FTC Safeguards Rule Help for CPAs and Tax Preparers

If you prepare returns for pay, the IRS says the FTC Safeguards Rule applies to you, whatever the size of your shop. That means a written information security plan, often called a WISP, kept up to date.

The Complete Kit below has a WISP template, a Qualified Individual designation form and IRS references for tax preparers, all as editable Word files.

Call 469-248-5463 DIY Kit

Does the FTC Safeguards Rule apply to your tax practice?

It covers financial institutions under the Gramm Leach Bliley Act. The IRS says tax and accounting professionals count, regardless of size. That includes solo preparers, enrolled agents, bookkeepers and CPA firms that handle client financial data.

Check the rule itself and the IRS publications with your advisor. I am an IT security consultant, not an attorney, so I cannot give legal advice. What I can do is help you get the security side written down.

What a written security plan covers

  • A named Qualified Individual who runs the program. In a small shop that can be you.
  • A risk assessment of where client data lives and what could go wrong.
  • Access controls, so staff only see what they need.
  • MFA on systems that hold client data.
  • Encryption of client data, in storage and when it moves.
  • Staff security training.
  • Oversight of vendors who touch client data, such as software and cloud providers.
  • An incident response plan, so you know who to call and what to do.

The plan can be smaller for a small shop. It still has to be real, written down and followed.

What the Complete Kit gives a tax practice

The Complete Kit is $199. For tax preparers it includes:

  • F01 Written Information Security Plan template.
  • F02 Qualified Individual Designation Form.
  • F03 IRS References for Tax Preparers.
  • Ten security policies and four checklists, plus the cyber insurance readiness pack.
  • H01 and H02 HIPAA worksheets, if your practice also handles health information.

These are templates. You fill them in for your office, have your attorney or advisor review them, and then follow them. A template does not make you compliant on its own. It gets your plan on paper in plain English.

Want a second set of eyes?

I review settings, devices and Microsoft 365 setups remotely. If your insurer asks about your security controls, the Cyber Insurance Readiness Check is a fixed price by seat count. Ask for a quote at lonestarcomputersecurity.com. For broader work, see the pricing on the home page.

Related: small business cybersecurity checklist, Microsoft 365 security setup and ransomware protection.

Watch the 30 second overview

Two ways to get ready: do it yourself with the kit, or have me check your setup.

FAQ

Frequently asked questions

Do tax preparers need a WISP?

The IRS says tax and accounting professionals must have a written information security plan. The rule behind it is the FTC Safeguards Rule. Check your own situation with your advisor.

Does the FTC Safeguards Rule apply to a solo preparer?

The IRS says it applies regardless of size. The plan can be simpler for a one person shop, but it still needs to be written down and followed.

What is a Qualified Individual?

It is the person you name to run your security program. In a small practice that is often the owner. The Complete Kit has a designation form for it.

Will the kit make my practice compliant?

No. No template can do that alone. The kit gets your plan on paper. You still need to fill it in, have it reviewed and do what it says. It is templates only and not legal advice.

Which kit tier do I need for the WISP template?

The WISP template, Qualified Individual form and IRS references are in the Complete Kit at $199. The Starter at $49 and Professional at $99 do not include them.

DIY Security Kit

Start Today With a Security Readiness Kit

Prefer to work at your own pace? Our editable Word templates put your policies and checklists on paper in plain English. Every tier includes an explainer video.

Starter Kit

$49

Ten ready to customize security policies and four checklists, as editable Word templates in plain English.

Buy the Starter Kit
Best Value

Professional Kit

$99

Everything in Starter, plus a cyber insurance readiness checklist pack and a 30 day implementation guide.

Buy the Professional Kit

Complete Kit

$199

The full kit, plus HIPAA and WISP template add on packs and IRS references for tax preparers.

Buy the Complete Kit

See every document in each tier in the full Security Kit details.

Templates only, not legal advice. Digital download. All sales are final, no refunds.

Talk to Scott

Call 469-248-5463. Remote service for DFW, Texas and anywhere in the US. Scott has 28 years in IT and holds CompTIA Security+ CE.