Accounting, Tax and Financial Firms: The FTC Safeguards Rule, IRS Requirements and the Written Security Plan

Rule versions described: 16 CFR Part 314 (FTC Standards for Safeguarding Customer Information) as amended by 86 FR 70272 (December 9, 2021), 87 FR 71509 (November 23, 2022) and 88 FR 77499 (November 13, 2023), eCFR text current as of October 23, 2026, read October 28, 2026; IRS Publication 4557 (Rev. 6-2024), Publication 5708 (Rev. 8-2024), Publication 5293 (5-2018), Publication 1345 (Rev. 12-2025) and Form W-12 (Rev. 10-2026); 26 U.S.C. 7216 and 6713 and 26 CFR 301.7216-2 and -3 as shown on the Cornell LII mirror October 28, 2026; AICPA Code of Professional Conduct updated through December 2023; IDAPA 24.30.01 (current Idaho Administrative Code); SEC Regulation S-P as amended by 89 FR 47688 (June 3, 2024); 32 CFR Part 170 (CMMC) and the DFARS rule at 90 FR 43560 (September 10, 2025). Rules change; check the regulator's current text before relying on any point.

Tax season puts a small accounting office in an odd spot. It holds more sensitive data per square foot than almost any business in town: Social Security numbers for every family member, bank account and routing numbers for refunds, wage statements, prior-year returns, copies of driver's licenses, sometimes medical expense records and divorce decrees. Yet many of these offices have three to ten people, no IT department and one shared password taped inside a desk drawer. Criminals know this. The IRS reported in July 2024 that it had received reports of "nearly 200 tax professional data incidents potentially affecting up to 180,000 clients" during the period it described.¹³

This lesson covers what federal law, the IRS and the profession expect of accounting, tax and financial firms, and goes deeper than the overview lessons on the specific rules a firm actually has to meet. If you need the basic map of financial privacy first (GLBA privacy notices, the opt-out, pretexting, the FCRA), read Money, Credit and Financial Data. For how the FTC enforces security in general, see The FTC and Federal Security Rules. For a small business manager's view of all the federal laws at once, see Federal Laws That Reach Your Business. This lesson assumes you have that background, or will get it there, and focuses on the tax and accounting office, the financial adviser and the professional services firm.

The law firm side of this module is in lesson 1, and client data handling, e-discovery, cloud and AI tools are in lesson 2. Firms that handle client money will also want lesson 3, and every firm needs lesson 5 on incident response and notice and lesson 6 on business email compromise.

Who the FTC Safeguards Rule covers

"Financial institution" is a broad term

The Gramm-Leach-Bliley Act of 1999 (GLBA) told the federal agencies that regulate financial institutions to set standards for protecting customer information. Banks and credit unions have their own regulators and their own versions of the standards. The Federal Trade Commission took everyone else: the "non-banking" financial institutions over which the FTC has jurisdiction. Its rule is 16 CFR Part 314, titled "Standards for Safeguarding Customer Information," usually called the Safeguards Rule. It applies to customer information in the institution's possession, including information about customers of other financial institutions that it receives.¹⁴

The phrase "financial institution" in the rule does not mean what most people picture. It means any business that is significantly engaged in an activity that is "financial in nature" under the Bank Holding Company Act. That list is long. The rule's definitions section, 16 CFR 314.2(h)(2), gives thirteen examples, among them a retailer that issues its own credit card, an auto dealer that leases cars for more than 90 days, a real estate or personal property appraiser, a check printer, a business that regularly wires money for consumers, a check casher, a real estate settlement service, a mortgage broker, and "An investment advisory company and a credit counseling service." Section 314.2(h)(3)(iv) excludes entities that engage in financial activities but are "not significantly engaged" in them, and the examples in 314.2(h)(4) include a merchant that lets a customer "run a tab," which is not a financial institution for that reason alone.¹

Tax preparers and accountants are named in the rule

For the tax and accounting profession there is no need to argue about coverage. The rule names it. Section 314.2(h)(2)(viii) gives this example of a financial institution:

"An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G)."¹

The same section's definition of a "customer relationship" includes a consumer who "Becomes your client for the purpose of obtaining tax preparation or credit counseling services from you" (314.2(e)(2)(i)(H)) and one who "Obtains financial, investment, or economic advisory services from you for a fee" (314.2(e)(2)(i)(G)).¹ So the individual who walks in with a shoebox of W-2s is a customer, and the household that pays a fee-only planner for advice is a customer too.

The IRS reads the rule the same way. Publication 5708, the IRS guide to writing a security plan, says: "Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size."² Publication 4557 states: "According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data."¹⁵

Who is in, and who may be out

Some practical boundaries help.

• Covered: a CPA firm that prepares individual returns; an enrolled agent's office; a seasonal storefront preparer; a bookkeeper who also prepares returns for individuals; an online tax preparation service; a fee-based financial planner or investment advisory firm within the FTC's jurisdiction. (Advisers registered with the SEC are under the SEC's own rule, Regulation S-P, covered below.)¹
• Customer versus consumer: the rule protects "customer information," which is nonpublic personal information about individuals who obtain a financial product or service for personal, family or household purposes. A firm that only does audits or bookkeeping for businesses may hold little information about consumers in that sense, though it will still hold employee payroll data and other personal information protected by state breach law and professional rules. Whether a particular business-only firm falls outside Part 314 is a judgment call about its own facts, and the safer course is to build the program anyway, because IRS and AICPA expectations reach the same controls.
• Law firms: the rule does not name law firms as a class. A law firm is covered only to the extent it is significantly engaged in a listed financial activity, such as preparing tax returns or providing real estate settlement services, which 314.2 lists as an example. Whether a given firm crosses that line is a legal judgment about that firm, not a rule statement.¹

The size of the firm does not change coverage. A one-person preparer is a financial institution. Size changes only which of the elements apply, through the 5,000-consumer exemption discussed below.

How the rule got here: 2002 to 2024

The Safeguards Rule is older than many of the firms it covers, but the version that applies today is recent. Knowing the history explains why so many small offices only learned about it after 2022.

The 2002 rule: flexible and short

The original rule was published at 67 FR 36484 on May 23, 2002 (the rule text itself is at 67 FR 36493).¹⁴ It required a written information security program, one or more employees to coordinate it, a risk assessment, safeguards designed to control the risks found, oversight of service providers and periodic adjustment. It did not say what the safeguards had to be. A firm could decide encryption or multi-factor authentication was unnecessary and still argue it met the rule.

The 2021 amendments: specific requirements

On December 9, 2021, the FTC published a final rule amending the Safeguards Rule at 86 FR 70272, effective January 10, 2022.¹⁶ The amendments turned the general program into a specific list. They added the Qualified Individual, required the risk assessment to be written, named eight specific safeguards including encryption and multi-factor authentication, required penetration testing and vulnerability scans, required a written incident response plan and an annual written report to the board or a senior officer, and created the exemption for small institutions. On the same day the FTC published a supplemental proposal to require breach reporting to the agency, at 86 FR 70062.¹⁷

The 2022 extension: six more months

The 2021 rule gave institutions until December 9, 2022 to meet the new elements. On November 15, 2022 the FTC announced a six-month extension, and the Federal Register document, 87 FR 71509, published November 23, 2022, moved the date to June 9, 2023.¹⁸¹⁹ The amended section 314.5 read: "Sections 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3), (h), and (i) are effective as of June 9, 2023." The FTC gave two reasons: a reported shortage of qualified security personnel, and supply chain delays for equipment, both made worse by the COVID-19 pandemic, which the agency said could make it hard for institutions, especially small ones, to meet the earlier date.¹⁸

The 2023 notification amendment

On October 27, 2023 the FTC announced that non-banking financial institutions would have to report data security breaches to it.¹⁹ The final rule was published at 88 FR 77499 on November 13, 2023 and took effect May 13, 2024. It added the definition of "notification event" at 314.2(m) and the reporting duty at 314.4(j). Today's section 314.5 reads only: "Section 314.4(j) is effective as of May 13, 2024."⁵²⁰

The ten elements of 16 CFR 314.4, one by one

The heart of the rule is section 314.4, "Elements." The current text has ten lettered paragraphs. Paragraphs (a) to (i) are the parts of the information security program; paragraph (j), added in 2023, is the duty to notify the FTC.³ Older summaries that speak of "nine elements" were written before (j) existed.

