Employee Security Training Requirements Under the FTC Safeguards Rule

Consider a firm that has done everything right on paper. It adopted a written information security program, encrypted its laptops, turned on multifactor authentication, and can produce the document on request. That same firm, however, has not run a security training session in two years, and the newest hire learned the firm’s procedures by watching the person at the next desk. Under the FTC Safeguards Rule, that gap is not a technicality. The rule requires qualified individuals to verify that all personnel receive security awareness training, updated as risks change, and that everyone with access to client data is trained on the program’s policies and procedures. A binder on a shelf does not satisfy that obligation. People do.

This is the one requirement that cannot be delegated to a document, and it is where most small firms quietly fall short. The training duty appears in the rule itself, not as a suggestion, and the IRS has folded it into its own expectations for tax professionals. A Written Information Security Program that names training but never delivers it is a program that exists on paper and nowhere else.

The training obligation hiding inside the Safeguards Rule

Every requirement in the Safeguards Rule can, in some fashion, be satisfied by a document. You can write your risk assessment into a file, your incident response plan into a binder, your access controls into a policy. The one thing you cannot write your way out of is § 314.4(c), which obligates you to provide your employees with security awareness training that addresses the risks you have identified and to keep that training current as those risks change. The Rule assumes a living practice, not a shelf.

The structure of the obligation matters. The Rule first requires a qualified individual to oversee your information security program—someone with the authority and competence to run it, whether that person is an employee, a contractor, or a fractional hire. That individual is responsible for the written program and, critically, for training the staff. The WISP document and the training program are separate deliverables. Possessing one does not discharge the other.

Here is where most small firms quietly fall short. They have a WISP—often a template from Tech 4 Accountants, Rush Tech Support, NATP, AICPA, or the IRS’s own Publication 4557 and 5708 frameworks—and they believe the work is done. But a template, however well drafted, contains no record that anyone has ever been taught to recognize a phishing email, to verify a wire request by phone, or to handle a client file with appropriate care. The IRS PTIN renewal asks whether your firm maintains a WISP. Answering yes when your only evidence is a PDF is technically accurate and practically thin. An examiner who asks for your training log will not be impressed by your table of contents.

Documented, recurring training is the difference between a program that exists and a program that functions. It need not be elaborate. It must be real, repeated, and provable.

What ‘good enough’ training looks like for a small firm

The Safeguards Rule does not prescribe a format, a vendor, or a curriculum. That flexibility is a gift to small firms, and also the reason so many do nothing: without a specification, the task feels undefined. It need not be. A defensible program for a ten-person firm is modest, repeatable, and documented.

The core components are few. A session once or twice a year, in person or by video, covering the threats your staff actually faces: phishing and business email compromise, password hygiene, secure handling of client documents, and what to do when something looks wrong. Onboarding training for every new hire, before they touch client data. Periodic phishing simulation, so the lesson is tested rather than merely heard. A written acknowledgment, signed and dated, confirming each employee completed the training. And a log recording who completed what, and when.

That log is the part firms most often skip, and it is the part an examiner will ask for first. Training that happened but was not recorded is, from a compliance standpoint, training that may as well not have. A shared spreadsheet with names, dates, and topics is sufficient. The record does not need to be elegant; it needs to exist.

Firms that want outside help have reasonable options. The IRS publishes free security-awareness material in Publication 4557, and NATP and AICPA member resources include training content. Managed service providers frequently bundle security training for their clients. A firm can also run the entire program in-house with a checklist, a log, and an hour of preparation. The Rule permits any of these.

Honesty requires a caveat: training does not prevent every breach. Determined attackers deceive trained people, and honest employees make mistakes. What training does is reduce the frequency of those mistakes and, just as importantly, demonstrate to regulators and to clients that the firm took its obligations seriously. Good faith, documented, is not a consolation prize. In a compliance review, it is often the whole game.

How EEZY WISP addresses training

EEZY WISP is the written security program document your firm is required to keep: a WISP written and maintained to satisfy the FTC Safeguards Rule and the IRS PTIN renewal question. That document is the foundation. It defines the policies your training must reinforce — acceptable use, access controls, incident response, vendor management — and gives your employees a single, coherent reference rather than a scatter of memos and good intentions.

What the document cannot do is stand at the front of the room. The Safeguards Rule treats employee training as an ongoing obligation, not a one-time event, and that cadence belongs to the firm. EEZY WISP does not include a training module, a learning management system, or a quiz feature. If you encounter a WISP product that claims to check the training box for you entirely, be skeptical; the rule expects your people to be trained, and someone at your firm has to own that calendar and keep the records.

In practice, that means pairing your EEZY WISP document with a recurring schedule — onboarding for new hires, annual refreshers for everyone, and targeted sessions when something changes, such as a new practice-management system or a revised IRS publication. IRS Publication 4557 remains a useful, free companion for structuring those sessions, and templates from Tech 4 Accountants, Rush Tech Support, NATP, or the AICPA face the same constraint: they supply the policy, not the classroom.

The EEZY WISP document gives your training a spine. It is where your policies live, where updates are reflected, and where an inspector can see that your program is written down rather than improvised. The teaching itself, and the records that prove it happened, remain your firm’s responsibility — as the rule intends.

What it costs

Pricing for EEZY WISP is published at eezywisp.com, and there is little point in repeating it here. The more useful question is what the alternative costs, because there is always an alternative.

