FTC Safeguards Rule Checklist for Tax Preparers: 12 Controls, and What Proof Looks Like
¿Prefiere leer en español? Esta lista está disponible en español.
What is on the FTC Safeguards Rule checklist for tax preparers?
The FTC Safeguards Rule checklist for tax preparers comes down to twelve controls: a written risk assessment, one named person in charge, multi-factor authentication, encryption, tested offsite backups, vendor agreements, yearly training, same-day offboarding, a written breach plan, sign-in logging, supported systems, and email protected against spoofing. Each one maps to a section of the rule (16 CFR 314.4), and an examiner or insurer will ask you to show it, not just say it.
The rule applies to every paid preparer, whatever the size of the office, because the Gramm-Leach-Bliley Act treats tax and accounting firms as financial institutions. Your written information security plan (WISP) is where you record these controls; the free IRS template is Publication 5708. This checklist is what has to be true behind it. The FTC explains the rule for businesses in FTC Safeguards Rule: What Your Business Needs to Know, and Drake users can see what to write for a Drake office. The IRS adds tax-specific guidance in Publication 4557.
Download the one-page printable checklist (PDF)
The 12-point checklist, with the rule behind each
| # | Control | Rule | What proof looks like |
|---|---|---|---|
| 1 | A written risk assessment, updated in the last 12 months | 314.4(b) | A dated document listing where client data lives and what could go wrong |
| 2 | One named person responsible (the Qualified Individual) | 314.4(a) | A name in the WISP, and a backup |
| 3 | Multi-factor authentication for anyone accessing client information | 314.4(c)(5) | MFA settings on email, remote access and tax software, for every user |
| 4 | Encryption of client data on devices and in transit | 314.4(c)(3) | BitLocker or FileVault on every laptop and PC; encrypted portal or email |
| 5 | Backups offsite, and a restore tested in the last six months | Your risk assessment; IRS Pub 4557 | A dated note of the last successful restore |
| 6 | Vendor oversight by contract | 314.4(f) | A list of vendors that touch client data, with the agreement for each |
| 7 | Security training for all staff, at least yearly | 314.4(e) | Signed acknowledgements (Pub 5708 Attachment D), seasonal staff included |
| 8 | Same-day access removal when someone leaves | 314.4(c)(1) | An offboarding checklist with dates |
| 9 | A written incident response plan | 314.4(h) | Who to call, how to contain it, who notifies whom |
| 10 | Logging and monitoring of user activity | 314.4(c)(8) | Sign-in logs turned on, and someone who reviews alerts |
| 11 | Supported, updated systems, with vulnerabilities checked | 314.4(d)(2) | No Windows 10; Windows 11 on a supported version; updates confirmed |
| 12 | Email domain protected against spoofing (SPF, DKIM, DMARC) | Supports your risk assessment | A passing result on an email authentication check |
Two more obligations sit alongside the twelve: an annual written report from the Qualified Individual to the owner or board (314.4(i)), and notifying the FTC within 30 days of a breach involving the information of 500 or more consumers (314.4(j)).
Which requirements does a small tax office not have to meet?
If your firm holds customer information on fewer than 5,000 consumers, four requirements do not apply (16 CFR 314.6): the written risk assessment (#1 above), continuous monitoring or annual penetration testing and twice-yearly vulnerability scans (part of #11), the written incident response plan (#9), and the annual report to the board. Everything else still applies, including the WISP, MFA, encryption, training and vendor oversight. Most small offices keep a short risk assessment and breach plan anyway, because they are what you reach for when something goes wrong.
What is the fine for not following the FTC Safeguards Rule?
The FTC can seek civil penalties of more than $50,000 per violation, adjusted for inflation each year, and settlements often come with years of required audits. For a tax preparer the bigger practical risk is the IRS: it can suspend or revoke a PTIN, and Line 11 of the PTIN renewal form asks you to confirm you know the requirement. Enforcement mostly follows a breach or a complaint, which is why the controls that prevent a breach matter more than the paperwork.
How do you check your office against the list?
- Three minutes, free: our readiness check scores your office against these twelve controls and shows the rule behind each gap.
- Ten seconds, free: the email spoofing check covers #12. Seven of the ten Polk County tax offices we checked this month failed it.
- Check #11 now: press Windows key + R, type winver, press Enter. Version 24H2 or older is no longer getting security updates, and none of the major tax programs supports Windows 10.
For the background on Line 11 and what the FTC actually asks for, see our FTC Safeguards self-assessment.
Want Help Getting Every Box Ticked?
iTech Plus helps tax and accounting offices across Polk County put these twelve controls in place and keep them there through filing season, with the plan and the evidence kept current in our WISP Manager. Book a free IT assessment, or call (321) 221-7117 or email info@itechplus.co.
General information about the FTC Safeguards Rule (16 CFR Part 314), not legal or tax advice.