The table gives each element, what the rule says in plain words, and what a small tax and accounting office (say, an enrolled agent, two preparers and a part-time receptionist, with about 1,200 individual clients) typically does to meet it. The right-hand column is a description of common practice, not a rule requirement; your own risk assessment decides what is reasonable for your office.

Source for the rule columns: 16 CFR 314.4, current eCFR text read October 28, 2026.³ Several entries are summaries, not quotations; the quoted phrases are the rule's own words.

MFA: the element that matters most in a tax office

The multi-factor authentication requirement in 314.4(c)(5) is short, and its reach is wide: MFA "for any individual accessing any information system." It is not limited to remote access or to administrators. The only escape is a written approval by the Qualified Individual of controls that are "reasonably equivalent or more secure."³ In practice, that means the tax software, the email system, the client portal, cloud file storage, remote access tools and the IRS e-Services accounts all need a second factor.

Not all MFA is equal. Federal guidance from CISA, the NSA, the FBI and MS-ISAC says MFA based on FIDO security keys or PKI certificates resists phishing, and where that is not possible, push notifications should use number matching so that a staff member cannot approve a login just by tapping "yes."²¹ Text-message codes are better than nothing, but a convincing fake login page can capture them too. A small office can start with an authenticator app for everyone and add security keys for the owner and anyone with administrator rights.

Encryption at rest and in transit

Section 314.4(c)(3) requires encryption of all customer information both in transit over external networks and at rest.³ "At rest" covers the laptop that goes home in a car, the external backup drive and the cloud folder. "In transit over external networks" covers email and file transfer. Sending a client's completed return as an unencrypted email attachment is the most common gap. A portal that requires the client to sign in, or an encrypted email service, closes it.

Encryption also matters at the end of a bad day. The FTC's notification duty, described below, applies only to "unencrypted customer information," and state breach laws, including Idaho's, are written the same way.¹²² An encrypted laptop stolen from a car is usually an inconvenience; an unencrypted one is a reportable breach.

The two-year disposal rule and record retention

Accountants keep things. The disposal element pushes the other way: dispose of customer information "no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates," "unless such information is necessary for business operations or for other legitimate business purposes, is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained."³ The exceptions are wide enough that a firm can keep returns and workpapers for as long as it has a documented business or legal reason. What the rule does not allow is keeping everything forever by default. The firm should write down its retention periods, apply them, and review them periodically.

Idaho's accountancy rules do not set a general retention period for workpapers. The only explicit retention period in IDAPA 24.30.01 is for peer review documents.¹⁰ So the retention schedule is a business and professional decision the firm makes and documents, informed by the IRS statute of limitations, professional standards and client agreements.

The small-firm exemption in 314.6, exactly

Section 314.6 is one sentence:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."⁴

Read it carefully, because it is often misdescribed as exempting small firms from "the rule." It removes four things:

1. (b)(1), the written risk assessment. The firm still must base its program on a risk assessment under 314.4(b), and must still reassess periodically under (b)(2). It just does not have to put the assessment in writing with stated criteria.
2. (d)(2), continuous monitoring or the annual penetration test and six-month vulnerability assessments. The firm still must "regularly test or otherwise monitor the effectiveness of the safeguards' key controls" under (d)(1).
3. (h), the written incident response plan.
4. (i), the annual written report to the board or senior officer.

Everything else stays: the Qualified Individual, all eight (c) safeguards including encryption and MFA, the testing duty in (d)(1), training, vendor oversight, program adjustments and FTC notification under (j).⁴³

Counting to 5,000

The count is of consumers about whom the firm maintains customer information, not this year's clients. A preparer who files 900 returns a year but keeps ten years of files, each listing spouses and dependents, may hold information on far more than 5,000 people. Count the people in the records you actually keep, including former clients, and repeat the count each year. If the firm is near the line, it is simpler to do the four extra items anyway.

The IRS does not give small firms the same break

Even an office under 5,000 consumers will want a written plan, because the IRS expects one. Form W-12, line 11, has every preparer acknowledge that paid preparers "are required by law to create and maintain a written information security plan," and IRS Publication 5708 says: "Your WISP must be written and accessible."⁶² The written incident response plan, excused under 314.6, is also one of the things the IRS sample plan contains as an attachment. In practice, small offices write the plan.

The 30-day FTC notice: 314.2(m) and 314.4(j)

What counts as a notification event

The 2023 amendment defines the trigger in 314.2(m):

"Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Customer information is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information."¹

Three points stand out. First, encryption only helps if the key was not also taken; a stolen laptop with the password on a sticky note is "unencrypted" for this purpose. Second, the presumption: if an intruder had access to unencrypted data, the firm must treat it as taken unless it has "reliable evidence" otherwise. That is why logs matter. A firm without sign-in and file-access logs usually cannot prove what an intruder did not take. Third, the definition turns on acquisition without the individual's authorization, so it covers an employee who walks out with client files, not only outside hackers.

The threshold, the clock and the form

Under 314.4(j)(1), "if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event. The notice shall be made electronically on a form to be located on the FTC's website, https://www.ftc.gov."³ The notice must include:

1. the name and contact information of the reporting financial institution;
2. a description of the types of information involved;
3. the date or date range of the event, if it can be determined;
4. the number of consumers affected or potentially affected;
5. a general description of the event; and
6. whether a law enforcement official has provided a written determination that notifying the public would impede a criminal investigation or damage national security.

Law enforcement may request an initial delay of up to 30 days, which can be extended for up to 60 more days on a written request.³

When the clock starts

Under 314.4(j)(2), an event is "treated as discovered as of the first day on which such event is known to you," and the knowledge of any employee, officer or other agent of the firm, other than the person who committed the breach, counts as the firm's knowledge.³ If the receptionist noticed on March 3 that clients were calling about IRS letters for returns they never filed, and told no one, the firm may already be on the clock. Training staff to report oddities the same day is part of compliance.

What the FTC notice is not

The FTC notice goes to the agency, not to clients. Notice to affected individuals is governed by state law. Idaho's statute, Idaho Code 28-51-105, requires a commercial entity that owns or licenses computerized personal information of Idaho residents to investigate promptly and, if misuse has occurred or is reasonably likely, notify affected Idaho residents "in the most expedient time possible and without unreasonable delay." It sets no fixed number of days, and private businesses have no statutory duty to notify the Idaho attorney general (public agencies must, within 24 hours).²³ A firm with clients in other states follows each state's law. The IRS has its own reporting channels, covered below, and the IRS Data Theft page repeats the FTC step: submit a report to the FTC if "500 or more people" are affected.²⁴ Incident response and client notice are covered in depth in lesson 5.

FTC enforcement: the TaxSlayer case and its MFA lesson

The FTC's best-known Safeguards Rule case against a tax business is TaxSlayer, LLC, a Georgia-based online tax preparation service. In an August 29, 2017 press release, the FTC said hackers gained full access to "nearly 9,000 TaxSlayer accounts between October 2015 and December 2015" and used the information to commit tax identity theft, filing fraudulent returns to steal refunds.²⁵

The FTC alleged that TaxSlayer violated both the GLBA Privacy Rule and the Safeguards Rule. On security, the complaint said the company had no written information security program until November 2015, had not conducted a risk assessment, and did not have adequate risk-based authentication or password requirements. Tom Pahl, then the acting director of the FTC's Bureau of Consumer Protection, put the key point in one sentence: "the attack ended when TaxSlayer eventually required people to use multi-factor authentication."²⁵

The settlement order bars the company from violating the Privacy and Safeguards Rules for 20 years and requires biennial third-party assessments of its security program for 10 years. The FTC announced final approval in November 2017.²⁶

What the case teaches a small office

• Credential stuffing is cheap. The attack described in the FTC's release used valid credentials to log in to customer accounts. Passwords reused from other breaches are the raw material. MFA is what stops them, as the FTC itself said.
• A written program is the first thing a regulator asks for. The absence of a written program and a risk assessment was among the FTC's allegations. The 2021 amendments made both more specific.
• Orders last a long time. Twenty years of order coverage and ten years of outside assessments cost far more than doing the work up front.

