The FTC Safeguards Rule applies to tax preparers because the Federal Trade Commission (FTC) treats any business "significantly engaged" in financial activities, including tax preparation, as a financial institution under the Gramm-Leach-Bliley Act (GLBA). If your practice collects, stores, or transmits nonpublic personal information (NPI), Social Security numbers, W-2s, bank routing numbers, the FTC Safeguards Rule for tax preparers and financial institutions requires a written information security program that meets specific federal technical standards, regardless of your firm's size or return volume.
The current version of the rule, codified at 16 C.F.R. Part 314, moved most provisions to a compliance deadline of June 9, 2023, replacing general best-practice language with nine specific, enforceable controls. The FTC has brought enforcement actions against financial service providers that failed to meet these standards, and penalties compound by the day.
Quick Answer
The FTC Safeguards Rule applies to tax preparers because the FTC classifies them as financial institutions under GLBA. Since the 2023 update, every tax practice handling client NPI must maintain a written information security program covering nine specific controls: a designated Qualified Individual, a written risk assessment, encryption, multi-factor authentication, staff training, vendor oversight, and a written incident response plan, plus annual reporting and penetration testing for firms with 5,000 or more customer records. There is no exemption based on firm size or the number of returns you prepare.
Key Takeaways
Every tax practice handling client NPI falls under the FTC Safeguards Rule, with no small-firm exemption. Nine controls are mandatory, including MFA, encryption, a written risk assessment, and a documented incident response plan. Breaches affecting 500 or more customers must be reported to the FTC within 30 days of discovery. Civil penalties can reach $51,744 per violation per day under FTC Act Section 5. A WISP built to IRS Publication 4557 standards covers most, but not all, of these requirements.
GLBA defines "financial institution" broadly, and the FTC's own published examples include tax preparation firms, mortgage brokers, check cashers, and credit counselors. For a tax practice, the connection is direct: preparing returns means handling Social Security numbers, W-2s and 1099s, bank account and routing numbers, investment statements, and prior-year returns, all of which qualify as NPI.
NPI is any financial information a client provides to obtain your services, plus anything about the client derived from the engagement. Publicly available information, like a business's listed phone number, does not automatically qualify, but if a client gave it to you specifically to prepare their return, treat it as protected. For how this intersects with IRS obligations, see our guide to IRS Publication 4557 and the taxpayer data WISP requirement. If you're uncertain whether your specific setup satisfies these requirements, a compliance specialist or attorney can review your written program.
Does the FTC Safeguards Rule Apply to Your Practice?
Tap the ones that sound like you.
Tap every statement that applies to you.
No Exemption for Small Firms
The FTC Safeguards Rule has no small-business exemption. Firms that maintain NPI on fewer than 5,000 customers get a simplified path on exactly one requirement, the annual written report to a governing body. Every other control, including MFA, encryption, the written risk assessment, staff training, and incident response planning, applies in full regardless of firm size.
The 9 Required Safeguards Rule Controls
- Designate a Qualified Individual, an employee or contracted provider with real authority, to run your security program
- Complete a written risk assessment covering every system that stores or processes NPI, updated after any material change
- Implement safeguards across eight areas: access controls, data inventory, encryption, secure development, authentication, monitoring, vendor oversight, and change management
- Encrypt NPI in transit using TLS 1.2 or higher, and at rest with full-disk encryption on every device
- Require multi-factor authentication on every system that touches NPI: email, tax software, remote access, and cloud storage
- Train staff with NPI access annually on phishing, business email compromise, and social engineering
- Vet and contractually bind third-party vendors, tax software, cloud backup, IT support, to written security requirements
- Maintain a written incident response plan that includes the FTC's 30-day breach notification deadline for incidents affecting 500 or more customers
- If you maintain NPI on 5,000 or more customer records, have your Qualified Individual report to a governing body at least annually
Authenticator apps such as Microsoft Authenticator or Google Authenticator, and hardware security keys built on the FIDO2/WebAuthn standard, satisfy the MFA requirement. SMS-based codes are acceptable only where technically necessary, since they remain vulnerable to SIM-swapping. See our guide to two-factor authentication for tax offices for setup specifics.
For encryption, TLS 1.2 or higher is the floor for data in transit, and full-disk encryption, BitLocker on Windows or FileVault on Mac, is the floor for data at rest. Unencrypted client files on a shared drive or unprotected email server do not meet the standard.
Your First 30 Days of Compliance
Tap each step as you finish it. Your progress is saved on this device.
0 of 5 done
Tax and Financial Data Security by the Numbers
According to the FTC, civil penalties for Safeguards Rule violations can reach $51,744 per violation per day under Section 5 of the FTC Act, adjusted annually for inflation. For a firm with unencrypted files, no MFA, and no incident response plan all out of compliance at once during a multi-day breach affecting hundreds of clients, those penalties compound quickly.
The direct FTC penalty is often not the costliest outcome. Non-compliance can also expose a practice to state attorney general enforcement, client lawsuits in which a documented violation can strengthen a negligence claim, suspension of your IRS Electronic Filing Identification Number (EFIN), and denial of a cyber insurance claim at the time of a breach. The FTC has also required third-party security audits as part of settlement agreements, an ongoing cost that can run into the tens of thousands of dollars a year. See our breakdown of what non-compliance costs a tax practice for more on these secondary risks.
