The biggest mistake an accounting firm can make with its Written Information Security Plan (WISP) is treating the document as the finished product. The FTC Safeguards Rule requires covered financial institutions, including tax preparation firms, to develop, implement, and maintain an information security program that protects customer information. A CPA firm can have a professionally written security policy, annual employee training records, and a cybersecurity provider—and still have serious gaps in its actual security environment. A stronger approach starts with evidence: verify that the safeguards described in the WISP work effectively in the firm’s real-world systems.
Start with evidence. Compare the WISP’s requirements with the firm’s actual security environment. Verify multi-factor authentication (MFA) across Microsoft 365, tax software, remote-access systems, and administrator accounts. Review the identity system to confirm that terminated employees lose access promptly. Test backup recovery by restoring a deleted client file and documenting the results.
The FTC Safeguards Rule requires covered financial institutions to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards appropriate to their business and the information they handle. Tax preparation firms are among the FTC’s listed examples of covered financial institutions.
This checklist helps accounting firms and tax preparers organize a practical review of their security program. It covers WISP responsibilities, risk assessment, access controls, encryption, service providers, incident response, testing, and documentation.
Important: This article provides educational information, not legal advice. Applicability and obligations depend on the firm’s activities and circumstances. Review the official rule and consult qualified legal or compliance professionals when necessary.
Quick Summary: FTC Safeguards Rule Checklist
Accounting firms and tax preparers should review the following areas as part of their information security program:
- Designate a Qualified Individual to implement and supervise the security program.
- Maintain a written information security program appropriate to the firm’s environment.
- Identify where customer information is collected, stored, processed, and transmitted.
- Conduct and document a risk assessment.
- Review access controls and implement MFA where required.
- Protect customer information through encryption or approved alternative controls where applicable.
- Evaluate the security of applications and systems handling customer information.
- Select and oversee service providers that maintain appropriate safeguards.
- Test and monitor security controls, including backup restoration where relevant.
- Maintain an incident response plan and required documentation.
- Review and adjust the program when operations, systems, or risks change.
The FTC’s official compliance guide and the text of the Safeguards Rule should guide the firm’s compliance decisions.
Does the FTC Safeguards Rule Apply to Accounting Firms?
The answer depends on the activities the business performs, not simply on whether it uses the title CPA firm, bookkeeping practice, or financial-services business.
The FTC specifically includes tax preparation firms among its examples of financial institutions covered by the Safeguards Rule. The definition of a financial institution can be broader than its everyday meaning, so firms should assess their activities rather than rely only on their business name.
For accounting firms that provide services beyond tax preparation, do not automatically assume that every service falls inside or outside the Rule. Review the relevant definitions and seek qualified guidance when coverage is unclear.
Does the small-business exemption remove the entire requirement?
No. The FTC exempts financial institutions that maintain customer information concerning fewer than 5,000 consumers from certain provisions of the Safeguards Rule. That does not mean every small accounting firm automatically avoids the Rule or its broader security responsibilities.
A small tax practice should still determine whether it is covered, understand the provisions that apply, and maintain appropriate safeguards for client information.
Official reference: FTC Safeguards Rule compliance guide.
What Is the Difference Between a WISP and the FTC Safeguards Rule?
A Written Information Security Plan (WISP) documents how a firm organizes and manages its information security program. The FTC Safeguards Rule establishes requirements for covered financial institutions.
These concepts work together, but they are not interchangeable.
| WISP | FTC Safeguards Rule |
|---|---|
| Documents the firm’s security program | Establishes regulatory requirements |
| Describes policies and procedures | Requires appropriate safeguards |
| Identifies responsibilities and processes | Requires covered institutions to implement and maintain the program |
| Should reflect actual security practices | Includes requirements related to risks, safeguards, and oversight |
The IRS also explains that a WISP is a tool for tax professionals to protect client data and should be tailored to the size, scope, complexity, and sensitivity of the information handled. IRS: Written Information Security Plans are essential for tax pros.
A document alone does not establish that every safeguard operates effectively. Firms should compare their written policies with the controls they actually use.
FTC Safeguards Rule Checklist for Accounting Firms
Use the following sections to organize a practical review. The checklist is an operational aid; the exact regulatory requirements should be confirmed against the current Rule.
1. Designate a Qualified Individual
The FTC requires covered financial institutions to designate a Qualified Individual to implement and supervise their information security program. The person may be an employee, an affiliate, or someone working through a service provider. The FTC does not require a specific degree or job title; the person needs knowledge appropriate to the firm’s circumstances.
A ten-person tax practice might designate a technically capable partner who works with an MSP. A larger accounting firm may assign responsibility to an internal technology or security leader. The important question is not simply who provides IT support. It is who has authority to oversee the security program, review risks, coordinate decisions, and supervise implementation.