Two cautions about what the record shows. First, this search found no FTC Safeguards Rule action against a small CPA or tax practice; the agency's cases have targeted larger companies, and the absence of a case is not proof that none exists. Second, the Safeguards Rule itself contains no dollar penalty. The FTC enforces it through orders under Section 5 of the FTC Act, and civil penalties generally depend on a violated order or on a rule the FTC can sue on under its civil penalty authority; this lesson does not state a per-violation penalty figure for the Safeguards Rule because no primary source read for it gives one. The IRS's own warning is more modest and more certain: failure to have a plan "may result in an FTC investigation."¹⁵ How the FTC's orders and penalties work in general is covered in The FTC and Federal Security Rules.

What the IRS requires and provides

The IRS does not write the Safeguards Rule, but it controls two things every preparer needs: the Preparer Tax Identification Number (PTIN) and, for those who file electronically, acceptance into the e-file program. It uses both to push security, and it publishes most of the free guidance small offices use.

Publication 4557: Safeguarding Taxpayer Data

Publication 4557, "Safeguarding Taxpayer Data: A Guide for Your Business," is the IRS's main security guide for tax professionals. The current revision is "Publication 4557 (Rev. 6-2024) Catalog Number 48905Y." It covers how to report data loss to the IRS and states, how to respond and recover, how to comply with the FTC Safeguards Rule, and includes a checklist for creating a plan.¹⁵ It also states two practical points worth knowing before an incident: for ransomware, "contact the FBI and Cybersecurity and Infrastructure Security Agency (CISA) ... in addition to the IRS," and "IRS telephone assistors cannot accept third-party reports of identity theft."¹⁵ The second point matters because the instinct in a crisis is to call the main IRS number. That is the wrong door.

Publication 5708: Creating a Written Information Security Plan

Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice" (Rev. 8-2024, Catalog Number 93462W), is the most useful single document for a small office, because it includes a sample plan.² It says plainly: "Your WISP must be written and accessible." It also says "There is no one-size-fits-all WISP," and tells firms to scale the plan to their size and type of operation.²

The publication's outline says a plan should contain:

1. the plan's objectives, purpose and scope;
2. a designated Qualified Individual and a list of authorized users with their access levels;
3. a risk assessment covering the information the firm handles, potential sources of loss and monitoring procedures;
4. an inventory of hardware that touches taxpayer data, with locations and the data each item processes;
5. documented safety measures, such as policies on data collection, disclosure, network protection, user access, remote access, connected devices and reportable incidents, and an employee code of conduct;
6. an implementation clause; and
7. attachments.²

The sample template follows that outline, with sections headed Objective, Purpose, Scope, Identified Responsible Officials, Inside the Firm Risk Mitigation, Outside the Firm Risk Mitigation and Implementation, followed by remote access, connected devices and training policies. The sample attachments are: A, Record Retention Policies; B, Rules of Behavior and Conduct Safeguarding Client PII; C, Security Breach Procedures and Notifications; D, Employee/Contractor Acknowledgement of Understanding; E, Firm Hardware Inventory containing PII Data; and F, Firm Employees Authorized to Access PII.² The sample plan later in this lesson follows the same order and cross-references the Safeguards Rule elements.

Publication 5293 and other guides

Publication 5293, "Protect Your Clients; Protect Yourself: Data Security Resource Guide for Tax Professionals" (5-2018, Catalog Number 71256E), is an older collected guide.²⁷ It is still posted and still useful as a reading list, but where it differs from Publications 4557 and 5708, use the newer documents. The Form W-12 instructions also point to Publication 5709, "How to Create a Written Information Security Plan for Data Safety," and Publication 5417, "Basic Security Plan Considerations for Tax Professionals"; the versions posted on irs.gov on October 28, 2026 were Rev. 5-2024 and Rev. 4-2023.²⁸

Publication 1345: e-file providers and next-business-day reporting

Publication 1345, the "Handbook for Authorized IRS e-file Providers," current as "Publication 1345 (Rev. 12-2025) Catalog Number 64382J," sets the rules for firms in the e-file program.⁷ Among its security, privacy and business standards for providers of individual income tax returns that collect taxpayer information online, it says:

"Authorized IRS e-file Providers of individual income tax returns must report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident."⁷

A reportable incident is "an event that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information (e.g., breach)." Electronic Return Originators (EROs, the role most local preparers hold in the e-file program) report through their local IRS liaison for tax professionals.⁷²⁹ If the provider's own website caused the incident, the provider must stop collecting taxpayer information through the site until the problem is resolved. The handbook also says providers subject to GLBA "must follow the FTC's Financial Privacy and Safeguard Rules" and lists basic steps: recognize phishing emails, create a data security plan, review internal controls, report data theft or loss, and use multi-factor authentication.⁷

Compare the clocks. The IRS e-file standard is the next business day after confirmation. The FTC notice is up to 30 days after discovery, and only at 500 consumers. Idaho's consumer notice has no fixed day count. In a tax office, the IRS call almost always comes first, and for a good reason: the IRS can flag affected taxpayer accounts and stop fraudulent refunds before they are paid.

The PTIN renewal attestation: Form W-12, line 11

Every paid preparer must have a PTIN and renew it each year on Form W-12 or online. The current Form W-12 (Rev. 10-2026), line 11, "Data Security Responsibilities," reads:

"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information. See IRS Publication 5708 and 4557 for more information about your responsibilities."⁶

The applicant checks Yes or No. The instructions (Revised October 2026) say to "Check the box to acknowledge awareness that paid tax return preparers are required by law to create and maintain a written information security plan to protect taxpayer information."²⁸

The wording has grown stronger. Earlier versions of the form (Rev. 10-2020, Rev. 5-2021 and Rev. 10-2023) read: "I am aware that paid tax return preparers must have a data security plan to provide data and system security protections for all taxpayer information."³⁰ The checkbox existed at least by the October 2020 revision, used for the 2021 PTIN season. The current text says "written" plan and "required by law." When a preparer checks Yes and has no plan, the box becomes a record of knowledge.

Tax return information: section 7216 and section 6713

Separate from security, federal tax law restricts what a preparer may do with return information at all. These rules matter for cybersecurity because many modern practice tools (cloud software, offshore processing, AI assistants, marketing platforms) involve disclosing or using return information in ways the preparer may not have thought about.

The criminal statute: 26 U.S.C. 7216

Under 26 U.S.C. 7216(a), a preparer who "knowingly or recklessly" discloses or uses return information for any purpose other than preparing the return "shall be guilty of a misdemeanor, and, upon conviction thereof, shall be fined not more than $1,000 ($100,000 in the case of a disclosure or use to which section 6713(b) applies), or imprisoned not more than 1 year, or both, together with the costs of prosecution."⁸ Section 6713(b) covers disclosures or uses connected to identity theft.

The consent rules: 26 CFR 301.7216-3

The regulations set out when a preparer may disclose or use return information with consent. Under 26 CFR 301.7216-3(a)(1), "a tax return preparer may not disclose or use a taxpayer's tax return information prior to obtaining a written consent from the taxpayer," and "The consent must be knowing and voluntary."³¹ Key rules from the same section:

• Conditioning the preparer's services on the client's consent generally makes the consent invalid.
• One document cannot authorize both uses and disclosures; they require separate consents.
• The consent must be signed and dated by the taxpayer.
• If the consent does not state how long it lasts, it is effective "for a period of one year from the date the taxpayer signed the consent."
• Disclosure to a preparer located outside the United States requires the taxpayer's prior consent.³¹

Under 26 CFR 301.7216-2(d), a preparer may disclose return information to another preparer located in the United States for the purpose of preparing a return or providing auxiliary services without consent; sending the work offshore requires consent.³² For a security program, the practical questions are: where are my software vendor's servers and support staff? Does my outsourced data entry happen in another country? Does an AI tool send client data to a service that uses it for anything beyond my request? If the answer to any of these involves offshore preparers or uses beyond return preparation, the consent rules may apply. The IRS guidance on the format and content of consents for taxpayers who file Form 1040 series returns is Rev. Proc. 2013-14, which modified and superseded Rev. Proc. 2008-35.⁵³

The civil penalty: 26 U.S.C. 6713

The civil side is 26 U.S.C. 6713. A preparer who discloses or uses return information without authorization faces a penalty of "$250 for each such disclosure or use, but the total amount imposed under this subsection on such a person for any calendar year shall not exceed $10,000." When the disclosure or use relates to identity theft, section 6713(b) substitutes "$1,000" for "$250" and "$50,000" for "$10,000."⁹ The statute shows fixed amounts; whether any inflation adjustment applies was not confirmed for this lesson.

