What the FTC Safeguards Rule Requires of Tax Preparers

If you prepare tax returns for a fee, the Gramm-Leach-Bliley Act’s Safeguards Rule almost certainly applies to you, along with many accountants, mortgage brokers, and other non-bank financial businesses. The IRS also expects tax professionals to maintain a Written Information Security Plan, and its Publication 4557 is a useful companion to the FTC’s requirements.

Designate a Qualified Individual

Someone must oversee and enforce your security program. That person can be an employee or a service provider, but you remain responsible, and you must oversee any provider you use.

Write a Risk Assessment

Identify the threats and vulnerabilities to customer information, evaluate them, and describe how you will address each. Firms with customer information on fewer than 5,000 consumers are exempt from the written assessment requirement, but the core safeguards below still apply.

Implement the Safeguards

• Access controls that limit who can see customer information.
• A data inventory so you know what you hold and where.
• Encryption of customer information in transit and at rest.
• Multi-factor authentication for anyone accessing your information systems.
• Secure disposal of customer information when you no longer need it, generally within two years after you last used it to serve the customer, unless a legitimate reason or law requires keeping it.
• Change management and activity logging for authorized users.

Test and Monitor

The rule calls for continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months. For most small firms, scheduled scanning and an annual independent test is the practical route.

Train Your Staff

Everyone who handles customer information should receive security awareness training, updated for current threats such as phishing and fraudulent client emails.

Oversee Your Service Providers

Choose providers that can maintain appropriate safeguards, require them by contract, and periodically check that they do. Your software vendors, payroll provider, and IT company all count.

Have a Written Incident Response Plan

Larger firms need a written plan covering goals, internal roles, communications, remediation, and post-incident review. Smaller firms under the 5,000-consumer threshold are exempt from the written plan, but being prepared is still wise.

Know the FTC Notification Requirement

Since 2024, covered firms must notify the FTC when unencrypted customer information of 500 or more consumers is acquired without authorization, generally within 30 days of discovery. Another reason to encrypt.

If you want a partner to build and run these safeguards, see our finance services or get in touch.