FTC Safeguards Rule Checklist for Tax and Accounting Firms

Updated 10/14/2026. Sources at the end.

The FTC Safeguards Rule, 16 CFR Part 314, sets what a firm’s information security program must include. Section 314.4 lists the elements below; IRS Publication 5708 applies them to tax and accounting firms. Each line restates the rule’s paragraph; the rule’s own text governs.

Section 314.4	Requirement	In writing
(a)	Name a Qualified Individual to oversee, run and enforce the program. The person may work for you, an affiliate or a service provider; if you use a service provider or affiliate, you keep responsibility for compliance and name a senior member of your staff to direct and oversee that person.
(b)	Base the program on a risk assessment of the reasonably foreseeable internal and external risks to client information, and of how well your current safeguards control them. Repeat the assessment periodically.	The risk assessment must be written.
(c)(1)	Control access: let only authorized users in, and limit each user to the client information their work needs. Review the controls periodically.
(c)(2)	Identify and manage the data, people, devices, systems and facilities the business relies on, according to their importance.
(c)(3)	Encrypt client information in transit over external networks and at rest. Where encryption is not feasible, use compensating controls your Qualified Individual has reviewed and approved.
(c)(4)	Use secure development practices for applications you build, and evaluate or test the security of outside applications you use for client information.
(c)(5)	Require multi-factor authentication for anyone who reaches any information system, unless your Qualified Individual approves an equivalent or stronger control in writing.	An exception must be approved in writing.
(c)(6)	Dispose of client information securely no later than two years after you last used it to serve that client, unless the business or the law needs it kept, and review your retention policy periodically.
(c)(7)	Adopt change management procedures.
(c)(8)	Monitor and log what authorized users do, and detect unauthorized access, use or tampering.
(d)	Test or monitor the safeguards regularly. For information systems, use continuous monitoring; without it, run a penetration test every year and vulnerability assessments at least every six months, and whenever operations change materially.
(e)	Train your staff in security awareness, update the training as risks change, and use qualified security personnel, in-house or through a provider.
(f)	Choose service providers that can protect the information, require the safeguards in their contracts, and assess them periodically.
(g)	Evaluate and adjust the program after testing and monitoring, after material changes to your operations, after each risk assessment, and whenever anything else may affect it.
(h)	Keep an incident response plan to respond to and recover from a security event that materially affects client information.	The plan must be written.
(i)	Have the Qualified Individual report on the program, regularly and at least once a year, to your board or equivalent body, or to the senior officer responsible if there is no board.	The report must be in writing.
(j)	Notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event that involves the information of at least 500 consumers, using the form on the FTC's website.

The small-firm exception

Section 314.6 says that sections 314.4(b)(1), (d)(2), (h) and (i) do not apply to a firm that keeps information on fewer than 5,000 consumers: the written risk assessment, the penetration testing and vulnerability assessments, the written incident response plan and the annual written report. Every other element applies to every firm, including the notice to the FTC.

Write the plan with the WISP template, and see what the rule requires each year.

Frequently asked questions

Do small tax practices have to follow every element?

No. Section 314.6 exempts firms with information on fewer than 5,000 consumers from 314.4(b)(1), (d)(2), (h) and (i). The other elements, including the notice to the FTC, apply to every firm.

When must a firm notify the FTC?

As soon as possible, and no later than 30 days after discovering a notification event that involves the information of at least 500 consumers, using the form on the FTC's website.