Where 7216 meets a breach

Section 7216 punishes knowing or reckless disclosure and use. A firm that is hacked despite reasonable precautions has not, by that fact alone, "disclosed" anything in the statute's sense. But a firm that knowingly emails full returns in plain text to anyone who asks, or that sends client files to an unvetted offshore processor without consent, is in a different position. Security failures and 7216 problems tend to show up together, in the same careless practices.

The threat to tax offices, in the IRS's words

The Security Summit

The Security Summit is a partnership of the IRS, state tax agencies and the private tax industry formed to fight tax-related identity theft. An IRS news release in July 2024 said the effort has been "in place since 2015."¹³ Each summer the Summit runs an education series for tax professionals. The 2026 series, announced July 7, 2026 in IR-2026-81, covered the written information security plan in its third week, with a link to Publication 5708, and Identity Protection PINs and multi-factor authentication in its fourth.³³

How many tax offices are hit

Hard numbers are scarce. The best official figure found for this lesson is from IR-2024-180, July 2, 2024, which reported "nearly 200 tax professional data incidents potentially affecting up to 180,000 clients" in the period it covered.¹³ The IRS did not publish a year-by-year series on its website that this research could find, so do not compare that figure to other years without a source. It also counts only incidents reported to the IRS; offices that never report are not in it.

The "new client" scam

The attack the IRS warns about most often is simple. A criminal emails the office pretending to be a prospective client. IRS Tax Tip 2024-06 (February 13, 2024) described it: "cybercriminals pose as potential clients," and "This phishing email has a malicious link or attachment that the scammer claims is their tax information." Once the preparer opens it, the scammer may get "the preparer's email address, password and possibly other information," and may "use that tax professional's hacked email account to target clients."³⁴

The scam works because it looks exactly like the business. Tax offices want new clients, and new clients send documents. The IRS's advice: do not click links or open attachments from unknown senders, forward IRS-related phishing to phishing@irs.gov, report data theft to the IRS liaison office for tax professionals, and remember that "Under Federal Trade Commission rules, tax professionals must have a Written Information Security Plan."³⁴²⁹

The warning returned in the 2026 "Dirty Dozen" list of tax scams. IR-2026-30, March 5, 2026, lists as item 11 "Spear-phishing and malware targeting tax professionals." The release says tax professionals "remain targets of 'new client' or 'document request' emails," and names warning signs including "mismatched or unfamiliar sender addresses," unexpected requests for sensitive data and urgent payment demands. It adds that a hacked email account lets scammers find real past client emails and use them to make the next message look genuine.³⁵

Defenses that work against this specific scam, all of which map to Safeguards Rule elements:

• Have new clients upload documents through the firm's portal, never as email attachments. The portal is an encrypted channel (314.4(c)(3)), and a habit of "we only accept documents through the portal" makes an attachment from a stranger stand out.
• Require MFA on email (314.4(c)(5)). Stolen passwords alone then do not open the mailbox.
• Train staff before each season on what these emails look like (314.4(e)).
• Log and alert on unusual mailbox activity, such as new forwarding rules or logins from abroad (314.4(c)(8)). Forwarding rules are a classic sign of a compromised mailbox; lesson 6 covers business email compromise in detail.

The Taxes-Security-Together Checklist

The IRS's "Tax Security 2.0: The Taxes-Security-Together Checklist" condenses the advice into five items:³⁶

1. Deploy the "Security Six": anti-virus software, a firewall, two-factor authentication, backup software or services, drive encryption and VPNs.
2. Create a data security plan.
3. Educate yourself on phishing scams.
4. Recognize the signs of client data theft: clients receive IRS letters about suspicious returns, more returns are filed with the firm's Electronic Filing Identification Number (EFIN) than it submitted, or clients receive tax transcripts they did not request.
5. Create a data theft recovery plan: contact the IRS liaison office, help the IRS protect clients, and bring in a cybersecurity expert.

Item 4 deserves a place on the office wall. Weekly, during filing season, compare the number of returns the firm submitted with the count the IRS shows for its EFIN in e-Services. A gap is often the first sign of a breach.

Identity Protection PINs for clients

An Identity Protection PIN (IP PIN) is "a six-digit number that prevents someone else from filing a tax return" using a person's Social Security number or ITIN. Anyone with an SSN or ITIN who can verify their identity may get one. A new IP PIN is issued each year and is valid for one calendar year. Clients can get one through their IRS Online Account (the fastest route), with Form 15227 (generally for people with adjusted gross income below $84,000 for individuals or $168,000 for married filing jointly), or in person at a Taxpayer Assistance Center.³⁷ A firm that encourages every client to get an IP PIN limits the damage if its own files are ever stolen: a thief with a stolen SSN cannot e-file a return for an IP PIN holder without the PIN.

When data is stolen: how a tax office reports

The IRS page "Data Theft Information for Tax Professionals" (last reviewed March 26, 2026) sets out who to contact. The order below follows the page and Publication 4557; the incident response plan should list current phone numbers and email addresses for each.²⁴¹⁵

1. The IRS, through the local liaison office for tax professionals. The IRS page says the liaison will notify IRS Criminal Investigation and that "Speed is critical." E-file providers are under the Publication 1345 next-business-day standard described above.²⁴²⁹
2. The states. Report to the state tax agencies where the firm files returns, using the Federation of Tax Administrators "Report a Data Breach" page linked from the IRS page. An Idaho office files with the Idaho State Tax Commission, so Idaho is on its list.²⁴
3. Law enforcement. The local FBI field office, the local Secret Service office if directed, and local police. For ransomware, Publication 4557 says to contact the FBI and CISA in addition to the IRS.²⁴¹⁵
4. The FTC, if 500 or more people are affected, within 30 days of discovery under 314.4(j).²⁴³
5. Security experts and the insurer. Publication 4557 tells firms to contact security experts to find the cause and scope, and to contact their insurance company.¹⁵
6. Clients, under state breach notice law (Idaho Code 28-51-105 for Idaho residents) and the firm's professional duties. See lesson 5.²³

Two things not to do. Do not call the general IRS phone line to report the breach, because, as Publication 4557 says, telephone assistors cannot accept third-party identity theft reports.¹⁵ And do not wipe and rebuild infected computers before someone preserves the evidence; the IRS, law enforcement and the insurer will all want to know how the intruder got in.

The profession's own rules: AICPA standards

The Confidential Client Information Rule, ET 1.700.001

CPAs who are AICPA members, and licensees in states that adopt AICPA standards, follow the AICPA Code of Professional Conduct. The Confidential Client Information Rule, ET 1.700.001.01, reads: "A member in public practice shall not disclose any confidential client information without the specific consent of the client."³⁸ The rule does not override other duties: it does not relieve a member of the Compliance With Standards or Accounting Principles Rules, does not affect compliance with "a validly issued and enforceable subpoena or summons" or applicable laws and regulations, does not bar peer review and does not stop a member from starting or responding to an ethics complaint.³⁸³⁹

The rule is written as a duty not to disclose. A breach is not a voluntary disclosure, but the code's interpretations on outsourcing show that the profession expects members to take reasonable care with where client information goes.

Third-party service providers: ET 1.700.040 and 1.150.040

Two interpretations govern cloud services, outsourced preparation, IT providers and similar vendors.

• ET 1.700.040, Disclosing Information to a Third-Party Service Provider. Before disclosing confidential client information to a third-party service provider, the member should either "Enter into a contractual agreement with the third-party service provider to maintain the confidentiality of the information and provide reasonable assurance that the third-party service provider has appropriate procedures in place to prevent the unauthorized release of confidential information to others," or "Obtain specific consent from the client before disclosing confidential client information to the third-party service provider."³⁸
• ET 1.150.040, Use of a Third-Party Service Provider (under the Integrity and Objectivity Rule). Before disclosing confidential client information to a third-party service provider, "the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member either should not use the provider or should decline the engagement. No notice is needed for administrative support services, which the interpretation describes with examples: "(for example, record storage, software application hosting, or authorized e-file tax transmittal services)."³⁸

The AICPA's Professional Ethics Executive Committee published sample client disclosure language for these outsourcing rules; the resource page is dated May 13, 2013.⁴⁰ Many firms put this language in their engagement letters, which lesson 5 covers.

