Managed IT Services
This article originally warned that the FTC Safeguards Rule extension was about to expire in June 2023. It did, and the rule has been fully enforceable ever since. For the profession most affected in New Jersey, the question is no longer whether the deadline is coming but whether your practice can show it complies. The FTC Safeguards Rule for tax preparers is now a standing obligation that the IRS checks at PTIN renewal, that cyber insurers ask about, and that clients increasingly expect.
This updated guide explains what it means for CPA firms, enrolled agents, and independent tax professionals, how it connects to the IRS Written Information Security Plan requirement, and what to do before the next filing season.
For the general rule, including all nine required elements and the under-5,000-consumer exemption, see our companion guide to the FTC Safeguards Rule requirements. This article focuses on the tax and accounting context.
Why Tax Preparers Are “Financial Institutions” Under GLBA
The Safeguards Rule comes from the Gramm-Leach-Bliley Act of 1999, which requires financial institutions to protect the security and confidentiality of customer information. The FTC’s definition of a financial institution covers any business significantly engaged in financial activities, and the FTC has been explicit that tax return preparation is one of them. That means the FTC Safeguards Rule for tax preparers applies to:
- CPA firms and accounting practices that prepare individual or business returns
- Enrolled agents and non-credentialed paid preparers
- Seasonal and storefront tax preparation offices
- Bookkeeping and payroll services that handle client financial records
- Financial planners and advisors not registered with the SEC
Size does not exempt you from the FTC Safeguards Rule for tax preparers. A sole practitioner preparing 300 returns from a home office is covered. The only size-based relief is the partial exemption for firms holding information on fewer than 5,000 consumers, which removes four documentation elements but keeps every technical safeguard in place.
The FTC Safeguards Rule and the IRS WISP for Tax Professionals
Tax professionals face the FTC Safeguards Rule for tax preparers from two directions. The FTC enforces the rule itself. The IRS, through the Security Summit, requires every paid preparer to have a Written Information Security Plan (WISP) and points to the Safeguards Rule as the standard that plan must meet. Since 2023, PTIN renewal includes a checkbox confirming that you are aware of the requirement to have a data security plan. IRS Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, the IRS WISP for tax professionals guide, Creating a Written Information Security Plan for Your Tax and Accounting Practice, are the IRS’s own guides, and both track the nine elements in the FTC’s Safeguards Rule guidance.
In practice, the IRS WISP for tax professionals and the FTC written information security program are the same document. A WISP that honestly describes a program meeting the FTC Safeguards Rule for tax preparers satisfies both agencies. A WISP downloaded as a template and filed away without the controls it describes satisfies neither, and is worse than no plan at all if an investigator compares it to reality. Our WISP compliance services build the plan around what your practice actually runs.
What the FTC Safeguards Rule for Tax Preparers Requires in Practice
Here is how each element of the FTC Safeguards Rule for tax preparers translates into a tax practice, with the specific systems that need attention.
Qualified Individual
Name one person responsible for the security program required by the FTC Safeguards Rule for tax preparers. In a small practice this is usually the owner or a partner, often with a managed IT provider acting as the technical lead. Put the name in the WISP.
Risk assessment and data inventory
List where taxpayer data lives: tax software and its hosted or local database, the client portal, email, scanned documents on the server or in SharePoint, QuickBooks files, payroll platforms, paper files, backups, and staff laptops and phones. Then assess the risks to each. Firms over the 5,000-consumer threshold must put this in writing; firms under it should anyway.
Multi-factor authentication
The FTC Safeguards Rule for tax preparers requires MFA for anyone accessing any system that holds customer information. For a tax practice that means the tax software login, the client portal administration, email, remote desktop or VPN, QuickBooks Online, payroll, and cloud storage. Most professional tax software now supports or requires MFA; confirm it is enforced for every preparer and every seasonal hire, not just the owner. Our guide to MFA for small business covers the options.
Encryption
Under the FTC Safeguards Rule for tax preparers, customer information must be encrypted in transit and at rest. Full-disk encryption on every computer, encrypted backups, TLS for email, and, critically, a secure client portal instead of emailing W-2s, 1099s, and completed returns as attachments. Emailing an unencrypted return is the single most common Safeguards Rule failure in tax practices.
Access controls and secure disposal
Limit each staff member to the clients and systems they work on, review access every season, and disable accounts the day a seasonal preparer leaves. The rule also requires disposing of customer information no later than two years after its last use unless a law or business need requires longer retention. Tax practices have legitimate retention needs, but “we keep everything forever” is not a policy; write down what you keep, for how long, and how it is destroyed.
