FTC Safeguards Rule Vendor Oversight for Tax Firms

Tax preparers subject to the FTC Safeguards Rule need a documented process for choosing, contracting with, and periodically reviewing service providers that handle or can affect the security of customer information. In practical terms, you should know which vendors can access taxpayer data, evaluate their security before onboarding, require reasonable safeguards in writing, and revisit the decision when risk or the service changes. A one-time software purchase list is not enough.

The Federal Trade Commission rule does not require every small tax firm to perform enterprise-style audits of every vendor. It does require a risk-based approach that you can explain and document. This matters because cloud tax software, document portals, managed IT providers, payroll systems, email platforms, backup vendors, and contractors can all create a path to sensitive client information or firm systems.

What the FTC Safeguards Rule requires from tax preparers

The FTC Safeguards Rule implements security requirements under the Gramm-Leach-Bliley Act for covered financial institutions. Many professional tax preparation and accounting firms fall within its scope because they provide tax preparation services involving customer financial information. Whether the rule applies to your particular business is a legal question to review with counsel.

Section 314.4(f) requires covered businesses to periodically assess service providers based on the risk they present and to maintain contractual provisions requiring providers to implement and maintain safeguards for customer information. The rule also calls for a written information security program, a designated Qualified Individual, risk assessment, safeguards, testing or monitoring, incident response planning, and ongoing program evaluation.

The IRS gives tax professionals related practical guidance in irs publication 4557 requirements 2026. IRS Publication 4557 explains that tax professionals should protect taxpayer data and consider the security practices of third parties that may access that information. IRS Publication 5708 provides a guide for creating a Written Information Security Plan, often called a WISP.

Which service providers deserve the closest review

Start with providers that store taxpayer data, connect to your network, administer accounts, or can interrupt your ability to serve clients. A service provider is broader than a company that directly hosts returns. A managed service provider with remote access, an email-security vendor with mailbox visibility, or a contractor using a firm-issued laptop may all need to be on your oversight list.

• Tax workflow vendors: tax preparation software, e-file services, client portals, document collection, e-signature, practice management, and payment processors.
• Technology providers: managed IT, managed detection and response, cloud storage, backup, email, identity providers, remote support, and internet-connected phone systems.
• People and professional services: seasonal preparers, outsourced bookkeeping, transcription, scanning, shredding, and marketing vendors that receive client lists.

Do not overlook informal arrangements. A contractor forwarding returns to a personal email address, a partner sharing a consumer cloud-storage folder, or a former IT provider retaining an administrator account can create a documentation gap and an avoidable security exposure. Your inventory should identify the business owner, service provided, information handled, system access, contract location, review date, and next review date.

Vendor oversight also connects directly to the threats tax firms see during filing season. Review phishing attacks on tax professionals with your staff and vendors who administer mailboxes or remote access, because a compromised privileged account can expose far more than one inbox.

Questions to ask a vendor before granting taxpayer-data access

Ask questions that produce usable answers, not a generic assurance that security is important. A small firm does not need to demand every provider use the same controls. You do need enough information to decide whether its safeguards are appropriate for the access you plan to provide.

• What customer information will you store, process, transmit, or be able to access?
• Which employees, contractors, and subcontractors can access that information, and how is access removed when roles change?
• Do you require multi-factor authentication for administrative and remote access?
• How do you encrypt customer information in transit and at rest?
• What is your process for detecting, containing, and notifying customers about a security incident affecting their information?
• How are backups protected and tested if your service is needed to restore operations?
• Will you use subcontractors, and how do you oversee their access and safeguards?
• At termination, how can our firm retrieve data and confirm return or deletion where appropriate?

Record unanswered questions and compensating controls. For example, if a vendor cannot offer a security document because it is a very small provider, you may decide to limit the data shared, prohibit direct system access, use a separate account with multi-factor authentication, or choose another provider. The point is to make and document a reasoned decision.

According to Verizon's 2025 Data Breach Investigations Report, third-party involvement in breaches reached 30 percent, double the prior year's figure. That statistic does not mean every vendor is unsafe. It does show why a tax practice should treat third-party access as part of its own risk management rather than as someone else's problem.

What good documentation looks like for a small tax practice

A defensible vendor file is usually simple and repeatable. It should show that you identified the provider, understood the access involved, reviewed information appropriate to the risk, included reasonable safeguards in the agreement, and set a future review point. Save a dated copy of the agreement, security questionnaire or documentation, approval notes, and any exceptions.

Place the workflow in your WISP so it becomes part of normal purchasing and renewal, rather than a spreadsheet nobody sees until an incident. An irs wisp template can give you the starting structure, but it must reflect your actual vendors, systems, roles, and review process. A copied template that says you conduct reviews when no one owns the task will not help you manage risk.

If you use an outside IT provider, define the boundary clearly. The provider may supply technical evidence and help operate controls, but firm leadership still needs to approve vendors, understand where client data goes, and retain oversight records. This is one reason the distinction between a cybersecurity company vs msp matters when you evaluate support. Ask who monitors endpoints, who can administer identity accounts, what happens after an alert, and what documentation you receive for your WISP.

When managed endpoint security supports vendor oversight

Vendor oversight cannot compensate for unmanaged computers inside your own firm. If an IT provider, seasonal worker, or remote contractor uses a system that can reach taxpayer records, you need a clear endpoint standard, account controls, and a process for removing access. Endpoint detection and response can improve visibility into suspicious activity and support incident investigation, but it does not guarantee prevention of a breach.

Bellator Cyber Guard offers Bellator Shield managed EDR for $19 per computer per month. It is a managed endpoint detection and response service for firms that need focused endpoint coverage. Bellator Core is $33 per computer per month and adds remote monitoring and Ransomware Rollback®; see protection plan details to compare the scope. These are managed-service offers, so they should not be compared as if they were license-only software prices.

For the policy and documentation side, Bellator provides a custom WISP starting at $749 for up to 5 users. Larger practices receive a custom quote. A tailored WISP can save a firm a reasonable 20 to 40 billable hours compared with assembling and adapting policy materials alone, while still requiring you to validate that the document reflects real operations. For a broader control baseline, use the irs cybersecurity compliance guide alongside your vendor-review process.