AICPA confidentiality and section 7216 together

The two regimes overlap but are not the same. AICPA confidentiality applies to all confidential client information in any engagement. Section 7216 applies to tax return information and requires a specific written consent format. A CPA firm sending tax files to an outsourced preparer abroad may need both a 7216 consent from the client and a confidentiality agreement with the provider under ET 1.700.040. A March 1, 2015 Journal of Accountancy article explains how the two fit together.³⁹³¹

SOC 2 and SOC for Cybersecurity, described

The AICPA also writes the criteria behind the security reports that many vendors hand to their customers. These standards are copyrighted and sold, so this lesson describes them without reproducing them.

• Trust Services Criteria. The current version is the "2017 Trust Services Criteria (With Revised Points of Focus, 2022)," control criteria established by the AICPA Assurance Services Executive Committee for attestation or consulting engagements. They cover five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. These criteria are the basis of SOC 2 reports, in which a CPA firm reports on a service organization's controls.⁴¹
• SOC for Cybersecurity. An engagement in which a CPA reports on an organization's entity-wide cybersecurity risk management program. The AICPA provides description criteria for such a program, an attestation guide titled "Reporting on an Entity's Cybersecurity Risk Management Program and Controls," and an illustrative report.⁴²

The practical tie-in: a firm checking a cloud tax software vendor or a portal under 16 CFR 314.4(f) and ET 1.700.040 can ask for the vendor's SOC 2 Type 2 report (a report covering how controls operated over a period of time, not just on one day) and read the exceptions section. Asking for the report is a suggested practice, not a rule requirement. How SOC 2 compares with NIST and ISO frameworks is covered in Security Frameworks and Standards.

Idaho accountancy law

Idaho regulates accountants under Idaho Code Title 54, Chapter 2, "Accountants," which includes sections on the board's powers and duties (54-204), definitions (54-206), firm registration and peer review (54-214), commissions and contingent fees (54-218) and license restriction and revocation (54-219).⁴³ The rules are IDAPA 24.30.01, "Idaho Accountancy Rules," administered through the Division of Occupational and Professional Licenses. (Older references to "IDAPA 01.01.01" use the numbering in place before the state reorganized its rules around 2019.)¹⁰

• Standards incorporated. IDAPA 24.30.01.002 incorporates by reference "The AICPA Professional Standards as applicable under the circumstances and at the time of the services," and PCAOB standards. So the AICPA confidentiality interpretations above carry weight under Idaho licensing rules.¹⁰
• Confidential client information. IDAPA 24.30.01.201.01: "A licensee is to protect and not disclose confidential client information obtained in the course of performing professional services, unless the licensee has obtained the specific consent of the client, or of such client's heirs, successors or personal representatives, or others legally authorized to give such consent on behalf of the client." Note the first verb: "protect." Idaho's rule is not only a ban on disclosure. Rule 201.02 lists exemptions, including disclosures required in reporting on examinations of financial statements and in Board investigations.¹⁰
• Client records. IDAPA 24.30.01.202 requires a licensee to furnish client records to a client or former client on request within a reasonable time, "whether the engagement has been terminated or the licensee has been paid for services rendered," including copies of working papers to the extent they contain records that ordinarily form part of the client's books, in the medium requested if the records exist in that medium.¹⁰ For security, this means the records must be retrievable. Ransomware that locks the files does not suspend the duty.
• No general retention period. As noted above, the only explicit retention period in IDAPA 24.30.01 is for peer review documents (rule 212.02). Do not cite an Idaho workpaper retention period; there is none in the rules.¹⁰
• Accountant privilege. Idaho Code 9-203A: "Any licensed public accountant, or certified public accountant, cannot, without the consent of his client, be examined as a witness as to any communication made by the client to him, or his advice given thereon in the course of professional employment," with an exception for Board of Accountancy proceedings and quality review.⁴⁴ The privilege protects communications from compelled testimony; it does nothing for files an intruder copies. That is a reason to protect them better, not less.

Financial advisers and brokers: amended SEC Regulation S-P

Investment advisers registered with the SEC, broker-dealers and some other securities firms are not under the FTC rule. Their equivalent is the SEC's Regulation S-P, which the Commission amended on May 16, 2024 (press release 2024-58).¹¹ The amendments were published at 89 FR 47688 on June 3, 2024, corrected at 89 FR 53487 on June 27, 2024, and took effect August 2, 2024.⁴⁵

Who it covers

The covered institutions are brokers and dealers, funding portals, investment companies, investment advisers registered with the SEC, and transfer agents registered with the SEC or another appropriate regulatory agency.⁴⁶ CPA firms and law firms are not covered institutions as such. But a firm with an SEC-registered investment adviser affiliate is, and any professional firm can be a service provider to a covered institution, which brings contract clauses.

What it now requires

• An incident response program. Written policies and procedures for an incident response program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information, including assessment, containment and control, and notice to affected individuals.¹¹⁴⁵
• Customer notice within 30 days. Notice to affected individuals "as soon as practicable, but not later than 30 days, after becoming aware" that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. No notice is required if a reasonable investigation determines the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.¹¹
• Service provider oversight with a 72-hour clock. Covered institutions must oversee service providers, including requiring them to notify the institution "as soon as possible, but no later than 72 hours after becoming aware" of a breach resulting in unauthorized access to a customer information system the provider maintains.¹¹
• Sensitive customer information includes items such as Social Security numbers and driver's license numbers whose compromise could create a reasonably likely risk of substantial harm or inconvenience.⁴⁵
• Disposal and records. The disposal rule now covers customer information, not only consumer report information, and covered institutions (other than funding portals) must keep written records of compliance.⁴⁵

Compliance dates: both have passed

Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026.⁴⁶ As of October 28, 2026, both dates have passed and the rule is fully in force for all covered institutions. Industry groups asked for more time; no extension appeared in the sources read for this lesson. The adopting release draws the line in its Table 3: for example, an SEC-registered investment adviser with $1.5 billion or more in assets under management was a "larger entity," as was any broker-dealer or transfer agent that is not a small entity and any investment company whose group had $1 billion or more in net assets. Smaller entities are the covered institutions that do not meet those standards. Check the table before deciding which date applied to a particular firm.⁴⁵

What it means for a CPA or consulting firm

If an accounting firm does work for an SEC-registered adviser or a broker-dealer that involves access to customer information (tax work for the adviser's clients, back-office accounting, IT services), expect the adviser's new contracts to require breach notice to the adviser within 72 hours. That is a shorter clock than any the accounting firm faces under its own rules, and the firm's incident response plan should say who tracks contract clocks like this one.

Engineers, architects, consultants and insurance agencies

Not every professional firm has a federal security rule of its own. For many, the obligations come from three places: the client's contract, state breach notice law and, for some, a sector program.

Engineers, architects and consultants

This research found no sector-specific federal cybersecurity rule for design firms as such. An engineering or architecture firm's duties come from its contracts (confidentiality clauses, non-disclosure agreements, data processing terms, sometimes security exhibits with specific controls), from state breach law (Idaho Code 28-51-105 applies to any commercial entity that owns or licenses computerized personal information of Idaho residents) and, for defense work, from CMMC.²³ A consultant that is a service provider to a GLBA-covered firm will see 16 CFR 314.4(f) in action: the client must require safeguards by contract, so expect a security clause. A consultant to an SEC-registered adviser or broker-dealer should expect the 72-hour clause under amended Regulation S-P.³¹¹

Defense work and CMMC

Firms that work on Defense Department contracts, including engineering and consulting firms several layers down the subcontract chain, face the Cybersecurity Maturity Model Certification (CMMC) program. The program rule, 32 CFR Part 170, was published at 89 FR 83092 on October 15, 2024 and took effect December 16, 2024.⁴⁷ The companion acquisition rule, DFARS Case 2019-D041, was published at 90 FR 43560 on September 10, 2025 and took effect November 10, 2025.⁴⁸

Under 32 CFR 170.3(e), Phase 1 began with the DFARS rule's effective date (November 10, 2025), putting Level 1 or Level 2 self-assessments into applicable solicitations. Phase 2 "Begins one calendar year following the start date of Phase 1," which by the rule's text is November 10, 2026, and would add Level 2 certification by a third-party assessment organization (C3PAO) for applicable contracts.⁴⁹ But on July 13, 2026 the department (called the Department of War in recent announcements) announced "the immediate suspension" of the Phase II requirements and of "pending and future CMMC implementation milestones," said "All Phase I self-assessment requirements remain firmly in place," and started a 60-day review.⁵⁴ According to a Morgan Lewis summary published July 16, 2026, contracting officers may require only Level 1 (Self) or Level 2 (Self) during the suspension, not Level 2 (C3PAO) or Level 3; later milestones are paused; and Phase 1 self-assessments, annual affirmations, DFARS 252.204-7012 and its NIST SP 800-171 controls and incident reporting duties remain.¹² The suspension was done by announcement and memoranda; the Phase 2 language in 32 CFR 170.3(e) itself had not been amended in the version read for this lesson. The details of where CMMC stands, and what it costs, are in Government Contracts, Idaho Public Sector and Sectors.

