If your accounting firm prepares tax returns or handles clients’ private financial information, the FTC Safeguards Rule likely applies to you. Professional tax preparers are considered financial institutions under the rule. That includes sole practitioners, small CPA firms, and larger accounting practices. IRS Publication 4557 also applies to tax professionals, but it serves a different purpose. The FTC Safeguards rule creates enforceable obligations, while the IRS publication offers practical guidance for protecting taxpayer data. Your firm needs to understand and address both.
There is much less gray area than many firm leaders believe.
What Is The FTC Safeguards Rule?
The Federal Trade Commission (FTC) Safegurds Rule requires covered financial institutions to develop, implement, and maintain a written security program. That program must protect the private information customers provide to the business.
The definition of a financial institution goes far beyond banks and investment companies. The FTC specifically identifies tax preparation firms as covered financial institutions.
If your firm uses Preparer Tax Identification Numbers, or PTINs, and an Electronic Filing Identification Number, or EFIN, you are handling information that criminals can use to commit tax and financial fraud. Protected information may include:
- – Social Security numbers
- – Tax returns and supporting documents
- – Bank account and routing numbers
- – Payroll records
- – Business financial statements
- – Investment and retirement account information
- – Driver’s license and identification documents
- – Dates of birth
- – Login credentials
- – Information received from other financial institutions
The rule previously included more limited requirements for financial institutions holding customer information concerning fewer than 5,000 consumers. That threshold still provides an exemption from certain provisions. However, it does not exempt a smaller firm from its overall responsibility to protect customer data.
Small firms still need safeguards such as a qualified person overseeing the program, a written risk assessment, multi-factor authentication, encryption, employee training, vendor oversight, and an incident response plan.
Whether your firm is a sole practitioner in Scottsdale, AZ or a growing practice serving clients across the United States, firm size does not make sensitive data less valuable to criminals.
FTC Safeguards Rule vs. IRS Publication 4557
The FTC Safeguards Rule and IRS Publication 4557, Safeguarding Taxpayer Data, point firms toward many of the same protections. However, they are not interchangeable. The FTC Safeguards Rule provides the legal requirements. It tells covered financial institutions that they must maintain safeguards for customer information. The FTC can investigate firms and pursue enforcement when those obligations are ignored.
IRS Publication 4557 is guidance specifically written for tax professionals. It explains practical ways to secure devices, protect client files, recognize phishing, monitor EFIN activity, train employees, respond to data theft, and recover after an incident.
I explain the difference this way: Publication 4557 helps show tax professionals what good data protection looks like. The FTC Safeguards Rule provides the regulatory teeth behind it.
Your firm does not need two disconnected security programs. It needs one coordinated program that accounts for the enforceable FTC requirements and the practical tax-industry guidance from the IRS.
Common Compliance Gaps In Accounting Firms
Multi-Factor Authentication
Multi-factor authentication requires a user to provide more than a password before gaining access. This can be done through an authentication application.
Many firms still see that extra step as a nuisance. However, passwords are stolen every day through phishing, reused credentials, and fake login pages. Multi-factor authentication can stop a stolen password from becoming full access to the firm’s email, tax software, or client files.
Encryption
Encryption is another common gap. Client data should be protected while it is stored and while it is being transmitted. In security terms, this is called encryption “at rest” and “in transit.”
Moving from an aging local server to a properly managed cloud environment can make encryption, access control, logging, and remote security easier. However, moving to the cloud does not create automatic compliance. The cloud platform must still be configured correctly.
Security Testing
Another difficult requirement is security testing. Firms need a reliable way to determine whether their safeguards work. Depending on the firm’s size and situation, this may include continuous monitoring, vulnerability assessments, and penetration testing.
I do not believe a managed IT company should grade its own work without independent validation. That is like auditing your own financial statements. A qualified third party should conduct penetration testing so the firm receives an objective assessment.
Other Compliance Gap
Other gaps we commonly encounter include:
- – Employees sharing usernames and passwords
- – Former employees remaining active in firm applications
- – Too many users holding administrator privileges
- – Client files exchanged through ordinary email
- – Personal computers used to access taxpayer information
- – No reliable record of who accessed a file or changed data
- – Backups that have never been tested
- – An incident response plan with outdated contact information
- – Security training completed once and never repeated
- – No documented review of third-party vendors
- – A WISP that does not match the firm’s actual technology
These gaps create more than a compliance problem. They give criminals additional opportunities to reach taxpayer information.
The FTC Safeguards Rule And Your WISP
A Written Information Security Plan, commonly called a WISP, documents how your firm protects customer information. The IRS states that professional tax preparers must create and enact a security plan.
Your WISP should be reviewed at least annually and whenever the firm experiences a major change. Examples include opening an office, changing tax software, adopting an AI platform, moving data to the cloud, merging with another practice, or allowing a new type of remote access.
For more information and help developing your plan, read our article, WISP for CPAs: How AI Can Help Accounting Firms.
Practical FTC Safeguards Rule Compliance Checklist
A practical compliance program should include the following actions:
- – Designate a qualified individual to oversee the security program.
- – Inventory applications, devices, cloud platforms, servers, and client-data locations.
- – Complete and document a written risk assessment.
- – Create a WISP customized to the firm’s actual environment.
- – Limit access based on each employee’s role.
- – Require multi-factor authentication anywhere customer information can be accessed.
