What this covers
- Federal law requires every professional tax preparer to have a written data security plan. It is not a best practice.
- The FTC Safeguards Rule sets out what the plan must address, and it now requires multi-factor authentication.
- Since May 2024, a security event affecting 500 or more people must be reported to the FTC within 30 days of discovery.
- The trigger for that report is unencrypted customer information. Encryption is not only a safeguard, it changes your reporting exposure.
Tax practices hold some of the most valuable personal data there is: Social Security numbers, bank account and routing numbers, income records and dependants' details, often for hundreds of households at once. That makes a small firm an attractive target, and it is why federal law treats tax preparers as financial institutions for data security purposes.
Most practitioners know they are supposed to have a security plan. Fewer have one written down, and fewer still have reviewed it since the rules changed. The IRS states it plainly: having a written data security plan "isn't just a good idea, it's federal law."
This guide covers what the plan has to contain, the two changes that matter most for small practices, and how to build one without turning it into a project nobody finishes.
RequirementWhy a written plan is not optional
The obligation comes from the Gramm-Leach-Bliley Act, which requires financial institutions to protect customer data. Tax preparers fall within that definition, and the Federal Trade Commission enforces the requirement through its Safeguards Rule.
The IRS describes the requirement directly: tax professionals are "required by federal law to have written plans identifying foreseeable data security risks and safeguards, and a plan of action to take in the event of a security breach."
Two words in that sentence carry most of the weight.
Written. A plan that exists in the owner's head does not count. It has to be documented, so it can be followed, tested and shown to someone who asks.
Foreseeable. The plan is not expected to anticipate everything. It is expected to address the risks a reasonable practice of your size would see coming: a lost laptop, a phished password, a misdirected email, a departing employee who still has access.
The rule scales. The IRS notes that a plan should be "appropriate to the company's size, scope of activities, complexity and the sensitivity of the customer data it handles." A sole practitioner does not need the program a 200-person firm needs. They do need one.
ElementsWhat a written plan has to cover
The FTC's guidance on the amended Safeguards Rule identifies nine elements that an information security program must include. A written information security plan, or WISP, is where a practice documents how it meets them.
The nine elements of the FTC Safeguards Rule
| Element, in the FTC's words | What it means in practice | |
|---|---|---|
| a | "Designate a Qualified Individual to implement and supervise your company's information security program." | One named person owns the program. Not "the team" |
| b | "Conduct a risk assessment." | Where client data lives and how it could be exposed |
| c | "Design and implement safeguards to control the risks identified through your risk assessment." | The controls for each risk, including multi-factor authentication and encryption |
| d | "Regularly monitor and test the effectiveness of your safeguards." | Evidence the controls work, not only that they exist |
| e | "Train your staff." | Everyone who touches client data, including seasonal staff |
| f | "Monitor your service providers." | Your software and vendors are part of your program |
| g | "Keep your information security program current." | Revise it when staff, software or channels change |
| h | "Create a written incident response plan." | What happens in the first hours of a breach |
| i | "Require your Qualified Individual to report to your Board of Directors." | A regular written report to whoever governs the firm |
The small-practice exemption. Practices that hold customer information on fewer than 5,000 consumers are exempt from four specific requirements: the written risk assessment, continuous monitoring or periodic penetration testing, the written incident response plan, and the board report. Everything else still applies, including the Qualified Individual, the safeguards themselves, staff training, oversight of service providers, and the breach report to the FTC covered below.
Element f is the one most practices underweight. Your program covers your vendors. If a client portal, a document storage service or a tax software provider handles client data on your behalf, choosing one that maintains proper safeguards and keeping an eye on it is part of your obligation, not theirs.
The IRS has published a sample template to make this easier. Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, was first released by the Security Summit in 2022 and updated in 2024. It walks through each section and provides a template a practice can adapt. Publication 4557, Safeguarding Taxpayer Data, is the companion guide the IRS recommends reviewing first.
MFAMulti-factor authentication is now required
The single most important change for small practices is multi-factor authentication.
