Tax and accounting firms
FTC Safeguards Rule Compliance for Tax and Accounting Firms
Tax preparers and accounting firms are covered by the FTC Safeguards Rule. We handle the technical side of FTC Safeguards Rule compliance: MFA, encryption, access control, monitoring, and the records that show it is in place.
You keep responsibility for the program. We make the IT controls real and documented.
- Serving Los Angeles
- Business IT since 1998
- Remote first, on-site when needed
The rule
What FTC Safeguards Rule compliance asks of a firm
The Safeguards Rule requires covered financial institutions, which includes tax preparers, to keep a written information security program, often called a WISP. The program must name a qualified individual, assess risks, put safeguards in place, test them, train staff, and plan for incidents.
The IRS also expects preparers to protect taxpayer data and to have a written security plan as part of their preparer obligations.
Technical safeguards we set up
- Multi-factor authentication for everyone who accesses client data
- Encryption of client data at rest and in transit
- Access limited to the people who need it
- Logging and monitoring of user activity
- Secure disposal of old devices and files
- Change management for systems that hold client data
This is technical IT guidance, not legal advice.
9 IT steps toward FTC Safeguards Rule compliance
These are the technical building blocks most firms need. Your qualified individual decides how they fit the program.
1. Inventory
List the systems, devices, and cloud services that hold client data.
2. Risk assessment
Write down what could go wrong and how likely it is.
3. MFA everywhere
Email, tax software, portals, and remote access.
4. Encryption
Laptops, backups, email, and file sharing.
5. Access control
Each person sees only what their job requires.
6. Monitoring
Logs and alerts for unusual sign-ins and changes.
7. Backups
Encrypted, tested, and kept separate from the network.
8. Staff training
Phishing awareness and safe handling of client files.
9. Incident plan
Who to call, what to unplug, and what to report.
How we help a firm get there
- Gap reviewWe compare your current IT to the technical requirements.
- Fixes before tax seasonMFA, encryption, and backups first, because they matter most.
- DocumentationNotes on each control that your WISP can reference.
FTC Safeguards Rule compliance in a busy tax office
Most firms we see already have some of the pieces: an antivirus product, a backup, maybe MFA on email. The gaps are usually in the details. The tax software has no MFA, an old employee account is still active, backups have never been restored, or client files sit in a shared folder anyone can open.
Official guidance to start with
The FTC’s plain-language guide, FTC Safeguards Rule: What Your Business Needs to Know, lists the required elements. The IRS adds preparer guidance in Publication 4557, Safeguarding Taxpayer Data. We use both when we review a firm.
Reporting a security event
Covered firms must notify the FTC of certain security events that involve unencrypted customer information. Good encryption and logging make it easier to know what happened and what was exposed. Our part is the technical evidence; the reporting decision belongs to the firm and its advisors.
Built for tax season
We schedule larger changes before January and keep the busy months quiet. Read more about IT support for accounting firms and IT for financial firms.
FTC Safeguards Rule compliance FAQ
Does the Safeguards Rule apply to small tax offices?
Tax preparers are covered. Some requirements are relaxed for firms with fewer than 5,000 customer records, but the core safeguards still apply. Confirm your status with your advisor.
Can you write our WISP?
We supply the technical sections and the evidence behind them. The firm owns the program and its policies.
Is MFA really required?
Yes. The rule calls for multi-factor authentication for anyone accessing customer information, with limited exceptions.
Is this legal advice?
No. We handle the IT controls. Ask your attorney or compliance advisor what the rule requires of your firm.
Related pages
IT support for accounting firms
Tax-season uptime and secure client files.
Cybersecurity
MFA, encryption, and email protection.
Backup and disaster recovery
Encrypted backups and tested restores.
Cyber insurance requirements
Controls insurers ask about.
Get your firm’s safeguards in order before tax season
A review of the technical controls behind your written security plan.
On-site and remote IT since 1998.