Monitoring, logging, and testing
Enable audit logging in Microsoft 365 and your tax software, keep it long enough to investigate, and either monitor continuously or run annual penetration tests and semiannual vulnerability scans. Endpoint detection and response on every workstation covers the device side.
Training
The FTC Safeguards Rule for tax preparers requires security awareness training for every person who touches taxpayer data, including seasonal staff before they see their first client file. Tax season phishing is highly targeted: fake IRS notices, fake e-services alerts, fake client emails with “my documents” attached. Record who was trained and when.
Service provider oversight
Your tax software vendor, portal provider, IT company, cloud backup, payroll service, e-signature platform, and shredding vendor all handle customer information on your behalf. Keep a list, keep the agreements, and review each one annually.
Incident response plan and breach reporting
Tax season data security planning means writing down what happens when a laptop is stolen, a preparer’s email is compromised, or ransomware hits the server. Since May 2024 the FTC must be notified within 30 days of discovering a breach of unencrypted information affecting 500 or more consumers. The IRS separately asks tax professionals to report data theft to their IRS Stakeholder Liaison immediately so that fraudulent returns can be flagged, and New Jersey’s breach notification law has its own requirements. Our article on what to do after a cyberattack covers the first 24 hours.
Tax Season Data Security: The Risks Specific to Filing Season
Tax practices face a concentrated threat window, which is why tax season data security deserves its own planning. Between January and April, criminals know that every preparer’s inbox is full of Social Security numbers, bank account details, and identity documents, and that staff are too busy to scrutinize every email. The attacks that cause the most damage in New Jersey tax offices are:
- Preparer email compromise. A phished login gives the attacker every client document ever emailed, plus the ability to request more from clients in your name.
- Fraudulent refund filing. Stolen client data is used to file returns before the real taxpayer does, and the preparer’s EFIN can be hijacked to do it at scale.
- Ransomware timed to peak season, when a firm is most likely to pay to get its systems back before deadlines.
- Fake client and fake IRS emails carrying malware disguised as tax documents.
- Remote work exposure from preparers working on personal devices or unsecured home networks.
Each of these is directly addressed by the FTC Safeguards Rule for tax preparers: MFA stops the email compromise, encryption and portals protect the documents, monitoring catches the intrusion, backups defeat the ransomware, and training reduces the clicks. The rule is, in effect, a tax season data security plan written by a regulator. Our guide on how to spot a scam email is a useful pre-season handout for staff.
A Pre-Season Checklist for the FTC Safeguards Rule for Tax Preparers
Work through this FTC Safeguards Rule for tax preparers checklist in the fall, before extensions are done and the January rush begins:
- Confirm the Qualified Individual is named and the WISP has been reviewed and dated this year.
- Update the data inventory and risk assessment for any new software, staff, or offices.
- Verify MFA is enforced on tax software, portal, email, remote access, and accounting platforms for every user.
- Check that every computer, including seasonal and home machines, is encrypted and running endpoint protection.
- Make sure clients have been onboarded to the secure portal and that staff know not to accept documents by email.
- Schedule security awareness training for all staff, with seasonal hires trained on day one.
- Review and disable dormant accounts from last season.
- Test a restore from backup and confirm backups are encrypted and offsite.
- Review vendor agreements and the vendor list.
- Walk through the incident response plan, including who calls the IRS Stakeholder Liaison, the FTC, clients, and your cyber insurer.
- Run the annual vulnerability scan or penetration test if you are over the 5,000-consumer threshold.
- Deliver the annual written report to the owner or partners and file it.
The printable version of this FTC Safeguards Rule for tax preparers checklist is available on our FTC Safeguards Rule compliance page.
The Safeguards Rule for CPA Firms Versus Seasonal Tax Offices
The FTC Safeguards Rule for tax preparers applies the same way to a 40-person CPA firm in Morristown and a two-person seasonal office in Clifton, but the practical work differs. The Safeguards Rule for CPA firms usually involves more systems: audit and assurance software, client accounting services, multiple offices, and year-round staff with broad access. Larger firms almost always exceed the 5,000-consumer threshold and therefore owe the full written program, annual testing, and annual report, and they are more likely to receive security questionnaires from business clients and lenders.
The upside is that most already run Microsoft 365 Business Premium or similar platforms where the required controls are built in and only need to be enforced and documented.