- – Encrypt client information while stored and transmitted.
- – Securely dispose of paper and electronic records.
- – Use strong, unique passwords and prohibit account sharing.
- – Monitor user activity and maintain audit logs.
- – Train employees to recognize phishing and fraudulent requests.
- – Conduct simulated phishing campaigns and follow-up training.
- – Evaluate vendors that handle or can access client information.
- – Document security requirements in vendor agreements.
- – Maintain encrypted and isolated backups.
- – Test whether backups can be restored.
- – Conduct independent security testing.
- – Create and test an incident response plan.
- – Establish breach-notification procedures.
- – Review the WISP at least annually.
- – Report on the security program to firm leadership.
The checklist must produce evidence. Keep your risk assessments, training records, testing results, vendor reviews, leadership reports, and documentation of corrective actions. A template with checked boxes will not protect your firm if its controls were never implemented.
What Happens If Your Firm Does Not Comply?
The consequences can reach far beyond a single regulatory fine.
FTC Enforcement
The FTC may investigate a covered firm that fails to maintain reasonable safeguards. An enforcement action may require corrective measures, outside assessments, reporting, and years of regulatory oversight.
One relevant example involved TaxSlayer, an online tax preparation provider. The FTC alleged that the company failed to maintain an adequate security program before an account takeover attack affected thousands of customers.
The resulting order prohibited TaxSlayer from violating the applicable privacy and security rules for 20 years. It also required 10 years of independent compliance assessments. Read the FTC’s TaxSlayer enforcement announcement.
Financial penalties depend on the violation and the legal authority used. Civil penalties can become substantial when a company violates a final FTC order. However, firms should not assume there is one fixed fine for every Safeguards Rule failure.
The real exposure may combine legal expenses, remediation costs, regulatory oversight, client claims, state penalties, and business interruption.
Breach-Reporting Obligations
The FTC Safeguards Rule requires covered institutions to notify the FTC within 30 days of discovering certain events involving the unauthorized acquisition of unencrypted information belonging to at least 500 consumers.
That threshold can be reached quickly. One employee emailing an unencrypted file may affect a single client. A compromised tax platform, server, or cloud account could expose information belonging to hundreds or thousands of people.
Arizona and other states have separate breach-notification laws. Firms serving clients in multiple states may need to address several reporting requirements.
EFIN Deactivation or IRS Sanctions
The IRS continuously reviews EFINs and can deactivate an EFIN that it determines has been compromised. The firm may be unable to electronically file returns until the issue is resolved and a new EFIN is issued.
Violations of IRS e-file requirements can also result in sanctions. According to IRS Publication 3112, sanctions can include reprimand, suspension, or expulsion from the IRS e-file program. Suspensions commonly last one or two years. Serious violations involving identity theft, fraud, or criminal conduct may lead to immediate suspension or expulsion.
A breach does not automatically mean permanent revocation. However, failing to protect an EFIN, report a compromise, correct known weaknesses, or follow IRS requirements can threaten a firm’s ability to file returns.
Financial And Reputational Damage
A data incident can also create:
- – Forensic investigation expenses
- – Legal and regulatory costs
- – Client-notification expenses
- – Credit-monitoring costs
- – Ransomware recovery expenses
- – Lost productivity during filing season
- – Fraudulent tax returns
- – Payment and direct-deposit fraud
- – Higher cyber insurance premiums
- – Lost clients and referral relationships
- – Long-term damage to the firm’s reputation
Accounting firms are built on trust. Clients expect their CPA to protect information that could be used to steal their identity, drain an account, or commit tax fraud. Once that trust is broken, restoring the technology may be easier than restoring the relationship.
Three Actions To Take In The Next 90 Days
If your firm is unsure where to start, do not attempt to fix every system at once. Start with the applications that create the greatest risk.
- 1. Make a complete list of your applications. Include tax software, email, file storage, payroll systems, client portals, bookkeeping platforms, remote-access tools, and AI applications.
- 2. Rank them according to how much sensitive information they contain and how many employees use them.
- 3. Review your three highest-risk applications. Ask the following questions:
- – Is multi-factor authentication required?
- – Can we use single sign-on?
- – Can access be limited by location or approved network?
- – Are employees sharing accounts?
- – Do any former employees still have access?
- – Does anyone have more access than necessary?
- – Can we review an audit log?
- – Is the stored and transmitted data encrypted?
This approach addresses the systems where one improvement can protect the greatest amount of client information.
Build A Program You Can Defend
At Ma’atIT, we believe our responsibility is to protect our clients before recommending a product or piece of equipment.
Because we specialize in CPA firms, we understand the rules, applications, deadlines, and risks affecting the profession. We give clients the advice we believe is in their best interest, even when nobody is looking. That means recommending safeguards that support the firm’s real compliance obligations, not simply selling another server or security product.
If you are unsure whether your WISP matches your technology, or whether your safeguards are properly implemented, contact Ma’atIT. We can evaluate your environment, identify the highest-risk gaps, and help you build a security program your clients and firm leadership can trust.
Fady Salama, President
Fady Salama is the Founder and CEO of Ma’atIT, where he helps businesses align technology with profitability and growth. With a strategic, numbers-driven approach, Fady works as a fractional CIO for his clients, going beyond IT support to build smarter roadmaps, reduce waste, and drive measurable business results.