If you prepare tax returns or do bookkeeping for other people, the FTC Safeguards Rule applies to you. Not "might apply." It applies, whether you are a 40-person CPA firm in Hartford or a one-person tax office working out of a spare bedroom in Cromwell. The rule says you need a written information security plan, a named person responsible for it, and a specific list of protections in place. The IRS now asks about that plan every time you renew your PTIN.

This post covers who is covered, what the plan has to contain, and what the protections look like in a small office. I set these protections up for Connecticut small offices, so the examples are the ones I actually run into.

One line up front: this is general information from an IT person, not legal advice. For questions about your specific obligations, talk to a lawyer who handles privacy and data security.

Who the rule covers

The Safeguards Rule comes from the Gramm-Leach-Bliley Act. It treats a lot of businesses as "financial institutions" that would never describe themselves that way. The FTC's own plain-language guide lists tax preparation firms, mortgage brokers, and similar businesses as examples, and the test is what you do, not what you call yourself.

Tax preparers are squarely inside it. Bookkeepers and payroll services generally are too, because you hold Social Security numbers, bank account numbers, and financial records for other people. The IRS has been blunt about this for years: in an August 2026 reminder, the Security Summit said federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan, and the PTIN renewal form (Form W-12) includes a line where you acknowledge that requirement.

So the question is not whether you need one. It is whether yours would hold up if someone asked to see it.

What a WISP actually is

A WISP, a Written Information Security Plan, is a document that describes how your office protects client information. It is not a certificate and nobody issues one. You write it, you keep it current, and you follow it.

The IRS publishes a free template, Publication 5708, written for small practices. It is the right starting point. Pair it with Publication 4557, Safeguarding Taxpayer Data, which is the IRS guide to the practical side.

A plan that fits a small office is usually 10 to 15 pages: who is responsible, what systems hold client data, what the protections are, and what happens when something goes wrong. A 60-page plan downloaded from the internet with your name pasted in is worse than a short one you can describe, because the rule expects you to follow what you wrote.

What the rule requires, element by element

The requirements are in 16 CFR Part 314, section 314.4. Each piece in plain English, as it looks in an office of one to ten people:

A Qualified Individual

Someone has to own the program. The FTC says this person needs no particular degree or title and can be an outside provider, but if you outsource it, someone senior in your firm still supervises and the responsibility stays with you. In a solo practice, that is you. Put your name in the plan.

A written risk assessment

You write down where client data is stored, what could go wrong, and how likely and how bad each problem would be. Laptop stolen from a car. Email account taken over. Ransomware on the office PC. Old client files in a storage unit. The assessment drives everything else, so it should be honest, not flattering.

Firms with information on fewer than 5,000 consumers are exempt from the written risk assessment under section 314.6, along with a few other paperwork items. You still have to base the program on a risk assessment. The exemption changes the paperwork, not the thinking, and the IRS template includes one anyway.

The specific safeguards

This is the part that becomes IT work. Section 314.4(c) lists them:

Access controls. Each person has their own login and can only reach the client files they need. Shared logins are the first thing I remove in a tax office.

An inventory. Every computer, phone, external drive, and cloud service that touches client data, in a list.

Encryption, in transit and at rest. The rule's wording is to "protect by encryption all customer information held or transmitted by you." In practice: BitLocker turned on and verified on every Windows laptop and desktop, FileVault on Macs, encrypted email or a secure portal for sending returns, and no client data on an unencrypted thumb drive, ever. If encryption is not feasible somewhere, the Qualified Individual has to approve an alternative in writing.

Multi-factor authentication. The rule says to "implement multi-factor authentication for any individual accessing any information system." That means your email, your tax software, your cloud storage, and your remote access, not just one of them. If you can sign in with only a password from a new phone, this box is not checked. I covered how to test that in the small business security checklist.

Secure disposal. Client information is disposed of securely no later than two years after you last used it for the service, unless you have a legal or business reason to keep it. That covers paper and old hard drives. A drive that went to the dump inside the old computer is a disposal failure.

Change management. When you add a system or switch software, the plan gets updated.