Insurance agencies

Several states have adopted versions of the National Association of Insurance Commissioners' Insurance Data Security Model Law (Model #668), which requires insurance licensees to keep an information security program and to notify the insurance commissioner of cybersecurity events. Idaho has not. In 2025, House Bill 117, the "Insurance Data Security Act," would have added a new chapter to Title 41 of the Idaho Code. It was introduced February 4, 2025, reported out of committee with a do-pass recommendation March 12, held on third reading from March 14 to 19, and on March 20 the House agreed by unanimous consent to return it to the Business Committee. It did not pass.⁵⁰ The NAIC's state adoption chart (Summer 2026) lists for Idaho only related activity: the 2025 bill, the state breach notice statute and IDAPA 18.01.01, the Department of Insurance rules (2022).⁵¹

An Idaho insurance agency is still covered by Idaho's breach notice law, and for agencies licensed by the Department of Insurance, the department is the "primary regulator" that enforces that law under Idaho Code 28-51-104(6).²² An agency that also sells to residents of states that adopted the model may be bound by those states' versions. (The commonly cited 72-hour notice to the commissioner in the model was not re-read for this lesson.) The NAIC chart lists which states have adopted it.⁵¹

Which rules apply to my firm: a decision chart

The chart below is a first screen. It sorts the main federal and Idaho rules covered in this lesson by the kind of work a firm does. A firm can land in several boxes at once (a CPA firm with a registered investment adviser affiliate and a defense contractor client is in three), and every firm is under state breach notice law. When a box is unclear for your firm, your compliance officer or a qualified privacy and security professional should document the analysis.

A sample written information security plan outline

The outline below follows the order of the IRS sample plan in Publication 5708 and cross-references each part to the 16 CFR 314.4 element it helps meet. It is written for a small tax and accounting office. It is an outline, not a finished plan: each bracketed item must be filled in from the firm's own systems and risk assessment. For a general small business policy and a 90-day rollout plan, see Policies, Training and a 90-Day Plan.

Common mistakes

Treating MFA as optional

The FTC said of TaxSlayer that "the attack ended when TaxSlayer eventually required people to use multi-factor authentication."²⁵ Since June 9, 2023, MFA "for any individual accessing any information system" has been a rule requirement for every covered firm, large or small.¹⁸³ Offices still turn it on only for remote access, or leave the receptionist's email without it. That account is often the one the "new client" email reaches first.

Reading 314.6 as "small firms are exempt"

The exemption removes four items: the written risk assessment, the (d)(2) testing schedule, the written incident response plan and the annual report.⁴ It does not remove the Qualified Individual, encryption, MFA, training, vendor oversight or FTC notice. And the IRS still expects a written plan.⁶

No written program, no risk assessment

Both were among the FTC's allegations in TaxSlayer: no written information security program until November 2015, and no risk assessment.²⁵ A preparer who checks "Yes" on Form W-12 line 11 without a plan creates a signed record that they knew a plan was required.⁶

Calling the wrong IRS number

Publication 4557 states that "IRS telephone assistors cannot accept third-party reports of identity theft."¹⁵ The report goes to the IRS liaison office for tax professionals, which notifies Criminal Investigation.²⁴

Ignoring the early signs

The IRS lists the signs of client data theft: clients getting IRS letters about returns they did not file, more returns on the firm's EFIN than it submitted, and clients receiving transcripts they did not request.³⁶ Because knowledge of any employee counts as the firm's knowledge under 314.4(j)(2), a sign noticed and not reported can start the FTC's 30-day clock without the owner knowing.³

Emailing returns as plain attachments

Section 314.4(c)(3) requires encryption of customer information in transit over external networks.³ A completed return sent as an ordinary email attachment fails that test unless the firm has documented a compensating control approved by the Qualified Individual.

Sending work offshore without consent

Disclosure of tax return information to a preparer outside the United States requires the taxpayer's prior written consent under 26 CFR 301.7216-3, and the AICPA interpretations require a confidentiality agreement or client consent, plus notice to the client, before using a third-party provider.³¹³⁸ Firms sometimes learn only after a vendor incident that their software's support or processing happens abroad.

Keeping everything forever

The disposal element requires disposal within two years of last use unless a business, legal or feasibility reason applies, and periodic review of the retention policy.³ A firm with twenty years of client files on an old server has more to lose in a breach and more people to notify. Idaho's rules set no general workpaper retention period, so the firm must set its own and follow it.¹⁰

Questions people ask

I only do bookkeeping for small businesses, not individual tax returns. Am I covered?

The rule's named example is the accountant or tax service "in the business of completing income tax returns."¹ A bookkeeping firm that serves only businesses may hold little "customer information" in the rule's consumer sense. But it still holds employees' names and Social Security numbers for payroll, which together are personal information under Idaho Code 28-51-104 (as is an account number combined with a code or password that permits access to the account), and its clients may require safeguards by contract.²² If the firm prepares even a few individual returns, it is in the rule's named category. Building the program is the simpler choice.

Is a written plan really "required by law"?

Form W-12 says paid preparers "are required by law to create and maintain a written information security plan."⁶ The legal source is the FTC Safeguards Rule. For firms with 5,000 or more consumers, 314.4 requires several written documents directly (written risk assessment, written incident response plan, written annual report). For smaller firms, the program itself must still exist, and the IRS position, stated in Publication 5708, is that "Your WISP must be written and accessible."²

Who can be the Qualified Individual in a three-person office?

The rule allows an employee, someone at an affiliate or a service provider.³ In a small office, it is usually the owner. If an IT provider does the work, the firm still keeps responsibility and must name a senior staff member to oversee the provider. The rule does not require a certification; it requires someone qualified for the size and complexity of the firm.

Does the FTC notice replace telling clients?

No. The FTC notice goes to the agency. Notice to clients is governed by state law, such as Idaho Code 28-51-105, and by professional duties.²³ A firm with clients in several states follows each state's law. See lesson 5.

Will the public see our FTC notice?

Plan on it. The 2023 final rule says: "the Commission intends to enter notification event reports into a publicly available database." That is why the notice asks whether law enforcement has determined that "notifying the public" would impede an investigation. Check the FTC's Safeguards Rule page for how the database currently works.⁵³¹⁹

Our tax software is in the cloud. Isn't security the vendor's job?

Partly. Under 314.4(f), the firm must choose a capable provider, require safeguards by contract and periodically assess the provider.³ The firm still controls who has accounts, whether MFA is on, what staff click on, and where downloaded files end up. The IRS's warnings to preparers focus on attacks against the firm's own email and login credentials, not the vendor's servers.³⁴

Should we tell every client to get an IP PIN?

Many offices do. Any person with an SSN or ITIN who can verify identity may get one, and it blocks e-filed returns under that number without the PIN.³⁷ It costs the client nothing but a few minutes, and the IRS gives it a full week in its 2026 summer series for tax professionals.³³

I am a financial planner. Is it the FTC rule or Regulation S-P?

If your advisory firm is registered with the SEC, Regulation S-P applies. If not, an "investment advisory company" is one of the FTC rule's examples of a financial institution.⁴⁶¹ If you also prepare tax returns, the IRS layer applies on top.

Hard questions

Is the Safeguards Rule too heavy for a three-person tax office?

The case that it is too heavy: the FTC itself delayed the 2021 requirements by six months because of a shortage of qualified security personnel and supply chain problems, which it said could make compliance hard for small institutions.¹⁸ A seasonal office with a few thousand dollars of margin cannot hire a security staff, and the rule's vocabulary (change management, penetration testing, continuous monitoring) was written for larger organizations. The money spent on documents might be better spent on a single strong control.

