IT Security for CPA Firms: FTC Safeguards Rule and WISP Guide

Accounting and tax firms hold exactly what identity thieves want: Social Security numbers for whole families, bank account and routing numbers, employer details, income history and copies of driver's licenses. A single compromised email account at a tax firm can give a criminal everything needed to file fraudulent returns or redirect refunds for hundreds of clients.

That's why federal rules treat CPA firms and tax preparers as financial institutions, with the same basic data security obligations as a mortgage broker or finance company. Many small firms don't realize this until a client's larger company sends a vendor security questionnaire, a cyber insurer asks for their written security plan, or they check the data security box on their PTIN renewal and wonder what it's referring to.

This guide explains what the FTC Safeguards Rule requires (including the 2024 breach notification amendment), what the IRS expects, how to build a Written Information Security Plan (WISP) that's actually useful, how to get through tax season securely, and how it all maps onto the Microsoft 365 tools most firms already use.

Does the FTC Safeguards Rule apply to CPA firms?

Yes. CPA firms and tax preparers are covered by the FTC Safeguards Rule, regardless of size. The rule implements the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions to protect customer information, and the regulation's definitions specifically list tax preparation firms as an example of a covered financial institution.

The FTC Safeguards Rule (16 CFR Part 314) is the Federal Trade Commission's rule requiring non-bank financial institutions to run an information security program that protects customer information. (See our glossary entry on the FTC Safeguards Rule.)

The IRS says the same thing. IRS Publication 5708 states plainly: "Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size." The IRS and its Security Summit partners repeated this in their August 18, 2026 news release (IR-2026-92), reminding tax professionals that federal law requires them to have a Written Information Security Plan.

Who exactly is covered?

• CPA firms that prepare tax returns for individuals or businesses
• Enrolled agents and other paid preparers, including seasonal and home-based preparers
• Bookkeeping and payroll firms that handle consumers' financial information
• Solo practitioners. There's no minimum size for coverage

Firms that also handle audit, advisory or financial planning work may have additional obligations from the AICPA, state boards, SEC rules or client contracts. Those are outside the scope of this article, but the security program you build for the Safeguards Rule usually covers most of what they ask for.

What does the FTC Safeguards Rule require?

The rule requires a written information security program built around nine elements, designed and overseen by a "Qualified Individual." The FTC significantly expanded the rule in 2021, and most of the new requirements took effect on June 9, 2023. A breach notification requirement was added later, effective May 13, 2024.

A WISP (Written Information Security Plan) is the document that describes your program: who's in charge, what risks you found, what safeguards you use, how you test them and what you do when something goes wrong. The FTC rule calls it a "written information security program"; the IRS calls it a "Written Information Security Plan." It's the same thing. Our WISP glossary entry has a short definition.

Here are the nine elements, as the FTC summarizes them, with the section of 16 CFR 314.4 and what each means for a small firm:

Plus the breach notification requirement in 314.4(j), covered below.

The safeguards in element 3, in plain English

Section 314.4(c) lists specific safeguards. These are where most of the IT work lives:

1. Access controls. Only people who need client data can get to it, and access is reviewed regularly.
2. Know your data. Inventory the data, devices, systems and personnel involved, and manage them according to their importance.
3. Encryption. "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest." If encryption isn't feasible, the Qualified Individual can approve effective alternative controls.
4. Secure development. If you build or customize applications, follow secure practices. For most firms, this is limited to spreadsheets and portal configuration.
5. Multi-factor authentication "for any individual accessing any information system," unless the Qualified Individual approves equivalent or more secure controls in writing.
6. Secure disposal of customer information no later than two years after it was last used to serve the customer, with exceptions (see below). Review the retention policy periodically.
7. Change management. Have a process for changes to systems, so a well-meaning update doesn't open a hole.
8. Monitor and log user activity and detect unauthorized access or tampering.

The exemption for firms with fewer than 5,000 consumers

Small firms get relief from four provisions, not from the rule. Under 16 CFR 314.6, firms that maintain customer information concerning fewer than 5,000 consumers don't have to meet:

• 314.4(b)(1): the written risk assessment (you still have to assess risk)
• 314.4(d)(2): continuous monitoring or annual penetration testing and six-monthly vulnerability assessments
• 314.4(h): the written incident response plan
• 314.4(i): the annual written report to the board

Everything else, including the Qualified Individual, safeguards, MFA, encryption, training, vendor oversight and breach notification, still applies.

