Is your firm meeting the FTC Safeguards Rule?
Since 2023, tax preparers, CPAs, and accountants are legally “financial institutions” — with real federal security requirements. Take the free 2-minute self-check and find out where you stand.
Get my free readiness review →
Not enforced on tax software + emailMissing
No WISP document on fileMissing
No one formally responsibleMissing
At rest yes, email transfer noPartial
Informal, not documentedPartial
IT + cloud providers under agreementOn track
Since June 9, 2023, the FTC classifies tax preparers, CPAs, and accountants as “financial institutions” under the Safeguards Rule — and the core requirements apply even to a one-person firm. “We’re careful with client data” is no longer enough; the rule wants specific, documented safeguards.
You’ll be asked to sign for this at PTIN renewal
Every PTIN expires on 31 December, and renewal opens in October. Form W-12 is signed under penalty of perjury, and Line 11 is where you confirm your data security responsibilities — that you have a written information security plan and that your practice is actually following it.
That second half is the part worth pausing on. Having the document is easy. Being able to say you follow it — multi-factor authentication everywhere client data can be reached, encryption in transit, a named person accountable, a real incident response plan, an annual review — is a different claim entirely.
The plan itself is free, and we’ll say so
The IRS publishes the template: Publication 5708, “Creating a Written Information Security Plan for Your Tax & Accounting Practice.” It costs nothing and you do not need us to get it. Anyone charging you for the document alone is charging you for a free PDF.
What the template cannot do is put MFA on your tax software, encrypt what leaves your office, keep the vendor list current, or make sure any of it is still true next October. That is the work, and it is the only part worth paying for.
What happens if the certification isn’t true
The IRS can suspend or revoke your preparer number. For most practices that is not a fine, it is the licence to earn.
Maximum FTC civil penalty per violation, per day under the Safeguards Rule, adjusted annually for inflation.
To notify the FTC of a breach affecting 500 or more clients. A public consent decree naming your firm outlasts any fine in a referral business.
We are not going to pretend the IRS is coming for your office in January. Enforcement is mostly complaint- and breach-driven. But the signature is annual, it is yours, and the honest question is whether the sentence above it is true on the day you sign it.
This isn’t optional, and it isn’t only for the big firms.
The Safeguards Rule is a federal requirement with real teeth — and most small tax and accounting firms don’t yet have the pieces in place.
What every firm must have
These apply to your firm regardless of size. The self-check walks you through each in plain English.
Multi-factor authentication
MFA on everything that can open client information — email, tax software, file storage.
Encrypted client data
Client information protected both where it’s stored and when it’s sent.
Written Security Plan (WISP)
An actual document describing your safeguards — not just “we’re careful.”
A Qualified Individual
One named person accountable for your firm’s information security program.
Staff security training
Your team trained to spot phishing and handle client data correctly.
Vendor vetting
Every vendor who touches client data held to the same security bar.
From “am I compliant?” to a clear plan.
No jargon, no fear-selling. Just an honest picture and the steps to close the gaps.
Take the 2-minute self-check
Answer a short plain-English checklist — no login, no obligation — and see where your firm stands.
We do a free readiness review
We review your answers against the Safeguards Rule and map exactly which requirements you’re missing.
You get a gap report + plan
A plain-English report of what’s required, what you’re missing, and how to become — and stay — compliant.
Find out if your firm is Safeguards-ready
Get your free FTC Safeguards readiness review — we’ll show you exactly which federal requirements you’re meeting and which need attention, in plain English.