The case that it is not: the FTC already carved out the costliest items for firms under 5,000 consumers.⁴ What remains, such as MFA, encryption, training and a vendor list, is mostly configuration of tools the office already pays for. The data a tax office holds is exactly what identity thieves want, and the harm of a breach falls on clients who did nothing wrong. The IRS figure of nearly 200 reported tax professional incidents affecting up to 180,000 clients shows the risk is not theoretical.¹³

What the evidence shows: the record supports the narrow point the FTC made in TaxSlayer: MFA ended that attack.²⁵ There is no public evidence this research found of the FTC pursuing a small tax practice under the Safeguards Rule, so the practical pressure on small offices comes mostly from the IRS (PTIN attestation, e-file standards) and from the cost of an incident, not from FTC enforcement.

Should the IRS require proof of a written plan, not just a checkbox?

For proof: a self-attestation costs nothing to check falsely, and the IRS controls the PTIN and the e-file program. Requiring an uploaded plan, or spot-checking plans at renewal, would turn an acknowledgment into a real requirement.

Against: the IRS would have to review hundreds of thousands of documents with no clear standard for what passes, and a plan on paper is not the same as working controls. Preparers already face penalties under 7216 and 6713 for misuse, and the FTC enforces the rule itself. The checkbox educates and creates a record without building a new bureaucracy.

What the evidence shows: the form's wording has grown stronger since 2020, from "must have a data security plan" to "required by law to create and maintain a written information security plan," which suggests the IRS is moving toward firmer expectations without, so far, demanding proof.⁶³⁰ This research found no public data on how many preparers check "No."

Is 500 consumers the right threshold for FTC notice?

For a lower threshold: most tax offices are small, so a breach of 300 clients, which is a disaster for those families, never reaches the FTC. The agency then sees only the large incidents and has a distorted picture of where breaches happen.

For keeping 500: the FTC notice is not consumer notice; state laws already require clients to be told regardless of number. A lower threshold would add paperwork for small firms without helping any affected person directly. The IRS already hears about tax office incidents of any size through its own channels.²⁴

What the evidence shows: the 500 figure appears in the final rule and in the IRS's own guidance to preparers.³²⁴ Whether it leaves a blind spot depends on data the FTC has not published in a form this research found.

Should Idaho adopt the NAIC insurance data security model?

For adoption: insurance agencies hold the same kinds of data as tax offices, and the model would give Idaho's Department of Insurance a security standard and an incident reporting channel similar to what neighboring states use.

Against: small agencies already face the state breach notice law, carrier contract requirements and, often, the Safeguards Rule through other lines of business. Another set of rules adds compliance costs for small Idaho agencies without new protection for consumers who already get breach notices.

What the evidence shows: the 2025 bill got a do-pass recommendation from committee, then was held and returned to committee by unanimous consent on March 20, 2025.⁵⁰ This research found no 2026 Idaho bill with "data security" or "cybersecurity" in its title, and the NAIC chart still lists no Idaho adoption, so the question remains open.⁵¹

Where to go next

• IRS Publication 5708: Creating a Written Information Security Plan: Free IRS guide with a fill-in sample WISP and four sample attachments; for tax and accounting offices of any size. Download it, replace the bracketed items with your office's facts, and review it each year before filing season.
• IRS Publication 4557: Safeguarding Taxpayer Data: Free IRS security guide for tax professionals, with a plan checklist and the steps for reporting data loss; read the reporting section before an incident and put the contacts in your plan.
• FTC: Safeguards Rule, What Your Business Needs to Know: Free FTC plain-language guide to the rule's elements, written for small financial businesses; use it alongside the rule text when assigning each element an owner.
• IRS Data Theft Information for Tax Professionals: Free IRS page listing who to contact after data theft, with links to the state reporting page and the IRS liaison contacts by state; bookmark it and copy your state's contacts into the incident plan.
• IRS Taxes-Security-Together Checklist: Free five-item IRS checklist for tax offices (the Security Six, a data security plan, phishing, signs of data theft, recovery); good for a staff meeting before filing season.
• IRS: Get an Identity Protection PIN: Free IRS page explaining how clients get an IP PIN online, by Form 15227 or in person; share it with clients in your engagement packet.
• SEC Regulation S-P Small Entity Compliance Guide: Free SEC guide to the 2024 amendments for brokers, advisers and other covered institutions; read it if your firm or an affiliate is SEC-registered, or if you are a vendor to one.

Still being checked (8 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• No FTC Safeguards Rule enforcement action against a small CPA or tax practice was found; this is an absence of evidence from a limited search, not proof that none exists.
• The Safeguards Rule contains no dollar penalty; whether and how civil penalties could apply to a first violation is a question of FTC Act authority not settled by a primary source read for this lesson.
• The IRS figure of nearly 200 tax professional data incidents affecting up to 180,000 clients (IR-2024-180) is the only official count found; no year-by-year series was found.
• Whether the 26 U.S.C. 6713 penalty amounts are adjusted for inflation was not confirmed; the statute shows fixed amounts.
• No extension of the amended Regulation S-P compliance dates was found in the Federal Register or the sources read.
• The July 13, 2026 CMMC Phase 2 suspension is confirmed by the department's release (reposted on business.defense.gov); the details of which CMMC levels contracting officers may require during the suspension come from law firm summaries (Morgan Lewis and others), and the implementing memoranda were not read directly.
• The NAIC model law's 72-hour notice to the insurance commissioner was not re-read for this lesson.
• The photo alt text for the 1892 document cabinet illustration was written from the Wikimedia Commons title and description, not from viewing the image.

