gets opened after something has already gone wrong. Any remediation step that involves purging compromised files should also follow your firm's secure data destruction requirements for tax preparers so the fix doesn't create a second compliance gap.
Bellator Cyber Guard builds a custom WISP, including the incident response section 16 CFR 314.4(h) requires, starting at $749 for firms with up to five users; larger practices get a custom quote. A plan drafted to match your actual systems and staff generally saves a firm the 20 to 40 billable hours it would otherwise spend researching and writing one internally. Review the custom WISP option before your next renewal deadline.
Action Checklist: Building a Compliant Plan
- Put the plan in writing; a verbal understanding among staff doesn't satisfy 314.4(h)
- Name one specific person with authority to declare an incident
- List every notification obligation: IRS Stakeholder Liaison, affected clients, state attorney general, the FTC if 500+ consumers are affected, and your cyber insurer
- Add a step to preserve evidence before remediating a device or account
- Schedule an annual review, plus a review after every real incident
- Run a tabletop walkthrough with staff at least once a year
Key Takeaway
A verbal understanding among staff doesn't satisfy 16 CFR 314.4(h). The FTC expects a written document naming who does what, and firms that already have a current WISP in place avoid rebuilding the incident response section from scratch every time staff or systems change.
Get Your Incident Response Plan Built Into a Compliant WISP
Bellator Cyber Guard drafts a custom Written Information Security Plan, including the incident response section the FTC Safeguards Rule requires, starting at $749 for firms with up to 5 users. Larger practices get a custom quote.
Frequently Asked Questions
Yes. The rule applies based on the type of information a business handles, not its size, though firms that collect customer information from fewer than 5,000 consumers are exempt from a small number of the rule's other provisions. The written incident response plan requirement under 16 CFR 314.4(h) applies regardless of staff count.
No. The incident response plan is one required section of your Written Information Security Plan (WISP). The WISP is the broader document covering risk assessment, access controls, encryption, vendor oversight, and employee training; the incident response plan is the part that activates when something actually goes wrong.
No. The 30-day FTC notification requirement under 16 CFR 314.4(j) applies only to security events involving unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. Smaller incidents still need to be documented and handled under your incident response plan, but they don't trigger the FTC notification deadline.
The Safeguards Rule is enforced by the FTC, and a missing or inadequate plan can become a finding during an investigation or audit. This article describes the rule's text and is not legal advice; firms with specific compliance or enforcement questions should talk to counsel familiar with the Safeguards Rule.
16 CFR 314.4(h) expects periodic evaluation and revision. In practice that means reviewing the plan at least once a year and immediately after any real security event, so it keeps matching your current staff, systems, and vendors.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
