The FTC Safeguards Rule and Your WISP: A Practical Guide for Tax Preparers

Who the Safeguards Rule covers

The Safeguards Rule comes from the Gramm-Leach-Bliley Act (GLBA). It applies to "financial institutions" under FTC jurisdiction, a broader group than most people expect. The FTC has stated plainly that tax preparers are covered. So are many bookkeepers, accountants offering financial services, mortgage brokers and similar businesses.

That describes much of the Central Coast's professional office base. Census County Business Patterns (2023) counts about 214 accounting, tax and payroll firms in Santa Barbara County and about 149 accounting firms in San Luis Obispo County. Many are a handful of people who get very busy from late January to mid-April.

Tax preparers also face an IRS expectation. The IRS PTIN renewal asks preparers to confirm they have a written data security plan. A WISP is no longer optional paperwork.

What the rule requires, in plain terms

The core elements are in 16 CFR 314.4. In short, your program must include:

1. A Qualified Individual who oversees the program. In a small firm, this is often the owner.
2. A written risk assessment of the client data you hold and the threats to it.
3. Safeguards based on that assessment. These include access controls, a data inventory, encryption of client data in storage and in transit, MFA for anyone accessing client information, secure disposal (generally within two years of last use unless you have a business or legal reason to keep it), change management, and logging and review of user activity.
4. Regular testing. The rule requires either continuous detection of system changes, or annual penetration testing plus vulnerability assessments at least every six months.
5. Security awareness training for staff.
6. Service provider oversight: choose capable vendors, require safeguards by contract, and check periodically.
7. Ongoing adjustment as your business and risks change.
8. A written incident response plan.
9. An annual written report from the Qualified Individual to the owner or board.
10. FTC notification within 30 days of discovering a "notification event" involving 500 or more consumers.

The small-firm exemption, and its limits

Firms that maintain customer information on fewer than 5,000 consumers are exempt from a few items. Those items are the written risk assessment, the testing requirement in item 4, the written incident response plan and the annual written report.

Many small practices fall under 5,000. The exemption does not remove the WISP, the Qualified Individual, MFA, encryption, training, vendor oversight or the FTC notice. Count your records carefully. Prior-year clients you still keep files on usually count.

Even if you qualify, a short risk assessment and an incident response plan are worth having. They are what you will reach for when something goes wrong in March. Insurers often ask about them as well.

What a usable WISP looks like for a small office

A WISP should describe your actual office, not a generic one. For a three-to-ten person firm, that usually means:

• The Qualified Individual's name, and who covers when that person is out
• A data inventory: tax software, client portal, email, scanned documents, local file shares, backups and paper files
• Who can access what, and how access is removed when seasonal staff leave
• MFA status for email, tax software, the portal and remote access
• Encryption status for laptops, phones and any portable drives
• Backup method, location and the date of the last test restore
• Rules for sending returns and documents to clients (portal, not email attachments)
• A vendor list with what each vendor touches
• A training schedule and an attendance record
• An incident response plan with phone numbers written down offline
• A date for the next review

IRS Publication 5708 includes a sample WISP for tax and accounting practices, and it is a reasonable starting point. The value comes from replacing the sample text with your own facts.

Tax season is the risk season

Attackers know the calendar. The busiest weeks bring the most phishing aimed at preparers: fake new-client emails with "documents attached," spoofed software notices and requests to change a refund deposit account.

Common problems in small firms include:

• Shared logins for seasonal staff, so no one can tell who did what
• Returns sent as email attachments because the portal felt slow
• Front-desk devices on the office network. Printers, a smart TV, thermostats, security cameras and door controllers often share one flat network with the tax workstations. Separating them is a network-side job. See small business network segmentation.
• Email account takeover that sits quiet until refund season. The business email compromise prevention guide covers the warning signs.

If your office runs on Microsoft 365 or Google Workspace, tightening MFA and sign-in settings is one of the highest-value hours you can spend. See the Microsoft 365 security checklist.

Two notification clocks, not one

The FTC notice applies when unencrypted customer information on 500 or more consumers is acquired without authorization. You report through a form on ftc.gov within 30 days of discovery.

California has its own law. As of October 2026, notices to affected California residents are due within 30 calendar days. If more than 500 residents are affected, a sample notice goes to the Attorney General within 15 days after you notify consumers. These obligations overlap, and your attorney should coordinate them. The California 30-day breach notification guide explains how to prepare in advance.

Free help first, then where Keith Systems fits

Start with what is free. The EDC SBDC, which serves Santa Barbara and Ventura counties, runs a free small-business cybersecurity webinar series from October 1, 2026 to April 7, 2027. It includes a session for accountants on the FTC Safeguards and GLBA written information security program. More free resources are listed in free cybersecurity help on the Central Coast.

If you want hands-on help, Jacob Keith (CISSP, CompTIA CySA+, CompTIA SecurityX) can work with your Qualified Individual. The work can include a risk assessment, drafting or tightening the WISP around your real systems, a review of MFA and account settings, a network-side review, and a short staff training session. An external exposure review, done with the owner's written authorization, is not a penetration test and may not by itself satisfy the rule's testing requirement. This supports your preparation for the rule. It is not legal advice, and no one can declare your firm "Safeguards approved."

Book a free security consult or call (805) 800-8163. Services are listed at /services.