Our advice: do the exempt items anyway, in a lighter form. A two-page written risk assessment and a one-page incident response plan cost little, cyber insurers and larger clients ask for them, and IRS Publication 5708's sample WISP assumes you have them. Count carefully, too. A firm preparing returns for 1,500 households, each with a spouse and dependents, plus payroll clients' employees, can pass 5,000 consumers faster than expected.

What is the FTC breach notification requirement?

Since May 13, 2024, firms covered by the Safeguards Rule must notify the FTC within 30 days of discovering that unencrypted customer information of 500 or more consumers was acquired without authorization. The FTC approved the amendment in October 2023, and it took effect 180 days after publication in the Federal Register.

Key definitions from 16 CFR 314.2:

• A notification event is the "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains."
• Information counts as unencrypted "if the encryption key was accessed by an unauthorized person." Encrypting a laptop doesn't help if the password is on a sticky note in the bag.
• Unauthorized acquisition is presumed when there's unauthorized access to unencrypted customer information, unless you have reliable evidence that acquisition didn't or couldn't reasonably have occurred. In other words, if an attacker got into a mailbox full of tax documents, assume they took them unless your logs prove otherwise.

What the FTC report must include

Under 314.4(j)(1), the notice is filed electronically through a form on the FTC's website and must include:

1. Your firm's name and contact information
2. A description of the types of information involved
3. The date or date range of the event, if known
4. The number of consumers affected or potentially affected
5. A general description of the event
6. Whether a law enforcement official has determined that public notice would impede an investigation or harm national security, and requested a delay

The FTC has indicated it may make these reports public, with delays possible at law enforcement's request. Plan your client communications accordingly.

Other notifications you'll probably need to make

The FTC report is only one of several. For a tax firm, a breach usually also means:

Clients often live in several states, and each state's breach law applies to its residents. That's a good reason to have a breach coach (often provided by your cyber insurer) and legal counsel lined up before anything happens.

What does the IRS require of tax professionals?

The IRS doesn't enforce the Safeguards Rule, but it reinforces it at every turn: through the PTIN attestation, its security publications, and its expectations for e-file providers. It also offers the most practical free resources for building a WISP.

The PTIN data security attestation

Every paid preparer who applies for or renews a PTIN (Preparer Tax Identification Number) on Form W-12 confirms, with a checkbox, that they're "aware of [their] legal obligation to have a data security plan and to provide data and system security protections for all taxpayer information." The checkbox was added to Form W-12 in late 2019. PTINs expire at the end of each calendar year, so this confirmation comes up every renewal season.

It's a small checkbox with real consequences. If you've attested that you understand the obligation and then suffer a breach with no plan in place, that attestation won't help you.

IRS Publication 4557: Safeguarding Taxpayer Data

Publication 4557 is the IRS's main security guide for tax professionals. It explains the FTC Safeguards Rule, the threats tax firms face, and practical steps. The IRS and Security Summit pair it with the "Taxes-Security-Together" checklist and what they call the "Security Six" basics: anti-virus software, firewalls, multi-factor authentication, backup software and services, drive encryption, and virtual private networks (VPNs).

IRS Publication 5708: the sample WISP

Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice," was developed by the Security Summit (the IRS, state tax agencies and private-sector tax industry partners). The current revision is dated August 2024 and includes updated guidance on multi-factor authentication. It provides:

• A short outline of what a WISP must contain
• A full sample WISP template you can adapt
• Sample attachments: record retention policy, rules of behavior, breach procedures, employee acknowledgment, hardware inventory and a list of employees authorized to access PII

The IRS also publishes Publication 5709, a short summary flyer, and Publication 5293, the Data Security Resource Guide for Tax Professionals, which covers what to do after a data theft.

Other tax-specific obligations worth knowing

• Internal Revenue Code section 7216 makes it a crime for preparers to knowingly or recklessly disclose or use tax return information without authorization. A breach caused by recklessness can raise questions here, too.
• E-file providers with an EFIN are expected to protect taxpayer information and report security incidents to the IRS.
• Your state may have its own requirements for tax preparers and for protecting personal information.

How to build a WISP that actually works

A good WISP is short enough that staff read it and specific enough that it describes what your firm really does. The worst WISPs are 40-page downloaded templates with "[Firm Name]" still in the headers. The IRS sample in Publication 5708 is an excellent starting point, but fill it in honestly.