Seasonal and small offices face a different challenge: a short, intense season, temporary staff, and often consumer-grade technology. The Safeguards Rule for CPA firms and small preparers alike still requires MFA, encryption, access control, disposal, training, and vendor oversight, and the under-5,000 exemption does not remove any of those. For a small office, the fastest path is a managed IT arrangement that supplies business-class laptops, enforced MFA, encrypted backup, a portal, and training as a package, so the owner can focus on returns.
Remote and Seasonal Preparers: Closing the Home-Office Gap
Since 2020, a large share of tax preparation happens from home. The FTC Safeguards Rule for tax preparers does not distinguish between the office and the kitchen table, so your program has to reach every location where taxpayer data is handled:
- Firm-owned, managed, encrypted devices for anyone who works with client data, rather than personal computers shared with family members.
- Remote access through a VPN or a hosted desktop with MFA, never an exposed remote desktop port.
- Mobile device management for phones that receive firm email or portal notifications.
- Printed documents controlled: discourage printing at home, and require shredding or return of anything printed.
- Seasonal onboarding and offboarding as formal steps, with training before access and account disablement on the last day.
Our post on whether employees should use personal devices for work covers the device side in more depth, and it applies squarely to the tax season data security problem.
Choosing a Secure Client Portal
Because document exchange is where most tax practices fail the encryption requirement of the FTC Safeguards Rule for tax preparers, the client portal deserves its own decision. Look for a portal that encrypts documents at rest and in transit, supports MFA for both staff and clients, integrates with your tax software so documents flow without re-uploading, offers e-signature for Form 8879 and engagement letters, logs every access, and lets you set retention and deletion rules.
Most major tax software vendors offer one; several standalone portals integrate with all of them. Whatever you choose, the rollout matters as much as the tool: clients will keep emailing W-2s until every engagement letter, email signature, and reminder points them to the portal and staff stop accepting attachments.
What Happens If a Tax Practice Ignores the Rule
Enforcement of the FTC Safeguards Rule for tax preparers arrives from several directions at once. The FTC can investigate and impose a consent order requiring a full security program and independent assessments for twenty years, with civil penalties for violating the order. The IRS can suspend or revoke EFIN and e-file privileges for preparers who fail to protect taxpayer data, and it has done so after data theft incidents. State regulators and the New Jersey Division of Consumer Affairs can act under state law.
Cyber insurers can deny claims where the application overstated controls. And clients whose refunds were stolen or whose identities were misused will leave, and may sue. Against that, the cost of meeting the FTC Safeguards Rule for tax preparers is modest and mostly configuration of tools you already own.
FTC Safeguards Rule for Tax Preparers: Frequently Asked Questions
I am a sole practitioner. Does the Safeguards Rule really apply to me?
Yes. The FTC Safeguards Rule for tax preparers has no minimum size. If you hold information on fewer than 5,000 consumers you are exempt from the written risk assessment, penetration testing, written incident response plan, and annual report, but MFA, encryption, access controls, disposal, training, and vendor oversight still apply.
Is a WISP the same as Safeguards Rule compliance?
The IRS WISP for tax professionals is the written plan the IRS requires and the Safeguards Rule’s written program in the same document. Compliance means the plan is accurate and the controls it describes are actually in place.
Can I still email returns to clients if I password-protect the PDF?
A password-protected PDF is better than an open one, but it does not satisfy the FTC Safeguards Rule for tax preparers: the encryption is weak and the password is usually sent in a second email. A secure client portal is the standard the rule and the IRS expect.
What should I do first if I think client data was stolen?
Contact your IT provider to contain the incident, call your IRS Stakeholder Liaison, notify your cyber insurer, and begin the clock on FTC and New Jersey notification deadlines. Do not wait to be certain; early reporting to the IRS protects your clients from fraudulent filings.
Does my tax software vendor’s security cover me?
Only partially. Under the FTC Safeguards Rule for tax preparers, the vendor secures its platform; you are responsible for your logins, your devices, your email, your staff, and your documentation. The rule’s service provider oversight element requires you to confirm the vendor’s protections, not assume them.
Get Your Practice Ready Before Filing Season
The extension is years behind us; what remains is a clear set of expectations and a short window every fall to meet them. eMDTec has helped New Jersey CPA firms, enrolled agents, and tax practices meet the FTC Safeguards Rule for tax preparers and the IRS WISP requirement through our IT support for accounting firms and managed IT services, from MFA and portal setup to the written plan and annual report. Schedule a free consultation and we will review your practice against the pre-season checklist above.