FTC Safeguards Rule for Tax Preparers: Plain-English Guide

Consider a firm that consists of one enrolled agent and one bookkeeper, sharing a rented office and a server that hums in the corner like an appliance that knows too much. The FTC Safeguards Rule requires this firm to designate a qualified individual to oversee its information security program, conduct risk assessments, monitor service providers, and test the effectiveness of its safeguards. The rule does not specify whether the qualified individual may be the same person who answers the phones in March.

The gap between what the rule demands and what a two-person firm can implement is where most compliance anxiety lives. The regulation speaks in the measured cadence of institutions with dedicated IT departments and compliance officers; the typical tax practice speaks in the cadence of a professional who would like to finish the extension season without a ransomware incident. Somewhere between those two registers sits the Written Information Security Program—the document the IRS asks about on the PTIN renewal, and the artifact most likely to be requested when something goes wrong.

The rule is not unreasonable in its expectations. It is unreasonable only in its assumption that every covered firm possesses the infrastructure to meet them unassisted. For the practitioner who has spent the afternoon resetting a client’s forgotten password, the requirement to maintain continuous monitoring of network activity does not read as a best practice. It reads as a reminder that the law was drafted by attorneys who have never met a tax preparer.

What the Safeguards Rule actually requires of you

The regulation, codified at 16 CFR Part 314, asks for nine things. Stripped of its regulatory phrasing, the list reads as follows.

Designate a qualified individual to run your information security program. In a sole proprietorship, this is you. The title is less important than the responsibility: someone must own the program, keep it current, and answer for it.

Conduct a written risk assessment. You must identify where client data lives, how it moves, and where it is vulnerable — then document those findings and revisit them as your practice changes. An assessment that lives only in your head does not satisfy the rule.

Implement access controls and encryption. Limit who can reach client data to those who need it, and encrypt sensitive information both in storage and in transit. For most small firms, this means strong passwords, multi-factor authentication, and full-disk encryption — all of which you likely already have, but which the rule expects you to commit to writing.

Monitor your service providers. Your cloud storage, your practice-management software, your payroll processor — if a vendor touches client data, you are expected to have evaluated their security and to have that evaluation on record.

Train your staff. Anyone with access to client data must understand how to protect it. This includes recognizing phishing, handling data securely, and knowing what to do when something goes wrong.

Maintain the written program itself. The WISP is where all of these commitments live — the designated individual, the risk assessment, the controls, the vendor oversight, the training plan. It is the document a regulator would ask to see, and the IRS asks whether you have one when you renew your PTIN.

The rule does not require perfection. It requires a documented, good-faith program that matches the size and complexity of your firm. A two-person practice is not expected to operate like a bank. It is expected to have thought about the risks and written down what it is doing about them.

The risk assessment you can do without a consultant

The Rule requires a written risk assessment, which sounds like something involving binders. For a small firm, it need not be. Consider a firm that receives client documents through a portal, by email, on thumb drives, and occasionally as paper shoved under the door during tax season. That list, written down, is the beginning of the assessment.

Start with entry points. Where does client data arrive? Note each channel: your portal, email, physical mail, walk-ins, the thumb drive a client hands you with a smile and a shrug. Then identify who touches it. In a two-person firm, this is a short list, but it still includes you, your colleague, and anyone else who might see a file — a contractor, a cleaning crew, a spouse who borrows the laptop.

Next, trace where data rests and how it moves. Does it sit on a local server, in the cloud, on a laptop that travels? Does it pass through email attachments, a client portal, a shared drive? Write down each location and each path. A spreadsheet with three columns — entry, storage, movement — suffices. IRS Publication 4557 offers a framework for this exercise, and templates from Tech 4 Accountants or Rush Tech Support can provide structure if you prefer not to start from a blank page.

The point is not to produce a document that impresses an auditor with its thoroughness. The point is to see your own operation clearly enough to know where the risks are. A firm that has mapped its data flows can make reasonable decisions about protecting them. A firm that has not is guessing.

The Rule asks for reasonableness, not perfection. An afternoon with a spreadsheet, honestly filled out, is a defensible start. The assessment should be revisited when something changes — new software, a new employee, a new way clients send you files — but it does not need to be a recurring ordeal. It needs to exist, and it needs to reflect reality.

What a WISP is, and what it is not

A Written Information Security Program is, at bottom, a document. It records three things: the policies your firm has adopted to protect client information, the risks you have identified in the course of your work, and the controls you have put in place to address those risks. The FTC Safeguards Rule requires it to be written, and it requires you to maintain it. That second verb does more work than the first.

What a WISP is not: software. Purchasing a tool does not produce a program, and the Rule does not ask what you have bought. It asks what you have written down, what you have assessed, and what you are actually doing. Nor is it insurance. A policy document does not transfer risk; it documents how you intend to manage it. And it is not a binder you assemble once, place on a shelf, and produce in the event of an inquiry. A WISP that describes a practice your firm no longer follows is a liability wearing the costume of a safeguard. If your document says you encrypt laptops and you do not, the document itself becomes evidence against you.

The Rule expects the program to track your operations as they are, not as they were when you first drafted it. New software, a new employee, a new way of receiving documents — each of these changes your risk picture, and your WISP should reflect that. An outdated WISP is arguably worse than none at all, because it demonstrates you knew the right questions and stopped asking them.

Firms obtain this document in several ways. Some adapt the templates the IRS publishes in Publications 4557 and 5708, or use materials from professional associations such as NATP or AICPA. Some hire an MSP to draft one. Others purchase a maintained program from a specialist provider — Tech 4 Accountants and Rush Tech Support, among others, offer templates in this space. The format matters less than the fit: the document has to describe your firm, not a generic one.