Practical checklist:
- Name the Qualified Individual.
- Document the person’s responsibilities.
- Define how the Qualified Individual works with external providers.
- Identify the person responsible for internal oversight.
- Establish a process for reviewing security issues and remediation.
Outsourcing technical work does not remove the covered firm’s responsibilities under the Rule.
2. Build a Complete Customer Information Inventory
A risk assessment is only useful when the firm understands what information it holds and where it exists.
Most accounting firms can identify their primary systems:
- Tax preparation software
- QuickBooks and accounting applications
- Document management platforms
- Microsoft 365
- Cloud hosting environments
- Client portals
However, customer information can also exist in email attachments, employee Downloads folders, scanner destinations, temporary file shares, local laptop drives, old server folders, backups, and physical documents.
The FTC’s compliance guide emphasizes understanding where customer information is collected, stored, and transmitted, while maintaining an accurate inventory of systems, devices, platforms, and relevant personnel.
Practical checklist:
- Identify customer information handled by the firm.
- Record the systems that collect, store, or transmit it.
- Include local devices, cloud platforms, and backups.
- Review access by employees, administrators, and service providers.
- Update the inventory when systems or workflows change.
A spreadsheet containing sensitive taxpayer information on an employee’s local computer can create a different risk from the firm’s professionally managed tax server. The inventory should reflect the actual environment rather than only the systems listed in the IT documentation.
3. Conduct and Document a Risk Assessment
The firm should assess foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.
The FTC requires the risk assessment to be written and to include criteria for evaluating identified risks and threats. The assessment should consider how information could be disclosed without authorization, misused, altered, or destroyed. The firm must also reassess risks periodically as circumstances change.
Questions to ask:
- Which systems contain sensitive client information?
- Who can access those systems?
- What happens if a privileged account is compromised?
- How could a phishing attack affect tax-season operations?
- What happens if a backup cannot be restored?
- Which risks have the firm accepted, mitigated, or assigned for remediation?
Practical checklist:
- Document the risk assessment.
- Identify relevant internal and external threats.
- Record evaluation criteria.
- Link identified risks to safeguards.
- Reassess when the business, systems, or threats change.
A generic template can help organize the process, but it should not replace an assessment of the firm’s real systems and operations.
4. Review Access Controls and Multi-Factor Authentication
Access should follow the work an employee performs, not simply their seniority or job title.
Accounting firms frequently manage changing access requirements. Seasonal preparers arrive, interns rotate through assignments, employees change roles, external IT providers receive administrative access, and staff members leave.
The FTC requires covered institutions to implement and periodically review access controls. It also requires MFA for individuals accessing customer information on covered systems, subject to the Rule’s written approval exception for equivalent or more secure controls.
Review these systems:
| System | What to verify |
|---|---|
| Microsoft 365 | MFA, administrator privileges, session controls |
| Tax software | User permissions and authentication |
| Remote desktop | Access restrictions and MFA |
| VPN | Authentication and authorization |
| Cloud hosting | Privileged access and logging |
| Remote support tools | Provider access and administrator controls |
Practical checklist:
- Review who can access customer information.
- Confirm that access matches current job responsibilities.
- Remove unnecessary permissions.
- Verify MFA across relevant access points.
- Document any approved alternative access controls.
- Test access removal for former employees.
A partner may need access to client records without requiring unrestricted server-administrator privileges. Similarly, a seasonal preparer may need access to a specific workflow rather than every client folder.
5. Protect Customer Information Through Encryption
The Safeguards Rule requires covered institutions to encrypt customer information on their systems and while in transit, with an alternative-control route where encryption is not feasible and the Qualified Individual approves effective alternative controls. The practical challenge is understanding where protection stops.
Consider a client tax return moving through the following workflow:
- The client uploads a document to a portal.
- An employee downloads the file.
- The document is stored on a local computer.
- The preparer sends it to a reviewer.
- The completed return is delivered to the client.
- The firm retains or disposes of the document.
Encryption on a hosted server does not automatically answer how the file is protected on an employee’s personal computer or how access to encryption keys is controlled.
Practical checklist:
- Review encryption at rest.
- Review encryption in transit.
- Identify local downloads and temporary files.
- Understand encryption-key access.
- Document alternative controls when applicable.
- Review protection across the full document lifecycle.
Do not stop at a vendor’s statement that its platform uses encryption. Ask where the control applies and what happens when information leaves the platform.
6. Review Data Retention and Secure Disposal
The Safeguards Rule includes a requirement to securely dispose of customer information no later than two years after its most recent use to serve the customer, subject to exceptions for legitimate business needs, legal requirements, or technical limitations.
