Tax preparation firms are financial institutions under the FTC Safeguards Rule. IRS Publication 5708 says that applies regardless of size. So a one-person office needs a written information security program too. The requirements are in 16 CFR 314.4. Offices with data on fewer than 5,000 consumers are exempt from four of them.
Does the Safeguards Rule apply to a small tax office?
Yes. Size doesn't change that. A solo preparer working from home is covered too. The rule asks for an information security program. The written version is often called a WISP.
If you hold customer information on fewer than 5,000 consumers, four parts of the rule don't apply to you. The rest still does. The table at the end lists the four.
Who is the Qualified Individual in a small office?
The rule says to name a Qualified Individual. This person oversees, implements and enforces your security program.
The Qualified Individual can be your employee. It can also be someone at an affiliate or a service provider, like an outside IT company. If you use a service provider, your office still keeps responsibility for compliance.
Write the name in your plan and name a backup. One named person is easier to hold to a schedule than "whoever has time."
What goes in the risk assessment?
The rule bases your program on a written risk assessment. You reassess it from time to time. The assessment:
- Sets criteria for judging risks.
- Looks at threats to the confidentiality, integrity and availability of client data.
- Says how you will address each risk.
Offices under 5,000 consumers don't have to write it down. Thinking it through still helps. Ask where client data lives and who can reach it. Then ask what happens if a laptop goes missing.
Which safeguards does the rule name?
Section 314.4(c) lists the safeguards. They include these three:
- Encryption. Encrypt all customer information you hold or send. That covers data in transit over outside networks and data at rest. The rule also allows effective alternative controls that your Qualified Individual approves.
- Multi-factor authentication. Anyone who signs in to any information system needs MFA. That means at least two of these: something you know, something you have, something you are. Your Qualified Individual can approve equivalent or stronger controls in writing.
- Disposal. Get rid of client information no later than two years after you last used it. You may keep it longer if you still need it for business or the law requires it. You may also keep it if disposal isn't reasonably feasible.
How do you test your safeguards?
The rule gives two options. One is continuous monitoring. The other is an annual penetration test plus vulnerability assessments at least every six months. You also run them after material changes to your office or systems. Offices under 5,000 consumers are exempt from this schedule.
What about staff training and vendors?
Train your staff in security awareness. Update the training based on what your risk assessment finds.
For vendors, the rule asks for three things:
- Choose service providers that can protect client data.
- Require safeguards in your contracts with them.
- Check on them from time to time.
Start with whoever touches your client data, such as your tax software company, cloud storage or IT support.
What goes in an incident response plan?
The rule asks for a written incident response plan. It covers seven areas:
- The plan's goals.
- Your internal process for responding.
- Roles, responsibilities and who makes decisions.
- Internal and external communications.
- Fixing the weaknesses you find.
- Documenting and reporting the event.
- Reviewing and revising the plan after an event.
Offices under 5,000 consumers don't need the written plan. The FTC notice rule below still covers them.
What do you report and to whom?
At least once a year, your Qualified Individual reports in writing to your board or its equivalent. With no board, the report goes to a senior officer. It covers the overall status of your program and any material matters. Offices under 5,000 consumers are exempt from this report.
The FTC notice rule covers every office. A notification event is when someone gets unencrypted customer information without the consumer's authorization. Information counts as unencrypted if an unauthorized person got the encryption key. If an event involves at least 500 consumers, notify the FTC through its online form. Do it as soon as possible. The deadline is 30 days after you find the event. This requirement has been in effect since May 13, 2024.
Summary: what applies under 5,000 consumers
| Requirement | Section | Fewer than 5,000 consumers |
|---|---|---|
| Qualified Individual | 314.4(a) | Applies |
| Written risk assessment | 314.4(b)(1) | Exempt |
| Safeguards, including encryption, MFA and disposal | 314.4(c) | Applies |
| Penetration test and scan schedule | 314.4(d)(2) | Exempt |
| Staff training | 314.4(e) | Applies |
| Service provider oversight | 314.4(f) | Applies |
| Written incident response plan | 314.4(h) | Exempt |
| Annual written report | 314.4(i) | Exempt |
| FTC notice for 500 or more consumers | 314.4(j) | Applies |
The rule has more detail than this table. Read section 314.4 for the full text.
Sources
- eCFR, 16 CFR Part 314, Standards for Safeguarding Customer Information, sections 314.2, 314.4 and 314.6. Checked October 12, 2026.
- FTC, FTC Safeguards Rule: What Your Business Needs to Know, updated December 2024.
- FTC, Safeguards Rule notification requirement now in effect, May 2024.
- IRS, Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax & Accounting Practice.