According to the IRS, "additional safeguards, like multi-factor authentication (MFA), are required by federal law," following the FTC's update to its safeguards standards. The updated Publication 5708 highlights best practices for implementing MFA for any individual accessing any information system.
MFA means a second proof of identity beyond a password: a code sent to a phone, an authenticator app, or a hardware key. Its value is simple. Most compromised accounts are compromised through a stolen or reused password. A second factor stops that from being enough on its own.
Where to check first. Email, tax software, document storage, the client portal and any remote access tool. If a system holds or can reach client data and only asks for a password, it is a gap in your plan.
ReportingThe 30-day breach report
The second change took effect in May 2024, and many practices still do not know about it.
Tax professionals must now "report a security event affecting 500 or more people to the Federal Trade Commission as soon as possible, but no later than 30 days from the date of discovery." The FTC provides a Safeguards Rule Security Event Reporting Form for this purpose.
The definition of what triggers a report matters as much as the deadline. Under the amended rule, a "notification event" means the acquisition of unencrypted customer information without the customer's authorization.
Encryption changes your exposure. If client data is properly encrypted and is taken, it may not constitute a notification event under that definition. If it is unencrypted, it does. That makes encryption at rest and in transit one of the few controls that affects both your risk and your legal obligations after an incident.
Thirty days is short. Discovering a breach, establishing its scope, counting affected people and filing a report inside a month is difficult without a plan already in place. The IRS recommends that practices create a data theft response plan in advance, including contacting their IRS stakeholder liaison.
What a response plan should settle before anything happens
| Question | Why it matters |
|---|---|
| Who decides that an incident has occurred? | Delay starts the clock without anyone acting |
| Who can establish how many people are affected? | The 500 threshold decides whether the FTC report applies |
| Where is the FTC reporting form, and who files it? | Searching for it during an incident wastes days |
| Who contacts the IRS stakeholder liaison? | The IRS recommends this as part of a response |
| Who tells clients, and what do they say? | State notification laws may apply separately |
A practice under the 5,000-consumer threshold is not required to have a written incident response plan. It is still required to file the FTC report if an event affects 500 or more people, and the IRS still recommends a response plan. One page settling the questions above costs an hour and saves days when it matters.
State breach notification laws can impose their own obligations alongside the federal one. Check the rules in each state where you have clients.
The processBuilding a plan for a small practice
Name your Qualified Individual
One person, by name, in writing. In a small practice it will usually be the owner. The program fails without someone accountable for implementing and supervising it.
Map where client data actually lives
Not where it should live. Where it does. Email attachments, the desktop of a seasonal preparer's laptop, a shared drive, the tax software, the portal, paper files, text messages from clients who photographed their W-2. Each location is a risk you have to address or eliminate.
This step usually produces the most useful finding: client documents scattered across channels the practice never chose. Every channel you remove is a risk you no longer need to control.
Match a safeguard to each risk
For every location on the map, write down the control: encryption, MFA, access limits, a retention rule, or removal. Where a vendor holds the data, record why you are satisfied their safeguards are adequate.
Use the IRS template, do not start blank
Publication 5708 already has the structure. Adapting it to your practice is a few hours of work. Writing a plan from scratch is a project that tends not to get finished.
Write the response plan before you need it
The table above. Who decides, who counts, who files, who contacts the IRS, who tells clients. One page is enough. Its job is to remove decisions from the worst week of your year.
Train everyone who touches client data
Including seasonal preparers and anyone with access to the portal or the tax software. Phishing and misdirected email cause more exposure in small practices than sophisticated attacks. Keep a record that the training happened.
Put the review in the calendar
The Safeguards Rule expects you to test your safeguards and keep the program current. Pick a date each year, outside filing season, and review the plan against what actually changed: new staff, new software, new channels.
IntakeWhere client intake fits in your plan
For most practices, the largest and least controlled flow of sensitive data is client intake. Every season, hundreds of documents containing Social Security numbers and account details arrive by whatever route the client finds easiest.
