Does your tax or accounting firm need a WISP? What the FTC Safeguards Rule requires

If your firm prepares tax returns, the federal government already considers you a financial institution, the same as a bank for this purpose. That brings a specific obligation: a written information security program that is actually in use.

Most firms have heard of the requirement. Fewer have a plan that would hold up if a client's data were stolen and someone asked to see it.

Who is covered

The FTC Safeguards Rule (16 CFR Part 314) names “an accountant or other tax preparation service that is in the business of completing income tax returns” as a financial institution. The IRS says the same in Publication 5708, and adds that it applies regardless of the size of the firm. Enrolled agents and solo preparers are included.

What the rule requires

The rule lists the elements. In plain terms, you need:

• A written information security program (often called a WISP) that fits your firm.
• A Qualified Individual who is responsible for it. This can be a person on staff or an outside provider you oversee.
• A risk assessment that you revisit periodically.
• Access controls, so people can reach only the client data their job needs.
• A data inventory: what you hold and where it lives.
• Encryption of customer information in transit and at rest.
• Multi-factor authentication for anyone accessing client information.
• Secure disposal of data you no longer need, plus change management and logging of user activity.
• Testing or monitoring to confirm the safeguards work.
• Training for staff, and oversight of service providers who handle client data.
• Regular updates to the program as the firm and the threats change.

Smaller firms get some relief. If you maintain information on fewer than 5,000 consumers, four items don't apply: the written risk assessment, continuous monitoring or annual penetration testing, a written incident response plan, and the annual report to your board. Everything else still does.

The breach-reporting rule

Since May 2024, if unencrypted customer information for 500 or more people is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. That's separate from state breach notification laws and from reporting data theft to the IRS through your Stakeholder Liaison.

Where firms usually fall short

When we review firms, the same gaps come up again and again:

• A WISP template that was downloaded and never filled in.
• Returns and statements sent to clients as email attachments.
• Accounts for staff who left last season that still work.
• Payment or direct deposit changes approved by email alone.
• Backups that have never been test-restored.

Each one is a finding in a regulator's review and a real path for an attacker.

How to get to a real plan in a month

1. Week 1: name your Qualified Individual and list where client data lives: tax software, document management, email, the file server, laptops, scanners.
2. Week 2: turn on multi-factor sign-in everywhere client data is reachable, and remove accounts for anyone who has left.
3. Week 3: replace attachments with a secure client portal and set a rule that payment changes are confirmed by phone.
4. Week 4: write the plan using IRS Publication 5708 as the outline, describing what you actually do, not what a template says. Then schedule a test restore and staff training.

A WISP isn't a document you file away. It's the description of how your firm protects client data, and the evidence that you do.

General information, not legal advice. Your obligations depend on your licenses, services and state.

Sources

• PreVeil: FTC Safeguards Rule for tax and accounting firms (summary of 16 CFR 314)
• IRS Publication 5708 (Creating a Written Information Security Plan) and Publication 4557 (Safeguarding Taxpayer Data)