Here's the process we use with accounting firms:

Step 1: Name your Qualified Individual

Pick one person, usually a partner or the firm administrator. If your IT provider fills the role, the rule requires you to keep responsibility, designate a senior member of your firm to direct and oversee them, and require the provider to maintain a compliant program. Write down who it is.

Step 2: Inventory your data and systems

List where client information lives. Publication 5708's sample lists the usual places: servers, drives and USB devices; filing cabinets and storage firms; workstations, laptops, client portals and document management; web-based and cloud applications; and tax and bookkeeping software. For most firms today, the list includes:

• Tax software (desktop or cloud)
• Document management and client portal
• Microsoft 365 email, OneDrive and SharePoint (or Google Workspace)
• Accounting and payroll platforms you log into on clients' behalf
• Scanners and multifunction printers (which often store copies of scanned documents)
• Paper files, shredding bins and archive boxes
• Staff laptops, home computers used for remote work, and phones

Step 3: Assess the risks

For each place data lives, ask: who can get to it, how could it be lost or stolen, and what would happen if it were? Rate each risk. Under 314.4(b)(1), firms over the 5,000-consumer threshold must write this down with criteria for rating risks and decisions about how each risk will be mitigated or accepted. Everyone else should write it down anyway.

The biggest risks we see at accounting firms, in rough order:

1. Email account takeover through phishing, leading to stolen documents or fraudulent payment instructions
2. Remote access without MFA, especially old remote desktop setups
3. Ransomware reaching file servers and backups
4. Client data in email, where it sits unencrypted for years
5. Unmanaged laptops and home computers
6. Ex-employees and seasonal staff with lingering access

Step 4: Document the safeguards

Describe what you do for each element of 314.4(c). Be specific: "MFA is enforced for all users on Microsoft 365, tax software and the client portal" is far better than "the firm uses strong authentication."

Step 5: Write the incident response plan

One to three pages: who to call (IT provider, cyber insurer, IRS Stakeholder Liaison, legal counsel), how to contain an incident, who decides on notifications, who talks to clients, and how you document it. Publication 5708's Attachment C is a good starting point.

Step 6: Train and get acknowledgments

Train everyone at hire and at least annually, including seasonal and contract staff. Have them sign the employee acknowledgment, as Publication 5708 recommends.

Step 7: Review it every year

Publication 5708 says to review the WISP at least annually. The off-season, after the October extension deadline, is a natural time. Update it after any significant change: new software, office move, merger, or incident. The Qualified Individual's annual report to the owners can be a short memo summarizing the program's status, test results, incidents and recommendations.

How do Safeguards Rule requirements map to Microsoft 365?

Most of the technical safeguards can be met with Microsoft 365 Business Premium plus your tax software's own security features. Business Premium includes Conditional Access, Intune device management, Defender for Business endpoint protection, data loss prevention and Purview Message Encryption, according to Microsoft's licensing documentation. Business Standard doesn't include most of these. (Our Microsoft 365 plan comparison explains the differences.)

Our accounting firm case study shows what this looks like in practice. A small firm serving corporate and institutional clients needed to pass its clients' security reviews. The work included central management of every computer with full-disk encryption, multi-factor sign-in and conditional access for everyone, baselines aligned to the SOC 2 Trust Services Criteria, logging and monitoring that produce evidence, encrypted cloud storage with structured client folders, and written security policies. The firm passed its client security reviews with no remediation findings and onboarded new corporate clients.

Tax-season security: what changes from January to April?

Tax season is when attacks on tax professionals peak, staffing is stretched, and shortcuts are most tempting. The IRS and Security Summit run awareness campaigns every year warning about phishing, EFIN and CAF number theft, and remote system compromises aimed at tax professionals.

The threats we see most often during filing season:

1. "New client" phishing. An email from a "prospective client" with an attachment or link to their "tax documents." The attachment installs malware or the link steals your Microsoft 365 password.
2. IRS and software vendor impersonation. Fake emails claiming to be from the IRS e-Services team or your tax software vendor, asking you to "verify" your account.
3. Business email compromise. An attacker in a client's or your own mailbox sends altered bank details for a payment or refund. The FBI's IC3 reported more than $3 billion in business email compromise losses in 2025 (IC3 2025 Internet Crime Report), the second-largest loss category after investment fraud.
4. Remote access takeover. Attackers use stolen credentials or exposed remote desktop services to get into a preparer's computer and file fraudulent returns using the firm's own software and EFIN.
5. Seasonal staff risk. Temporary staff with full access, shared logins, personal devices and little training.

