What it is
Tax and accounting firms hold the data fraudsters want. Many are financial institutions under the FTC Safeguards Rule, and the IRS expects tax professionals to protect client data. A written plan lays out who is responsible, which risks matter and which safeguards the firm runs.
The template follows the rule’s main elements: a qualified individual, a written risk assessment, a safeguards table with owner and evidence, testing, training, service provider oversight, incident response and an annual report to leadership. IRS Publication 4557 and Publication 5708 describe the IRS expectations.
When to use it
- Setting up a security program for the first time.
- Updating the plan after a risk assessment or incident.
- Answering a client or insurer security questionnaire.
What’s inside
- Scope, qualified individual and roles
- Risk assessment and testing requirements
- Safeguards table: inventory, access, MFA, encryption, backups, disposal and more
- Training, service providers, incident response, annual report and acknowledgment
Standard cited
This template follows 16 CFR Part 314 / IRS Pub. 4557. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Does the Safeguards Rule apply to my firm?
The rule applies to financial institutions under FTC jurisdiction, and the FTC has treated tax preparers and many accountants as covered. Under 16 CFR 314.6, firms that hold information on fewer than 5,000 consumers are exempt from some provisions, including the written risk assessment, the incident response plan and the annual report to the board.
Does having this document make a firm compliant?
No. Compliance depends on doing what the plan says, and keeping evidence. The plan is a starting point to adapt with advice from counsel or a security adviser.
What is the qualified individual?
The person the firm designates to oversee and implement the information security program. The plan names the person and lists the duties.
Related templates
- WISP Risk Assessment Worksheet (Excel)
- Incident Response Plan for CPA Firms
- Firm Technology and Data Inventory Register (Excel)
- Vendor Due Diligence Questionnaire for CPA Firms
Last updated 11/05/2026. All free templates.