See the builders

Guides · Published October 21, 2026

The FTC Safeguards Rule for tax preparers: what 16 CFR 314.4 requires in your WISP

If you prepare tax returns for pay, the FTC treats your firm as a financial institution. Its Safeguards Rule, 16 CFR 314.4, lists what your written information security program must contain. Here is each element in plain English, with the rule's own words.

Who the rule covers

The Safeguards Rule applies to financial institutions under the FTC's jurisdiction, which includes tax preparers. The IRS reminds tax professionals of it every year (IR-2026-92). Full text: 16 CFR 314.4 on eCFR.

The elements, one by one

(a) A Qualified Individual

One person oversees and enforces the program. It can be you, an employee or an outside provider: "The Qualified Individual may be employed by you, an affiliate, or a service provider."

(b) A written risk assessment

"The risk assessment shall be written". It must identify risks to client information and how you will deal with them, and you repeat it periodically.

(c) Safeguards

Controls for the risks you found, including access controls, an inventory of your systems, secure disposal and change management. Two are spelled out:

(d) Testing and monitoring

Without continuous monitoring, you need an annual penetration test and vulnerability assessments "at least every six months".

(e) Staff training

Security awareness training for everyone who handles client data, kept up to date.

(f) Service providers

Choose vendors that can protect the data, require it in the contract, and check on them periodically. That includes your tax software, cloud storage and IT support.

(g) Keep the program current

Update it when your testing, your business or your risks change.

(h) A written incident response plan

"Establish a written incident response plan" covering how you respond to and recover from a security event.

(i) An annual written report

The Qualified Individual reports "in writing, regularly and at least annually" to your board or, in a small firm, the owner.

(j) Notifying the FTC

Since May 13, 2024, if a breach involves "the information of at least 500 consumers", you must notify the FTC "as soon as possible, and no later than 30 days after discovery", using the FTC's online form (FTC).

The small-firm exemption, and what it does not cover

Firms that keep information on fewer than 5,000 consumers are exempt from four parts: the written risk assessment in (b)(1), the testing in (d)(2), the incident response plan in (h) and the annual report in (i) (16 CFR 314.6).

That does not exempt you from the program itself. You still need a Qualified Individual, safeguards such as encryption and MFA, training, vendor oversight and the FTC notice. IRS Publication 5708 still tells you to write a plan, and Form W-12 still asks you to confirm you know you must have one (see PTIN renewal and your WISP).

Turn these requirements into your plan

The WISP Builder follows 16 CFR 314.4 and IRS Publication 5708, section by section. $199 for the 2027 edition, works offline.

See the builder

Frequently asked questions

Does the FTC Safeguards Rule apply to small tax preparers?

Yes. Tax preparers are financial institutions under the Gramm-Leach-Bliley Act. Firms with information on fewer than 5,000 consumers are exempt from four specific parts of 16 CFR 314.4, but not from the program itself.

Is multi-factor authentication required?

Yes. 16 CFR 314.4(c)(5) requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves equivalent controls in writing.

When do I have to notify the FTC of a breach?

Since May 13, 2024, when a breach involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery, using its online form.

Who can be the Qualified Individual?

Anyone you designate to oversee the program: the owner, an employee, or an outside service provider.

Rules quoted as of October 21, 2026.