The FTC Safeguards Rule Checklist for Small Accounting & CPA Firms
Published July 22, 2026 · 10 min read
TL;DR
As of June 2023, the FTC Safeguards Rule applies to almost every accounting and tax practice — not just large firms. You need a written Information Security Program with nine specific elements, a Qualified Individual, MFA, encryption, and a written incident response plan. This checklist walks the nine items you are legally required to have.
Who this is for
Small and solo CPA firms, tax preparers, bookkeeping practices, enrolled agents, and accounting outsourcers. If you prepare individual tax returns, offer bookkeeping to small businesses, or handle any client financial data, the FTC Safeguards Rule applies to you as a “financial institution” under the Gramm-Leach-Bliley Act.
Everything below is drawn from the FTC’s own plain-language guidance. The IRS also requires a Written Information Security Plan (WISP) from every paid tax preparer — see IRS Publication 5708. The overlap is significant, so a good Safeguards program covers both.
Am I actually subject to it?
Almost certainly yes. The FTC treats you as a financial institution if you are “significantly engaged in activities that are financial in nature.” That explicitly includes tax preparers, bookkeepers, and CPA firms that offer accounting services.
If you have fewer than 5,000 consumers whose information you handle, you get a limited exemption from a few items (written risk assessment, incident response plan, annual report to management). Everything else in this checklist still applies.
The nine required elements — in plain English
The Safeguards Rule lists nine specific things your Information Security Program must include. Here they are, one by one, with what “compliant” actually looks like at a small practice.
1. Designate a Qualified Individual
A single named person responsible for the security program. Can be the owner, can be a partner, can be an outsourced IT provider — but it must be one identified person, in writing. If you outsource it, you still supervise them, and a partner or owner has to be that supervisor.
2. Written risk assessment
A written document identifying reasonably foreseeable threats to client information — phishing, ransomware, insider misuse, stolen laptops, vendor breach, physical break-in — and how you rank the risks. Updated periodically as your practice changes.
3. Design and implement safeguards
Based on your risk assessment, put controls in place. At minimum, the FTC calls out access controls, data inventory, encryption, secure application development or vendor selection, MFA, secure disposal, change management, and logging. See Section 4 for the practical version.
4. Regularly monitor and test safeguards
Either continuous monitoring, or annual penetration testing plus semi-annual vulnerability assessments. For a small practice with cloud systems, credentialed vulnerability scans from a reputable vendor twice a year meet the bar.
5. Train your workforce
Security awareness training for every staff member, including seasonal preparers. Refreshed at least annually. Log dates and topics. Cover phishing specifically — it is how nearly every accountant breach starts.
6. Oversee service providers
Every vendor with access to client information — cloud tax software, portal, payroll platform, IT contractor, offshore bookkeeping, e-signature — has a written contract requiring them to protect the data. You periodically assess how well they are doing it.
7. Keep the program current
When you add a new tax platform, hire staff, open a second office, adopt AI tools, or a material threat emerges — the program gets updated to reflect it. Not once, done forever.
8. Written incident response plan
What you do when something goes wrong. Roles, notifications, escalation, evidence preservation, communication to affected clients. Written out, tabletop-tested at least once a year.
9. Annual report to management
Your Qualified Individual reports at least annually to your Board (or, in a small firm, the owner or managing partner) on the state of the program, risk assessment updates, incidents, and recommendations. Keep the report on file.
The technical controls a small firm actually needs
The Safeguards Rule updated in 2023 spelled out specific controls. Here is the working checklist for a small firm.
- Multi-factor authentication (MFA), everywhere it fits. Tax software, portal, email, remote access, cloud storage, admin accounts on any platform. The rule specifically requires MFA for anyone accessing client info. This is non-negotiable.
- Encryption of client data at rest and in transit. Full-disk encryption (BitLocker, FileVault) on every laptop and workstation. TLS for email and portals. Encrypted backups. If a laptop with unencrypted client returns is stolen, you have a state-law breach on your hands.
- Access controls — least privilege. Seasonal preparers can see the returns they work on, not the whole client base. Bookkeeper does not have admin on your tax software. Terminated staff removed within 24 hours.
- Unique logins. No shared ‘front desk’ or ‘interns’ account. Every human gets a unique named account with their own MFA.
- Data inventory. You know what client information you have, where it lives (tax software, portal, email, workstations, cloud drives, paper files), and how long you keep it. Kept as a document you can update.