Our phishing and business email compromise guide covers these attacks in depth, and our phishing quiz is a quick way to test your team.

Tax-season security checklist

Signs your firm's EFIN or software may be misused

The IRS lists warning signs in its data theft guidance. Watch for:

• More e-file acknowledgments than returns you filed
• Clients receiving IRS letters about returns they didn't file, or getting rejections because a return was already filed
• Computer cursors moving on their own, or the computer slowing unexpectedly
• Unfamiliar sign-ins or password reset emails for your tax software or e-Services account

If you see any of these, disconnect the affected computer from the network and call your IT provider and IRS Stakeholder Liaison.

How should a CPA firm exchange documents with clients?

Use a secure client portal or encrypted email for every document containing client financial information, and stop accepting tax documents as ordinary email attachments. The Safeguards Rule requires encryption of customer information in transit over external networks, and email is where most firms fall short.

Here's how the common options compare:

A few practical points:

1. Make the portal the default. Put it in your engagement letter and client welcome email. When a client emails a W-2 anyway, reply with the portal link rather than working from the attachment, and delete the email copy once the document is saved.
2. Turn on MFA for the portal for both staff and, where the portal supports it, clients.
3. Use expiring links. If you share OneDrive or SharePoint folders, set links to expire and to work only for the named client.
4. Set a mailbox retention policy so old emails with attachments don't accumulate forever. Microsoft 365 Business Premium includes retention policies for Exchange, SharePoint and OneDrive.
5. Never send passwords in the same email as an encrypted PDF. Use a phone call or text for the password, or better, use the portal.

Remote and hybrid work for accounting staff

Remote work is fine under the Safeguards Rule, as long as remote access is protected by MFA and the devices are managed. Section 314.4(c)(5) requires MFA for any individual accessing any information system, which includes remote connections.

The setups we see causing trouble are an exposed Remote Desktop Protocol (RDP) port on the office server, personal home computers with full access to client files, and shared family PCs. Safer patterns include:

• Firm-owned laptops enrolled in Intune with BitLocker, Defender and automatic updates
• Cloud-hosted files in SharePoint or OneDrive with Conditional Access requiring a compliant device, rather than VPN access to an office file server
• Remote access gateways that require MFA, if desktop tax software has to stay on an office server, rather than RDP open to the internet
• Separate home Wi-Fi for work devices where possible, and never public Wi-Fi without a VPN

Document whatever you choose in the WISP's remote access policy, which Publication 5708 lists among the suggested policies.

Records retention and secure disposal in practice

The Safeguards Rule's two-year disposal requirement has important exceptions, so the practical answer is a written retention schedule with a reason for each record type. Under 314.4(c)(6), you must securely dispose of customer information no later than two years after it was last used to serve the customer, unless it's necessary for business operations or another legitimate business purpose, it's required to be kept by law or regulation, or targeted disposal isn't reasonably feasible. You must also periodically review your data retention policy.

For a tax firm, that usually means:

1. List record types: returns and workpapers, source documents, engagement letters, payroll records, correspondence.
2. Set a retention period for each, with the reason: a legal requirement, professional standards, your statute-of-limitations exposure, or a client's continuing relationship. Your professional liability insurer and state board may have guidance.
3. Dispose of the rest securely and on a schedule. Shred paper through a vendor that provides certificates of destruction. Wipe or destroy drives in retired computers, servers and copiers. Multifunction printers often store images of everything they've scanned.
4. Clean up email and file shares. Old client folders in former employees' OneDrive accounts and years-old email attachments are the data most often stolen and least often needed.
5. Record what you did. A one-line log entry ("2026-11-15: destroyed 2018 and earlier paper files, 14 boxes, certificate on file") is evidence your program works.

Publication 5708's sample Attachment A is a record retention policy you can adapt.

What does good security cost a CPA firm?

For most small firms, the core technology is a Microsoft 365 Business Premium subscription, a business-grade backup, and a managed IT provider to configure and monitor it. Specialized items like penetration tests, client portals and cyber insurance are on top.

We don't quote list prices here because they change and depend on firm size. Instead, here's what typically drives cost:

Our managed IT cost calculator gives a ballpark for your firm's size, and our cyber insurance requirements checklist explains what insurers ask for.

Mistakes we see at accounting firms

The same handful of gaps appear again and again, and most are cheap to fix.