Accounting firms should not interpret this as a universal two-year deletion rule for every document. Tax records, workpapers, and other professional or legal obligations may affect retention decisions.
Review the distinction between:
- Customer information disposal.
- Professional record retention.
- Backup retention.
- Legal or business requirements.
For example, a cloud hosting provider may retain backups for 90 or 120 days. That describes a potential restoration window, not the accounting firm’s complete records-retention policy.
Practical checklist:
- Identify categories of customer information.
- Document retention and disposal procedures.
- Review applicable legal and business requirements.
- Assess local files and temporary copies.
- Understand backup retention separately.
- Verify that disposal methods protect sensitive information.
Important: Firms should evaluate their retention and disposal procedures against the Rule and other applicable requirements instead of applying a single deletion period to all records.
7. Test Security Controls and Backup Restoration
A security product being installed does not prove that the control works correctly.
The FTC requires covered organizations to monitor and test the effectiveness of their safeguards. The Rule allows continuous monitoring for information systems where the requirements are satisfied. Where continuous monitoring is not used, the Rule specifies penetration testing and vulnerability assessments, including the applicable frequency and system-wide scan requirements.
Firms should verify the exact testing requirements in the current Rule rather than rely on a generic annual cybersecurity checklist.
Practical verification exercises:
- Restore a deleted client file in a controlled test.
- Review the date and outcome of the latest backup recovery test.
- Revoke a test user’s access and verify the result.
- Confirm that former employees cannot sign in.
- Review whether suspicious MFA alerts reach the appropriate person.
- Examine whether identified vulnerabilities receive remediation.
Practical checklist:
- Document the chosen monitoring and testing approach.
- Review applicable testing frequency.
- Record findings and remediation.
- Test backup restoration.
- Confirm that responsible staff receive security alerts.
- Reassess controls after significant system changes.
The objective is not to collect certificates alone. It is to establish evidence that the safeguards operate as intended.
8. Evaluate Cloud Hosting and IT Service Providers
Accounting firms often rely on multiple external providers. One company may host tax software, another may administer Microsoft 365, and another may provide backup, portal, or managed security services.
The FTC requires covered financial institutions to take reasonable steps to select service providers capable of maintaining appropriate safeguards, address security expectations through contracts, and oversee provider arrangements.
Questions for vendors:
- Who can access our customer information?
- Do administrators use MFA?
- What activity do you log?
- How quickly will you notify us about an incident?
- How do you protect backups?
- What happens to our data when the contract ends?
- What evidence can you provide about relevant security controls?
SOC 2 reports, certifications, and other documentation may support a vendor review. They should not replace understanding the services the firm actually purchases and the responsibilities assigned to each party.
Practical checklist:
- Identify service providers with access to customer information.
- Review security provisions in contracts.
- Assess provider access controls.
- Document incident notification arrangements.
- Review provider oversight and reassessment.
- Understand data return and disposal at contract termination.
The firm should maintain visibility into its third-party dependencies rather than assume that an outsourced service automatically removes its own responsibilities.
9. Maintain an Incident Response Plan
An incident response plan should identify who acts when a security incident occurs.
Consider a scenario in which Microsoft 365 is compromised at 8:30 a.m. during tax season. The firm’s response may require decisions about account access, sessions, mailbox forwarding rules, connected applications, data exposure, insurance, and client communications.
The plan should establish appropriate roles, decision authority, communication processes, remediation, and documentation. These requirements should be assessed against the Rule’s incident response provisions.
Questions to document:
- Who revokes compromised account access?
- Who investigates the incident?
- Who examines suspicious mailbox forwarding rules?
- Who assesses potential access to SharePoint or OneDrive data?
- Who contacts the cyber insurer?
- Who coordinates legal review?
- Who determines whether notification obligations apply?
Practical checklist:
- Assign incident response responsibilities.
- Document escalation procedures.
- Define communication channels.
- Identify external providers and relevant contacts.
- Review containment and remediation procedures.
- Conduct exercises and record lessons learned.
The purpose of an incident plan is to reduce confusion when the firm needs to act quickly.
10. Understand FTC Security Event Notification
The FTC’s Safeguards Rule includes a notification requirement for qualifying security events.
Covered financial institutions must notify the FTC as soon as possible and no later than 30 days after discovery of a notification event involving the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. The Rule also addresses encrypted information when an unauthorized person gains access to the encryption key.
The FTC provides an online reporting form for qualifying events. FTC Safeguards Rule Security Event Reporting Form.
Practical checklist:
- Identify who evaluates a potential notification event.
- Document the incident discovery date.
- Determine whether the event meets the applicable threshold.
- Review the type of information involved.
- Escalate to appropriate legal and compliance personnel.
- Prepare to submit the required FTC report when applicable.