Monitoring user activity. Some way to detect unauthorized access or use. In a small office the tools do this: managed antivirus with logging, Microsoft 365 audit logs, and someone who looks at alerts.

Testing and monitoring

You either continuously monitor your systems or you do annual penetration testing and vulnerability assessments every six months. Small firms under the 5,000-consumer threshold are exempt from that specific schedule, but not from the general duty to test and monitor. Monitored endpoint protection and patch management on every machine is how most small offices meet this in practice.

Staff training

Everyone who touches client data gets security awareness training, and it gets refreshed. For a two-person office this can be a short written session each year, documented with a date and signatures. Drill phishing; a tax office inbox in February is a target.

Service provider oversight

Your tax software vendor, your cloud storage, your IT provider, your payroll service: you choose ones that can protect the data, require it in the agreement, and check on them periodically. Keep the list in the plan.

A written incident response plan

What you do when something happens: who you call, how you contain it, how you notify clients, and what you fix afterward. Small firms are exempt from the written version under 314.6, but you want one anyway, because the IRS also expects you to report a client data theft to your IRS Stakeholder Liaison and to the state through the Federation of Tax Administrators. Our post on what to do in the first hour after a computer is hacked covers the technical side.

Reporting to the FTC

Since May 2024, a breach involving unencrypted information on 500 or more consumers has to be reported to the FTC as soon as possible and no later than 30 days after you discover it, through the FTC's online form. Notice the word "unencrypted." A stolen laptop with BitLocker on it and the key secured is a very different event from one without.

An annual report

The Qualified Individual reports in writing, at least yearly, on how the program is doing. Small firms are exempt, but a one-page annual review takes an hour and is worth it.

What this looks like in a real Connecticut office

Most tax and bookkeeping offices I walk into have some of this done and none of it written down. Common gaps:

Email on Microsoft 365 with MFA turned on for the owner but not the seasonal preparers.
BitLocker "on" but nobody has the recovery keys backed up anywhere.
Client PDFs sitting in a Downloads folder and in three different cloud accounts.
One shared login for the tax software.
A backup that runs to an external drive that sits plugged into the same computer.
Old computers in a closet with client data still on the drives.

None of those take a consultant. They take an afternoon of IT work and a plan that says what was done.

A Simsbury bookkeeping and tax office we took on this fall is a good picture of the order of operations. A real firewall first, then monitoring and endpoint protection on the four PCs, backups, and BitLocker on every machine. The owner wrote the WISP and collected signed acknowledgments from staff while we closed out MFA on email and the tax software, individual logins, and one logged backup restore test. None of it was exotic, but none of it was in place before.

The order I do it in

Build the inventory. Every device, every cloud account, every place client data sits.
Turn on MFA everywhere and remove shared logins.
Verify disk encryption on every machine and store the recovery keys somewhere safe.
Put managed endpoint protection and patching on every machine so monitoring is real.
Set up an off-site backup with version history and check its date.
Set a disposal process for paper and drives.
Fill in the IRS template with what is actually in place. Date it. Sign it.
Hold a short training session and record who attended.
Calendar an annual review.

That is compliance readiness: the protections are real, the plan describes them accurately, and you can show both. Nobody certifies a Safeguards Rule program, me included. What I can do is get the technical pieces in place and give you the documentation that matches.

The bottom line

The FTC Safeguards Rule applies to Connecticut tax preparers and bookkeepers now, the IRS asks about it at every PTIN renewal, and the requirements are specific: a named person, a risk assessment, MFA, encryption, disposal, monitoring, training, vendor oversight, and a written plan. For a small office the technical work is a few days, not a project, and the IRS template handles the writing.

If you want to know where your office stands before tax season, get your company's free IT health report. It is an on-site look and a written summary of where you stand, no software installed and no obligation. From there, managed IT covers the monitoring, protection, and backup pieces month to month with no retainer, and you can contact me with questions any time.

This article is general information from an IT provider, not legal or tax advice. The rule text is at 16 CFR Part 314; confirm your obligations with an attorney.

FTC Safeguards Rule for CT Tax Preparers & Bookkeepers