1. A downloaded WISP nobody's read. The template is filled in with the firm's name and filed. It doesn't describe what the firm actually does.
2. MFA everywhere except one place. Usually the old remote desktop connection, a shared admin account, or the partner who "doesn't need it."
3. Clients emailing tax documents, and staff emailing completed returns back, unencrypted. Move document exchange to a portal or encrypted email.
4. Seasonal staff sharing a login to the tax software or a workstation.
5. Ex-employee accounts still active months after they left, sometimes with mail forwarding to a personal address.
6. Backups on a USB drive plugged into the server, which ransomware encrypts along with everything else.
7. No inventory of client data. Ten years of PDFs in a partner's OneDrive, scanned returns on the multifunction printer's hard drive, boxes of paper in a storage unit.
8. Paying wire or refund-related changes on email instructions without a phone call.
9. Vendors with no security review. The document management or payroll platform holding thousands of clients' data, with no contract language about safeguards.
10. Never testing. No vulnerability scan, no restore test, no phishing simulation, ever.

Scenario walk-throughs

A solo enrolled agent working from home

One preparer, about 400 returns a year, working from a home office with a laptop and a cloud tax product.

What the rules require: All of the Safeguards Rule except the four provisions exempted for firms under 5,000 consumers. A WISP, MFA on everything, encryption, secure disposal, training (yes, of yourself), vendor oversight and FTC breach notification.

What we'd set up: Microsoft 365 Business Premium (or a comparable secure business email), BitLocker on the laptop, a separate standard user account for daily work, MFA on email, tax software and e-Services, a client portal for documents, cloud backup with versioning, a home Wi-Fi network separate from family devices, and a 10-page WISP based on Publication 5708.

An eight-person CPA firm in Ormond Beach

Two partners, four staff accountants, an admin and seasonal help. Desktop tax software on a server, Microsoft 365 Business Standard, remote access for partners.

Gaps we'd expect: no Conditional Access or device management on Business Standard, an old remote desktop setup, documents arriving by email, a USB backup, and a WISP from a few years ago.

What we'd change: move to Business Premium for Conditional Access, Intune, Defender and message encryption; replace exposed remote desktop with secure remote access behind MFA; enforce a client portal for documents; implement immutable cloud backups with a tested restore; set up seasonal staff with individual accounts; rewrite the WISP with the partner as Qualified Individual; and schedule a vulnerability scan. Our ransomware protection guide covers the backup design.

A 30-person firm with corporate clients

Tax, audit and advisory. Larger clients send security questionnaires and ask about SOC 2.

What's different: The firm almost certainly exceeds 5,000 consumers, so the full rule applies: written risk assessment, continuous monitoring or annual pen testing with six-monthly vulnerability assessments, a written incident response plan, and an annual written report to the partners. Client contracts may require more. This is the situation in our accounting firm case study, where a SOC 2–aligned environment with documented controls let the firm answer questionnaires confidently and pass client security reviews.

Questions to ask your IT provider

1. Is MFA enforced for every user on email, tax software, remote access, the portal and admin accounts? How is it enforced?
2. Are all laptops and desktops encrypted, and can you show me a report?
3. Where are our backups, is at least one copy immutable or offline, and when did we last test a restore?
4. Who monitors security alerts, and what happens outside business hours?
5. How do you remove access when a seasonal or permanent employee leaves?
6. Can you produce an inventory of our devices and the systems holding client data?
7. When did we last have a vulnerability scan? Have we ever had a penetration test?
8. Will you help us update our WISP and incident response plan each year?
9. If we have a breach, what do you do in the first hour?

If you'd like to see where your firm stands, our cyber insurance readiness check covers many of the same controls the Safeguards Rule requires.

The bottom line

If your firm prepares tax returns, the FTC Safeguards Rule applies to you, and has since long before the 2023 and 2024 amendments. You need a Qualified Individual, a written plan that reflects reality, MFA and encryption, trained staff, vendor oversight, an incident response plan, and a way to notify the FTC within 30 days if 500 or more consumers' unencrypted data is acquired. The IRS gives you a free head start with Publications 4557 and 5708, and Microsoft 365 Business Premium covers most of the technical controls when it's configured properly.

Beefed Up IT works with accounting and tax firms in Ormond Beach, Daytona Beach, Palm Coast and remotely across the US to build security programs that satisfy the Safeguards Rule, the IRS and demanding clients. See our security services and accounting firm case study, or book a free 20-minute call and we'll walk through your WISP and setup before next filing season.