- Secure disposal. Client information disposed of no later than two years after its last use for that client — unless you need it for a legitimate business purpose or the law requires you to keep it, which for tax records it often does. Old laptops wiped or shredded with a certificate. Paper client files shredded, not tossed. Retired portals purged of client data.
- Logging and monitoring. Your tax software logs who accessed which return. Your email tenant logs sign-ins. Someone reviews the logs periodically — or you route them to a monitoring service.
- Patch management. Windows, Mac, and applications updated on a regular schedule. No end-of-life operating systems. Automatic updates enabled where practical.
- Vulnerability testing. Either annual penetration testing plus semi-annual vulnerability scans, or continuous monitoring. Written results kept on file.
The IRS WISP requirement layered on top
Every paid tax preparer with a PTIN must have a written security plan under the IRS rules. The good news: the WISP requirements are a subset of the FTC Safeguards Rule requirements. Build one program and you satisfy both.
The WISP specifically should include:
- Identity of your Data Security Coordinator. Same person as your FTC Qualified Individual if you like.
- Scope statement. What client information you handle, and where it lives.
- Risk assessment. Reasonably foreseeable threats to that data.
- Employee guidelines. Acceptable use, phishing awareness, password rules, mobile devices.
- Incident response steps. Including notifying the IRS Stakeholder Liaison and the FBI if you experience a data theft event.
- Annual review. Documented, signed by the coordinator.
The IRS publishes a sample WISP in Publication 5708 — you can fill in the template in an evening and it is a perfectly acceptable starting point.
Incident response — the version you actually need
Client tax data breach reporting is not just theoretical: state laws require notification, and if returns were stolen for refund fraud, you have IRS reporting obligations too. Have this nailed down before you need it.
- Named incident lead. Your Qualified Individual, or a specific backup if they are unreachable.
- Contact list on paper. Cyber insurance carrier, outside counsel, IT vendor, IRS Stakeholder Liaison, local FBI field office. Printed and stored offline — you will not have email during ransomware.
- Communication templates. Client notification letters, staff talking points, and vendor communication scripts. Written in calm times.
- State-law notification map. Every state where you have clients has its own breach law. Deadlines range from 30 to 90 days. Know which apply.
- Annual tabletop exercise. Sit down for 90 minutes once a year and walk through a hypothetical incident. Document the exercise.
The four traps that catch small firms
“My tax software is secure so I am covered.”
The Safeguards Rule is about your program, not your vendor. Vendor security is one of the nine required elements, not a substitute for the other eight.
Reusing personal email for client work.
Non-business email accounts do not offer the audit controls, retention policies, or DLP the rule expects. Every practice needs a business email tenant with named accounts.
No MFA on the portal.
This is the single most-cited weakness in accountant ransomware events. If your portal or tax platform can enforce MFA and you have not turned it on, that is the first thing to fix this week.
Verbal “we’re careful” instead of a WISP.
The IRS explicitly asks whether you have a WISP when you renew your PTIN. Answering “no” is a red flag. Answering “yes” without one is worse.
Run it yourself in an afternoon
- Name your Qualified Individual and Data Security Coordinator in writing. This is the first document.
- Do a data inventory. Where does client information live? Every tool, every device, every cabinet.
- Turn on MFA everywhere it is available. Do this today. It is free and it moves the needle more than any other single action.
- Draft the WISP using IRS Publication 5708 as your template. Sign and date it.
- Build the incident response contact card and print it. Put copies in the office and in the Qualified Individual’s bag.
- Schedule the annual report to management and the annual training refresh on the calendar for next year — so the program actually recurs.
If you would rather not build the paperwork by hand
VylintShield generates the written documents §314.4 calls for from a short questionnaire about your firm: the risk assessment, the incident response plan, and the access-control, data-handling, and staff-security-awareness policies that make up the body of a WISP — written against 16 CFR Part 314, not a generic template. You assemble them into your written program, and they are yours to keep.
But the checklist above is the whole game. If you complete it in-house, you are in vastly better shape than most small firms — that is the point of publishing it.
Need the Safeguards Rule paperwork fast?
VylintShield produces the risk assessment, incident response plan, and staff-security-awareness and data-handling policies the FTC and IRS ask for — written against 16 CFR Part 314 for your firm.
Generate your Safeguards documents →A guided questionnaire, not a template pack. Select FTC Safeguards as your framework and the documents are written for your firm.
Paid plans start at $588/year, billed once — there is no monthly plan. See full pricing and what each tier includes.
Different practice type? See our HIPAA checklist for dental & small medical practices or our WISP + ABA cybersecurity checklist for law firms.