The FTC notification requirement does not replace other applicable federal, state, contractual, or professional obligations. Firms should seek appropriate legal guidance when assessing a significant incident.
IRS Guidance for Tax Professionals
Tax professionals should also review IRS guidance on written information security plans and taxpayer-data protection.
The IRS explains that a WISP should be tailored to the size, scope, complexity, and sensitivity of the customer data handled. IRS guidance highlights employee training and management, information systems, and detecting and managing system failures.
Recommended IRS resources
- IRS: Written Information Security Plans are essential for tax pros
- IRS Publication 5708: Creating a Written Information Security Plan for Your Tax & Accounting Practice
- IRS Publication 5709: How to Create a Written Information Security Plan for Data Safety
Use the IRS resources as supporting guidance when developing or reviewing the firm’s WISP. Confirm the applicable publication and its current version before linking to a specific requirement.
Common FTC Safeguards Rule Mistakes
Mistake 1: Treating the WISP as the entire security program
A policy can describe controls that the firm does not actually operate. Review the gap between documented procedures and real-world evidence.
Mistake 2: Assuming a small firm has no obligations
The small-firm exemption applies to certain provisions. Firms should assess coverage and the provisions that apply to them.
Mistake 3: Leaving all responsibility to the IT provider
An MSP can provide technical services, but the covered firm must understand its responsibilities and maintain appropriate oversight.
Mistake 4: Checking only email MFA
MFA review should consider relevant systems that provide access to customer information, including remote access and privileged accounts.
Mistake 5: Confusing backup retention with records retention
A backup window describes restoration capability. It does not automatically define the firm’s legal or professional retention requirements.
Mistake 6: Collecting vendor certificates without reviewing the service
Documentation can support due diligence, but the firm should understand the actual provider’s access, safeguards, and contractual obligations.
Mistake 7: Failing to test the controls
A configured security product is not sufficient evidence that a safeguard works correctly. Testing and monitoring should generate usable evidence.
Evidence Checklist: What Should Accounting Firms Document?
A firm preparing for a security review should maintain an organized, controlled location for relevant security documentation.
Examples include:
| Evidence | Purpose |
|---|---|
| WISP | Documents the information security program |
| Data inventory | Identifies systems and information locations |
| Risk assessment | Records threats, evaluation, and decisions |
| Access reviews | Supports review of permissions |
| Training records | Documents relevant staff training |
| Vendor evaluations | Supports provider oversight |
| Testing reports | Records monitoring or testing results |
| Backup restoration results | Documents recovery testing |
| Incident exercises | Supports response readiness |
| Remediation records | Tracks identified security gaps |
The specific documentation required depends on the Rule and the firm’s circumstances. This list is a practical organization aid, not a claim that each item has an identical submission or retention requirement. The policy tells the firm what it intends to do. Evidence helps demonstrate whether the controls are being performed.
Frequently Asked Questions
The FTC lists tax preparation firms among its examples of covered financial institutions. Applicability should be assessed using the Rule’s definitions and the firm’s activities.
A Written Information Security Plan documents the firm’s information security program, including its responsibilities, processes, and safeguards. IRS guidance states that the plan should be tailored to the firm’s size, scope, complexity, and data sensitivity.
Tax preparation firms should assess the applicable requirements and maintain appropriate security practices. The FTC exempts firms below the 5,000-consumer threshold from certain provisions, not automatically from the entire Rule.
The Rule provides requirements for monitoring and testing, including provisions concerning continuous monitoring, penetration testing, and vulnerability assessments. Firms should verify the testing approach and frequency against the current Rule and their circumstances.
IRS Publication 5708 and Publication 5709 provide WISP-related guidance for tax and accounting practices. Review the official IRS resources for the relevant guidance.
Service providers have obligations under the Rule, and covered financial institutions must take reasonable steps to select and oversee providers capable of maintaining appropriate safeguards. The firm should understand its own responsibilities and its provider’s contractual and operational role.
Final Checklist: Turning the WISP Into an Operating Security Program
The FTC Safeguards Rule becomes easier to manage when the firm connects the written plan to its real environment. Start with the people who own security. Identify the customer information the firm handles. Review the systems and accounts that can access it. Verify MFA, encryption, and access controls. Evaluate the vendors that process or store customer information. Test the safeguards and backup recovery processes. Document what happens when a control fails.
Then compare the findings with the WISP. Each gap between the written plan and the actual environment gives the firm an opportunity to improve its security program. The goal is not simply to produce a long document. It is to maintain a security program that accurately reflects the firm’s operations, responsibilities, safeguards, and evidence.
Review the official FTC Safeguards Rule and IRS guidance before making compliance decisions. Requirements can vary with the firm’s activities and circumstances, and significant legal or regulatory questions deserve qualified professional advice.