That is a data security problem as much as an operational one. A client who emails an unencrypted PDF of a brokerage statement, or texts a photo of a W-2, has moved sensitive data through a channel your plan cannot control.
The AICPA's revised tax standards make the same point from the professional side. Effective January 2024, AICPA members providing tax services must make a reasonable effort to safeguard taxpayer data. Our engagement letter guide covers how that standard connects to the terms you set with clients.
Two practical steps close most of the gap:
- Give clients one secure route and make it the easiest one. Clients use email because it is convenient. A secure channel only works if it is less effort, not more.
- Say how documents should be sent in the engagement letter. It sets the expectation before the first upload and gives you a written basis for declining insecure submissions.
The same structure that makes document collection faster also reduces your data security exposure: one channel, one record of what arrived, and no copies scattered across inboxes.
ProductHow TaxFlo approaches this
TaxFlo gives clients a single guided portal for uploads, answers and messages, which replaces the email and text channels that are hardest to secure.
Documents are encrypted in transit using TLS and at rest using AES-256. Client-facing views mask Social Security numbers, EINs, TINs, bank account numbers and routing numbers, while preparer views show the fuller record based on role.
Two things worth being clear about. Using any software does not by itself make a practice compliant with the Safeguards Rule: the written program, the Qualified Individual, the risk assessment, staff training and the response plan are still yours. And because your plan covers your service providers, you should evaluate TaxFlo's safeguards the same way you would evaluate any vendor that handles client data.
Approved firms sign in through the provider workspace. If your firm is not set up yet, apply as a provider, try the workflow in the Playground, or talk to us about your intake process.
QuestionsFrequently asked questions
Are tax preparers legally required to have a data security plan?
Yes. Federal law requires professional tax preparers to create and implement a written data security plan. The requirement comes from the Gramm-Leach-Bliley Act and is enforced by the Federal Trade Commission through its Safeguards Rule.
What is a WISP?
A WISP is a written information security plan. It documents how a practice meets the FTC Safeguards Rule: who the Qualified Individual is, what risks exist, what safeguards address them, how staff are trained, how service providers are overseen, how the safeguards are tested, and how the program is kept current. It also sets out what to do if a breach occurs.
Does the IRS provide a WISP template?
Yes. IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, includes a sample template. It was first released by the Security Summit in 2022 and updated in 2024, with added guidance on multi-factor authentication.
Is multi-factor authentication required for tax preparers?
Yes. The IRS states that additional safeguards such as multi-factor authentication are required by federal law, following the FTC's update to its safeguards standards. It should be in place on any system that holds or can access client data.
When does a tax preparer have to report a data breach to the FTC?
A security event affecting 500 or more people must be reported to the FTC as soon as possible, and no later than 30 days from the date of discovery. The requirement took effect in May 2024. State breach notification laws may apply separately.
Does encryption affect breach reporting?
It can. Under the amended Safeguards Rule, a notification event is the acquisition of unencrypted customer information without authorization. Properly encrypted data that is taken may not trigger the FTC reporting requirement, which makes encryption one of the few controls that affects both risk and reporting obligations.
Does a small or solo practice need a written plan?
Yes. The requirement applies to all professional tax preparers regardless of size. Practices holding customer information on fewer than 5,000 consumers are exempt from four specific requirements: the written risk assessment, continuous monitoring or periodic penetration testing, the written incident response plan, and the board report. The rest of the program still applies, and so does the FTC breach report.
Sources
- FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission
- 16 CFR 314.6, Exceptions, Legal Information Institute
- Here's what tax preparers need to know about a data security plan, Internal Revenue Service
- Tax pros urged to guard against identity theft with updated written information security plan (IR-2024-308), Internal Revenue Service
- Security Summit releases new data security plan to help tax professionals (IR-2022-147), Internal Revenue Service
- FTC Requires Non-Banking Financial Institutions to Report Data Security Breaches, Akin Gump
Published by AmitaSoft LLC. This post covers practice operations and cites IRS and FTC guidance on data security requirements. It is not legal advice. Confirm current requirements with IRS Publications 4557 and 5708 and with your own counsel.