Requirements by Customer Record Count
Written Information Security Program
- All Firms
- Required
- 5,000+ Customer Records
- Required
Qualified Individual Designated
- All Firms
- Required
- 5,000+ Customer Records
- Required
Written Risk Assessment
- All Firms
- Required
- 5,000+ Customer Records
- Required
Multi-Factor Authentication
- All Firms
- Required
- 5,000+ Customer Records
- Required
Encryption In Transit and At Rest
- All Firms
- Required
- 5,000+ Customer Records
- Required
Security Awareness Training
- All Firms
- Required
- 5,000+ Customer Records
- Required
Written Incident Response Plan
- All Firms
- Required
- 5,000+ Customer Records
- Required
FTC Breach Notification (500+ customers, 30 days)
- All Firms
- Required
- 5,000+ Customer Records
- Required
Annual Penetration Testing
- All Firms
- Risk-based
- 5,000+ Customer Records
- Required
Annual Written Report to Governing Body
- All Firms
- Not required
- 5,000+ Customer Records
- Required
| Feature | All Firms | 5,000+ Customer Records |
|---|---|---|
| Written Information Security Program | Required | Required |
| Qualified Individual Designated | Required | Required |
| Written Risk Assessment | Required | Required |
| Multi-Factor Authentication | Required | Required |
| Encryption In Transit and At Rest | Required | Required |
| Security Awareness Training | Required | Required |
| Written Incident Response Plan | Required | Required |
| FTC Breach Notification (500+ customers, 30 days) | Required | Required |
| Annual Penetration Testing | Risk-based | Required |
| Annual Written Report to Governing Body | Not required | Required |
The FTC Safeguards Rule runs alongside IRS Publication 4557, Safeguarding Taxpayer Data, which independently requires every tax professional to maintain a Written Information Security Plan (WISP). The two frameworks are largely complementary. A WISP built to IRS standards will satisfy most FTC Safeguards Rule requirements, but not all of them.
The FTC rule adds specificity Publication 4557 does not: the 30-day FTC breach notification requirement for incidents affecting 500 or more customers, a formal annual penetration testing schedule for firms with 5,000 or more customer records, and the written annual report to a governing body. Both the FTC and IRS point to the NIST Cybersecurity Framework (CSF) as a reference model, and its five functions, Identify, Protect, Detect, Respond, and Recover, map directly onto the nine Safeguards Rule requirements.
Build One WISP That Covers Both Frameworks
A custom Written Information Security Plan documents the controls both the FTC and IRS require in one place, typically saving a practice 20 to 40 billable hours compared to assembling the documentation from scratch. Plans start at $749 for up to 5 users, with a custom quote for larger practices.
Bellator Cyber Guard consistently finds the same gaps when assessing tax and accounting firms. Most involve consumer-grade tools used without a signed data processing agreement, personal Dropbox or Gmail accounts instead of business-tier, contractually covered services, which shifts risk back onto the firm with no vendor protection in place.
MFA gaps are just as common: firms protect their tax software portal but leave email, the system where client NPI usually arrives first, secured by a password alone. A risk assessment written in 2022 or earlier also will not satisfy the current rule once your technology or staffing has changed. Our FTC Safeguards Rule checklist and incident response plan guide walk through closing these gaps in order.
Book a Free Tax Cybersecurity Assessment
Get a prioritized remediation roadmap scored against the FTC Safeguards Rule's nine requirements.
Frequently Asked Questions
Yes. The rule applies to any business significantly engaged in financial activities, including solo tax preparers, with no exemption based on firm size or return volume. Firms with fewer than 5,000 customer records get a simplified path on one requirement, the annual written report to a governing body, but MFA, encryption, and incident response planning still apply in full.
The FTC Safeguards Rule is a federal regulation under GLBA enforced by the FTC with civil penalty authority. IRS Publication 4557 is IRS guidance directing tax professionals to build a WISP. A compliant WISP satisfies most Safeguards Rule requirements, but the FTC rule adds the 30-day breach notification, mandatory penetration testing for larger firms, and the annual report to a governing body.
Under the 2023 update, tax preparers must notify the FTC within 30 days of discovering a breach affecting 500 or more customers, submitted through the FTC's designated online portal. State breach notification laws may apply on a shorter timeline and require notice to affected individuals and state regulators as well.
Authenticator apps such as Microsoft Authenticator or Google Authenticator, and FIDO2/WebAuthn hardware security keys, satisfy the requirement. SMS-based codes are acceptable only where technically necessary, since they're vulnerable to SIM-swapping, and should be phased out wherever app-based authentication is available.
The FTC can seek civil penalties up to $51,744 per violation per day under FTC Act Section 5, adjusted annually for inflation. Non-compliance can also trigger state attorney general enforcement, client lawsuits, EFIN suspension, and denial of cyber insurance claims at the time of a breach.
The rule doesn't set a fixed interval, but requires an update whenever circumstances change materially, new technology, remote work, a new vendor, or a security incident. Most compliance advisors recommend a formal annual review as a baseline.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
