Is your firm meeting the FTC Safeguards Rule?
Since 2023, tax preparers, CPAs, and accountants are legally “financial institutions” — with real federal security requirements. Take the free 2-minute self-check and find out where you stand.
Get my free readiness review →
Not enforced on tax software + emailMissing
No WISP document on fileMissing
No one formally responsibleMissing
At rest yes, email transfer noPartial
Informal, not documentedPartial
IT + cloud providers under agreementOn track
Since June 9, 2023, the FTC classifies tax preparers, CPAs, and accountants as “financial institutions” under the Safeguards Rule — and the core requirements apply even to a one-person firm. “We’re careful with client data” is no longer enough; the rule wants specific, documented safeguards.
You’ll be asked about this at PTIN renewal
Every PTIN expires on 31 December, and renewal opens in October. Form W-12 is signed under penalty of perjury, and Line 11 asks you to confirm that you know paid preparers are required by law to create and maintain a written information security plan.
Line 11 itself is a yes-or-no about awareness. The law it points to is not: the FTC Safeguards Rule requires the plan to exist and the safeguards in it to be real — multi-factor authentication everywhere client data can be reached, encryption in transit, a named person accountable, a real incident response plan, an annual review. Having the document is easy. Being able to show you follow it is a different matter entirely.
The plan itself is free, and we’ll say so
The IRS publishes the template: Publication 5708, “Creating a Written Information Security Plan for Your Tax & Accounting Practice.” It costs nothing and you do not need us to get it. Anyone charging you for the document alone is charging you for a free PDF. We walk through every section in the WISP template for tax professionals: how to fill it in, and the controls behind it in our FTC Safeguards Rule checklist.
What the template cannot do is put MFA on your tax software, encrypt what leaves your office, keep the vendor list current, or make sure any of it is still true next October. That is the work, and it is the only part worth paying for.
What happens if the plan isn’t real
The IRS can suspend or revoke your preparer number. For most practices that is not a fine, it is the licence to earn.
Maximum FTC civil penalty per violation, per day under the Safeguards Rule, adjusted annually for inflation.
To notify the FTC of a breach affecting 500 or more clients. A public consent decree naming your firm outlasts any fine in a referral business.
We are not going to pretend the IRS is coming for your office in January. Enforcement is mostly complaint- and breach-driven. But you answer Line 11 every year, and the honest question is whether the plan it refers to exists and matches what is actually in place.
This isn’t optional, and it isn’t only for the big firms.
The Safeguards Rule is a federal requirement with real teeth — and most small tax and accounting firms don’t yet have the pieces in place.
What every firm must have
These apply to your firm regardless of size. The self-check walks you through each in plain English.
Multi-factor authentication
MFA on everything that can open client information — email, tax software, file storage.
Encrypted client data
Client information protected both where it’s stored and when it’s sent.
Written Security Plan (WISP)
An actual document describing your safeguards — not just “we’re careful.”
A Qualified Individual
One named person accountable for your firm’s information security program.
Staff security training
Your team trained to spot phishing and handle client data correctly.
Vendor vetting
Every vendor who touches client data held to the same security bar.
From “am I compliant?” to a clear plan.
No jargon, no fear-selling. Just an honest picture and the steps to close the gaps.
Take the 2-minute self-check
Answer a short plain-English checklist — no login, no obligation — and see where your firm stands.
We do a free readiness review
We review your answers against the Safeguards Rule and map exactly which requirements you’re missing.
You get a gap report + plan
A plain-English report of what’s required, what you’re missing, and how to become — and stay — compliant.
Find out if your firm is Safeguards-ready
Get your free FTC Safeguards readiness review — we’ll show you exactly which federal requirements you’re meeting and which need attention, in plain English. Prefer to see the rule section behind each item first? Try our 12-question readiness check, which has an FTC Safeguards mode for tax firms.