The honest limits of a template

A template — ours, Tech 4 Accountants’, the IRS 4557 materials, one drafted by your MSP — solves a specific problem: producing a written program that satisfies the documentation requirement. What it does not do is anything else.

The rule asks you to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage of each, and evaluate the sufficiency of your existing safeguards. That is a judgment call about your systems, your clients, and your tolerance for inconvenience. No template can make it for you. It can list the categories of risk; it cannot tell you whether your office manager’s personal laptop, which accesses the firm portal on weekends, is a vulnerability you have accepted or one you have simply failed to consider.

Consider a firm that has adopted a practice-management platform, a document portal, and three separate bank-feed integrations, none of which the partners could explain under mild questioning. A template will give them a sensible password policy and a place to record their multifactor authentication decision. It will not tell them which MFA method suits their workflow, whether their vendors’ security practices meet the rule’s due-diligence standard, or why the bookkeeper’s credentials appear in a shared spreadsheet labeled “IMPORTANT.”

This is the honest arithmetic: the document is necessary and not sufficient. If you handle modest volume, understand your systems, and can follow written instructions, a well-constructed template is likely enough. If your practice is large, your stack is opaque, or your data practices have accreted over years without examination, you may need a security professional to perform the assessment the rule contemplates. That costs money. So does a data breach, rather more of it.

The rule does not demand perfection. It demands a program, implemented and maintained. A template gets you the program. The implementation remains, as it has always been, your department.

What EEZY WISP provides

EEZY WISP is a written information security program — the document itself, written and maintained, that the FTC Safeguards Rule requires a tax preparer to keep and that the IRS asks about at PTIN renewal. It is not software that scans your network, not a monitoring service, and not a consultant who visits your office. It is the policy document, drafted to satisfy the rule’s requirements, kept current as those requirements evolve, and available when you need to demonstrate that the document exists.

The distinction matters because much of the market addresses a different problem. Tech 4 Accountants and Rush Tech Support sell WISP templates, which provide the raw material but leave the drafting, updating, and tailoring to you. IRS Publications 4557 and 5708 offer government-issued frameworks, as do the NATP and AICPA templates — all legitimate starting points, all requiring you to turn a general outline into a working program. An MSP will sometimes write a policy as part of a broader engagement, though the quality and ongoing maintenance vary considerably. EEZY WISP occupies the narrower ground of delivering the finished, maintained document itself.

The service is hosted on Microsoft Azure. Pricing is on the site.

Whether a maintained document is what your firm needs depends on what you already have. If you have nothing, the requirement is not satisfied by good intentions. If you have a template you have not looked at since you downloaded it, you may have a document in name only. EEZY WISP addresses the specific, unglamorous task of keeping a compliant written program in place — a task that is easy to defer and difficult to reconstruct after the fact.

Getting the program into your practice

A Written Information Security Program arrives as a document, but it only becomes a program when it collides with the way your firm actually operates. That collision is best staged deliberately, over the course of a week, rather than left to happen on its own.

Start by reading the document against your data flows, not the ones the template assumes. Consider a firm that receives client documents through a secure portal, stores working papers in the cloud, and exchanges the occasional spreadsheet by email. Each of those channels needs to be accounted for in the program, and any that do not apply to your practice should be noted as such. The FTC expects the document to reflect your reality, not a generic ideal.

Next, adjust the named roles and procedures. If the program designates a Chief Information Security Officer and you are a two-person operation, the responsible party is whoever actually makes decisions about software, passwords, and vendor access. Name that person. If your firm has no IT department, the procedure for responding to a suspected breach needs to say who calls whom, not refer to an internal security team that does not exist.

Then distribute the finished document to everyone who touches client data, including seasonal staff and any bookkeeper or contractor with system access. Acknowledgment of receipt, even by email, creates a record that the FTC would find persuasive.

Finally, set a calendar reminder to revisit the program when your tools or staff change. A new practice management platform, a new employee, a new e-signature vendor — each of these triggers a review. The program is a living document, not a one-time purchase.

If questions arise during implementation, support is available Monday through Friday, 9 AM to 8 PM, and weekends 9 AM to noon Eastern, at eezycloud.com/support.

Alternatives and how EEZY WISP fits your stack

You have options, and it is worth surveying them before committing. The IRS offers Publications 4557 and 5708, free frameworks that outline what a security program should address. They are useful starting points, though they leave you to do the drafting. NATP and AICPA provide templates to their members, which are more tailored to tax practice but still require you to fill in the particulars of your own operation. Tech 4 Accountants and Rush Tech Support sell commercial WISP products, as do many MSPs who will draft a policy as part of their engagement. Each approach has its adherents, and none of them is wrong.

The question is not whether these alternatives exist but how much of your own time you are willing to spend assembling something the FTC will find adequate. A template from a professional association is a reasonable foundation if you have the patience to adapt it. An MSP-drafted policy may serve if your provider understands the Safeguards Rule specifically, not just IT generally. The free IRS publications will not write your program for you, but they will tell you what the agency expects to see.

EEZY WISP occupies a different position. It is a maintained, written program designed for the compliance requirement itself, not a byproduct of another service. If you use other EEZY products, they share a single login and a central bill at eezycloud.com/account/, though each is also sold independently. Support runs Monday through Friday, 9 AM to 8 PM, and weekends 9 AM to noon, Eastern time. Pricing is on the site.