Data security for tax staff: the FTC Safeguards Rule, a WISP and IRS Publication 4557

In this lesson you will

Explain why professional tax preparers are financial institutions under the GLB Act
List the Safeguards Rule elements in 16 CFR 314.4 that a WISP must address
Apply the FTC notice rule for a security event affecting 500 or more people
Describe the staff steps when data theft is suspected

Why preparers are covered

IRS Publication 4557 (Rev. 6-2024) explains that the Gramm-Leach-Bliley Act requires companies defined as financial institutions to protect the security and confidentiality of customer information, and that the definition includes professional tax preparers. The FTC implemented the Act through the Safeguards Rule at 16 CFR Part 314, whose definitions in 314.2 list an accountant or other tax preparation service that completes income tax returns as a financial institution. The rule requires a written information security program, which the IRS calls a written information security plan (WISP). Publication 4557 states that failure to create and enact a security plan may result in an FTC investigation. Authorized e-file providers also follow the security standards in Publication 1345.

What the plan must address

Section 314.4 sets the elements, and Publications 4557 and 5708 (Rev. 8-2024) summarize them. The plan must be appropriate to the firm's size and complexity, the nature and scope of its activities, and the sensitivity of the customer information. Each firm must:

designate a qualified individual to oversee, implement and enforce the information security program;
identify and assess risks to customer information in each relevant area of operations, and evaluate the effectiveness of current safeguards;
design and implement a safeguards program, and regularly monitor and test it;
select service providers that can maintain appropriate safeguards, require safeguards by contract, and oversee their handling of customer information;
evaluate and adjust the program for changes in the business or the results of testing and monitoring;
implement multi-factor authentication for any individual accessing any information system, unless the qualified individual approves in writing reasonably equivalent or more secure access controls (314.4(c)(5));
provide security awareness training with regular refreshers; and
notify the FTC of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers as soon as possible and no later than 30 days after discovery (314.4(j)).

Under 314.6, a firm that keeps customer information on fewer than 5,000 consumers is exempt from a few elements: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual written report to the board. The core plan, qualified individual, MFA, training and FTC notice still apply.

Publication 4557 notes that multi-factor authentication means at least two of a knowledge factor (a password), a possession factor (a token) and an inherence factor (biometrics).

Building the WISP

Publication 5708 gives a sample outline: objectives, purpose and scope; the designated qualified individual and responsible officials; risk assessment; hardware and data inventory; safety measures in place; an implementation clause; and attachments. It treats the WISP as an evergreen document to be reviewed at least annually and after material changes, with annual staff training and signed acknowledgments kept on file. The WISP template follows this outline.

Basic safeguards for staff

Publication 4557's checklist turns the plan into daily habits:

use the firm's security software and keep it updated on every device;
use multi-factor authentication wherever offered;
encrypt sensitive files and emails, and send client data only through the secure portal;
back up encrypted copies of client data;
use strong passphrases and never share credentials;
be suspicious of emails asking you to open attachments or click links, especially from new "clients."

Spotting and reporting data theft

Publication 4557 lists clues such as client returns rejected because a return with the same SSN was already filed, clients receiving IRS notices about returns they did not file, and unexpected account activity. If theft is suspected, the publication directs firms to report it to the IRS through the local Stakeholder Liaison, and to keep the liaison updated during recovery. Staff should escalate to the qualified individual immediately rather than investigate alone.

The data theft response plan sets out who to call and in what order.

Worked example

A phishing click at Northgate Tax: deciding the FTC notice

On March 3, 2026 a Northgate Tax associate opens an attachment from a fake new client. On March 10 three clients report e-file rejections because returns were already filed under their SSNs. The qualified individual confirms that an attacker used the associate's credentials, which were not protected by multi-factor authentication, to download a client folder.

Scoping: the folder held unencrypted 2025 organizers for 620 individuals, each with names and SSNs.

Step 1, IRS: the firm reports the theft to its IRS Stakeholder Liaison on March 10, as Publication 4557 directs, and provides the affected client list so the IRS can watch for fraudulent returns.

Step 2, FTC: the attacker acquired unencrypted information on 620 consumers, at least the 500 in 16 CFR 314.4(j), so the firm must notify the FTC as soon as possible and no later than 30 days after discovery. The event is discovered on the first day an employee other than the attacker knows of it, March 10, so the deadline is April 9, 2026 (21 days left in March plus 9 in April).

Step 3, root cause and WISP update: the missing multi-factor authentication was a gap against the Safeguards Rule. The qualified individual enables it for all accounts, records the change in the WISP, schedules phishing training, and documents the post-incident review.

Conclusion: two notices (IRS liaison and FTC), a dated WISP update, and training records are the evidence the firm responded as the rules require.

Self-check

Answer each question before you open the answer.

Why does the FTC Safeguards Rule apply to tax preparers?
Show answer
Tax preparation is a financial activity, so 16 CFR 314.2 treats an accountant or tax preparation service that completes income tax returns as a financial institution. The Safeguards Rule implements the Gramm-Leach-Bliley Act for financial institutions under FTC jurisdiction.
When must a firm notify the FTC of a security event?
Show answer
When a notification event (unauthorized acquisition of unencrypted customer information) involves at least 500 consumers. Notice is due as soon as possible and no later than 30 days after discovery, under 16 CFR 314.4(j).
Who must be designated under the Safeguards Rule to run the security program?
Show answer
A qualified individual responsible for overseeing, implementing and enforcing the information security program, under 16 CFR 314.4(a). The person can work for the firm, an affiliate or a service provider, but the firm keeps responsibility for compliance.
Where does Publication 4557 tell a firm to report client data theft to the IRS?
Show answer
To the firm's local IRS Stakeholder Liaison, and the firm keeps the liaison updated during recovery. IRS telephone assistors cannot accept third-party reports of identity theft, so the liaison is the channel.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error