A firm can assemble its own program from IRS Publication 4557 and the 5708 templates, or from the template libraries offered by NATP and AICPA. Tech 4 Accountants and Rush Tech Support sell WISP templates as well. None of these options carries a product price, but none of them is free. The cost is staff time: someone must read the source material, adapt it to the firm’s actual systems, write the policy, and then keep it current as the FTC’s expectations, the firm’s software, and its staff change. The Safeguards Rule requires the program to be maintained, not merely written once and filed away. A template that sits untouched for two years is a document, not a program, and an examiner will notice the difference.

Training adds another layer. A written policy does not train anyone. Someone has to build the training content, deliver it to new hires and returning staff, document that it happened, and repeat it on a schedule. In a three-person firm, that someone is usually the principal, and the hours come out of billable time.

EEZY WISP is priced on the site, and the EEZYVERSE arrangement means one login and one central bill at eezycloud.com/account if the firm uses other EEZY products. Support runs Monday through Friday, 9 AM to 8 PM, and weekends 9 AM to noon, Eastern, per eezycloud.com/support. Whether the subscription is cheaper than the hours depends on what the principal’s hours are worth, which is a calculation each firm can do without assistance.

Getting started and the first week

Consider a firm that has just purchased EEZY WISP: two partners, one administrative staff member, and a shared office where client files live on a single server. The document arrives, and the first task is reading it. Not skimming. Reading. The Safeguards Rule requires the firm to designate a qualified individual to oversee the program, and in a two-person firm, that person is likely one of the partners, already carrying a full client load.

The second task is the first training session. This is where the document meets the staff. The qualified individual walks through the WISP section by section: how client data is handled, what the acceptable-use policy requires, how to recognize a phishing attempt, what to do when something looks wrong. Attendance is logged, because the FTC expects firms to demonstrate that training occurred, not merely assert that it did. A sign-in sheet or a dated email confirmation suffices. The point is evidence.

The third task is scheduling. The Safeguards Rule does not specify a frequency, but semiannual refreshers are a defensible rhythm, and the calendar reminder should be set before the first session ends. Firms that intend to revisit training “when things slow down” are firms that never revisit it.

None of this requires an IT department. It requires a document, a designated owner, an hour with the staff, and a calendar entry. Firms that prefer to build their own program from IRS Publication 4557 or a template from NATP or AICPA face the same obligations; the document is only the beginning. If questions arise during setup, support is available Monday through Friday, 9 AM to 8 PM, and Saturday and Sunday, 9 AM to 12 PM Eastern, at eezycloud.com/support.

The first week is not the hard part. The hard part is the second session, and the third.

The honest alternatives

The IRS publishes Publication 4557, a readable overview of safeguarding taxpayer data, and its companion Publication 5708, which contains a WISP template a firm can adapt. Both are free, and both are competent. They explain what the Safeguards Rule expects and give a workable starting document. What they do not do is run a training session. A firm that builds its program from 4557 and 5708 still has to design the curriculum, deliver it, document attendance, and repeat it annually. The template is free; the hours are not.

The NATP and AICPA offer their own templates and guidance to members. These tend to be more tailored to tax practice than the IRS versions, and they come with the credibility of a professional association. The same caveat applies: the template does not train anyone. Someone in the firm owns that task, and if that person leaves, the program usually leaves with them.

Tech 4 Accountants and Rush Tech Support sell WISP templates aimed squarely at the tax and accounting market. These are closer to a finished document than the IRS versions, and they reflect the vocabulary of a working practice. They still require the firm to maintain the policy, update it as the rule evolves, and conduct the training itself.

An MSP-written policy is a different arrangement. A managed service provider will often draft the WISP as part of a broader engagement and may bundle employee training into the same contract. That is a genuine convenience. It also ties the firm’s compliance to a single vendor. If the relationship ends, the policy and the training infrastructure often end with it, and the firm discovers it owns less than it assumed.

None of these options is wrong. Each asks the firm to carry something it may not have the time or staff to carry.

Where training fits in the rest of the stack

A Written Information Security Program is the spine of your compliance obligations, but it is only one component. The Safeguards Rule expects a functioning security apparatus: multifactor authentication on every system that touches client data, encrypted storage for files at rest and in transit, access controls that limit staff to what their role requires, and a written incident-response plan that tells you what to do when something goes wrong. Training is the connective tissue among these elements. MFA fails when an employee approves an authentication request they did not initiate. Encryption fails when someone downloads client files to an unencrypted laptop to work from home. Access controls fail when a departing staff member retains credentials because nobody thought to revoke them.

The other components are largely set-and-verify. You implement MFA, you confirm it works, you revisit it periodically. Training is the one requirement that decays. A written policy does not forget itself; a person does. This is why the Rule treats training as ongoing rather than a single onboarding event.

For firms assembling their compliance stack, the pieces can come from several places. The WISP itself might be drawn from IRS Publication 4557, an AICPA or NATP template, a policy written by an MSP, or a purpose-built document from a provider. EEZY WISP supplies the written program; it belongs to the EEZYVERSE family, where one login covers the EEZY products a firm uses and one central bill sits at eezycloud.com/account, though each product is also sold on its own site. Whatever the source of the document, the training obligation remains yours. No template can sit with your receptionist and explain why the email she just received is a credential-harvesting attempt.

The Safeguards Rule asks for a program, not a binder. A program is only as good as the last time someone actually ran the training.