Last verified October 28, 2026. General education, not legal, ethics, accounting or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. 16 CFR 314.2, Definitions, including 314.2(b) (consumer), (d) (customer information), (e)(2)(i)(G) and (H) (customer relationship), (h)(2)(viii) and (xii) (examples of financial institutions), (h)(3)(iv) and (m) (notification event), Cornell LII mirror of the current eCFR text (read Oct. 28, 2026). Read it online. ↩
2. IRS, Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, Rev. 8-2024, Catalog Number 93462W, including the sample WISP template and Sample Attachments A to F (read Oct. 28, 2026). Read it online. ↩
3. 16 CFR 314.4, Elements, paragraphs (a) to (j), Cornell LII mirror of the current eCFR text; quoted phrases are the rule's words, other descriptions are summaries (read Oct. 28, 2026). Read it online. ↩
4. 16 CFR 314.6, Exceptions: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." [86 FR 70308, Dec. 9, 2021], Cornell LII (read Oct. 28, 2026). Read it online. ↩
5. Federal Trade Commission, "Standards for Safeguarding Customer Information," final rule, 88 FR 77499, November 13, 2023 (FR Doc. 2023-24412), effective May 13, 2024; includes the statement that the Commission "intends to enter notification event reports into a publicly available database" (read Oct. 28, 2026). Read it online. ↩
6. IRS, Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) Application and Renewal, Rev. 10-2026, line 11, Data Security Responsibilities (read Oct. 28, 2026). Read it online. ↩
7. IRS, Publication 1345, Handbook for Authorized IRS e-file Providers of Individual Income Tax Returns, Rev. 12-2025, Catalog Number 64382J, security, privacy and business standards, including incident reporting (read Oct. 28, 2026). Read it online. ↩
8. 26 U.S.C. 7216, Disclosure or use of information by preparers of returns, Cornell LII (read Oct. 28, 2026). Read it online. ↩
9. 26 U.S.C. 6713, Disclosure or use of information by preparers of returns (civil penalty), subsections (a) and (b), Cornell LII (read Oct. 28, 2026). Read it online. ↩
10. IDAPA 24.30.01, Idaho Accountancy Rules, current Idaho Administrative Code, including rules 002 (incorporation by reference), 201 (Confidential Client Information), 202 (Records) and 212.02 (peer review document retention) (read Oct. 28, 2026). Read it online. ↩
11. U.S. Securities and Exchange Commission, press release 2024-58, "SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information," May 16, 2024 (read Oct. 28, 2026). Read it online. ↩
12. Alexander B. Hastings, Daniel Funaro, Scott Whitman, Moshe Klein and Alison Tanchyk, Morgan Lewis, "Department of War Suspends CMMC Phase II Requirements, but Cybersecurity Obligations Remain," July 16, 2026 (secondary source describing the July 13, 2026 announcement; the department's memoranda were not read directly) (read Oct. 28, 2026). Read it online. ↩
13. IRS, IR-2024-180, "Tax pros continue to be targeted by identity thieves; IRS, Security Summit urge continued vigilance against evolving threats as special summer education series, Nationwide Tax Forums begin," July 2, 2024 (read Oct. 28, 2026). Read it online. ↩
14. 16 CFR Part 314, Standards for Safeguarding Customer Information, eCFR (page reported up to date as of Oct. 23, 2026), including 314.1(b) scope and the source note citing 67 FR 36493, May 23, 2002 (read Oct. 28, 2026). Read it online. ↩
15. IRS, Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, Rev. 6-2024, Catalog Number 48905Y (read Oct. 28, 2026). Read it online. ↩
16. Federal Trade Commission, "Standards for Safeguarding Customer Information," final rule, 86 FR 70272, December 9, 2021 (FR Doc. 2021-25736), effective January 10, 2022 (read Oct. 28, 2026). Read it online. ↩
17. Federal Trade Commission, "Standards for Safeguarding Customer Information," supplemental notice of proposed rulemaking, 86 FR 70062, December 9, 2021 (read Oct. 28, 2026). Read it online. ↩
18. Federal Trade Commission, "Standards for Safeguarding Customer Information," final rule; delay of effective date, 87 FR 71509, November 23, 2022 (FR Doc. 2022-25201), amending 16 CFR 314.5 to read "Sections 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3), (h), and (i) are effective as of June 9, 2023" (read Oct. 28, 2026). Read it online. ↩
19. Federal Trade Commission, Safeguards Rule page (rulemaking documents, the Nov. 15, 2022 extension announcement and the Oct. 27, 2023 breach reporting announcement) (read Oct. 28, 2026). Read it online. ↩
20. 16 CFR 314.5, Effective date: "Section 314.4(j) is effective as of May 13, 2024." [88 FR 77509], Cornell LII (read Oct. 28, 2026). Read it online. ↩
21. CISA, NSA, FBI and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One, October 2023 (phishing-resistant MFA and number matching) (read Oct. 28, 2026). Read it online. ↩
22. Idaho Code 28-51-104, Definitions (breach of the security of the system; personal information, which applies "when either the name or the data elements are not encrypted"; primary regulator) (read Oct. 28, 2026). Read it online. ↩
23. Idaho Code 28-51-105, Disclosure of breach of security of computerized personal information by an agency, individual or a commercial entity (read Oct. 28, 2026). Read it online. ↩
24. IRS, "Data Theft Information for Tax Professionals," page last reviewed March 26, 2026 (read Oct. 28, 2026). Read it online. ↩
25. Federal Trade Commission, press release, "Operator of Online Tax Preparation Service Agrees to Settle FTC Charges That It Violated Financial Privacy and Security Rules," August 29, 2017 (In re TaxSlayer, LLC; quotes of Tom Pahl, Acting Director, Bureau of Consumer Protection) (read Oct. 28, 2026). Read it online. ↩
26. Federal Trade Commission, press release, "FTC Gives Final Approval to Settlement with Online Tax Preparation Service," November 2017 (TaxSlayer final order) (read Oct. 28, 2026). Read it online. ↩
27. IRS, Publication 5293, Protect Your Clients; Protect Yourself: Data Security Resource Guide for Tax Professionals, 5-2018, Catalog Number 71256E (read Oct. 28, 2026). Read it online. ↩
28. IRS, Instructions for Form W-12, Revised October 2026, line 11 and the list of related publications (Publications 5708, 4557, 5709 and 5417; Publication 5709 is Rev. 5-2024 and Publication 5417 is Rev. 4-2023 on irs.gov) (read Oct. 28, 2026). Read it online. ↩
29. The IRS's official name for this office is "Stakeholder Liaison"; local Stakeholder Liaison contacts are listed by state on irs.gov and linked from the IRS data theft page. Publication 1345 (Rev. 12-2025) says EROs "must contact their local stakeholder liaison" (read Oct. 28, 2026). Read it online. ↩
30. IRS, Form W-12 (Rev. 10-2020), prior revision, line 11 wording "must have a data security plan"; the same wording appears in the Rev. 5-2021 and Rev. 10-2023 versions in the IRS prior-year forms archive (read Oct. 28, 2026). Read it online. ↩
31. 26 CFR 301.7216-3, Disclosure or use permitted only with the taxpayer's consent, Cornell LII (read Oct. 28, 2026). Read it online. ↩
32. 26 CFR 301.7216-2, Permissible disclosures or uses without consent of the taxpayer, paragraph (d), Cornell LII (read Oct. 28, 2026). Read it online. ↩
33. IRS, IR-2026-81, "IRS, Security Summit launch summer series to help tax pros protect clients from identity theft," July 7, 2026 (read Oct. 28, 2026). Read it online. ↩
34. IRS, Tax Tip 2024-06, "Tax professionals: Watch out for new client email scam," February 13, 2024 (read Oct. 28, 2026). Read it online. ↩
35. IRS, IR-2026-30, "Dirty Dozen tax scams for 2026: IRS reminds taxpayers to watch out for dangerous threats," March 5, 2026, item 11, "Spear-phishing and malware targeting tax professionals" (read Oct. 28, 2026). Read it online. ↩
36. IRS, "Tax Security 2.0: The Taxes-Security-Together Checklist," page last reviewed Oct. 9, 2026 (read Oct. 28, 2026). Read it online. ↩
37. IRS, "Get an Identity Protection PIN," page last reviewed Aug. 4, 2026 (read Oct. 28, 2026). Read it online. ↩
38. AICPA, Code of Professional Conduct, effective December 15, 2014, updated for all official releases through December 2023, ET 1.700.001 (Confidential Client Information Rule), 1.700.040 (Disclosing Information to a Third-Party Service Provider) and 1.150.040 (Use of a Third-Party Service Provider), copy hosted by the Minnesota Society of CPAs (read Oct. 28, 2026). Read it online. ↩
39. Mary L. Blatch, "AICPA's revised confidentiality rule and Sec. 7216," Journal of Accountancy, March 1, 2015 (read Oct. 28, 2026). Read it online. ↩
40. AICPA, "Sample client disclosure language for outsourcing rules," resource page dated May 13, 2013 (read Oct. 28, 2026). Read it online. ↩
41. AICPA, "2017 Trust Services Criteria (With Revised Points of Focus, 2022)," resource page posted Sept. 30, 2023 (described, not reproduced) (read Oct. 28, 2026). Read it online. ↩
42. AICPA, "SOC for Cybersecurity" resource page (described, not reproduced) (read Oct. 28, 2026). Read it online. ↩
43. Idaho Code Title 54, Chapter 2, Accountants, chapter index (read Oct. 28, 2026). Read it online. ↩
44. Idaho Code 9-203A, Confidential communications with accountants (read Oct. 28, 2026). Read it online. ↩
45. Securities and Exchange Commission, "Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information," final rule, Release No. 34-100155, 89 FR 47688, June 3, 2024 (FR Doc. 2024-11116), corrected at 89 FR 53487, June 27, 2024, effective Aug. 2, 2024; section II.F and Table 3 (compliance periods of 18 and 24 months after publication; larger-entity thresholds) (read Oct. 28, 2026). Read it online. ↩
46. Securities and Exchange Commission, "Regulation S-P: Small Entity Compliance Guide" (covered institutions; compliance dates Dec. 3, 2025 and June 3, 2026) (read Oct. 28, 2026). Read it online. ↩
47. Department of Defense, "Cybersecurity Maturity Model Certification (CMMC) Program," final rule, 32 CFR Part 170, 89 FR 83092, October 15, 2024, effective December 16, 2024 (read Oct. 28, 2026). Read it online. ↩
48. Department of Defense, "Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)," final rule, 90 FR 43560, September 10, 2025, effective November 10, 2025 (read Oct. 28, 2026). Read it online. ↩
49. 32 CFR 170.3, Applicability, paragraph (e) (phased implementation), Cornell LII; Phase 2 date computed from the rule text (read Oct. 28, 2026). Read it online. ↩
50. Idaho Legislature, 2025 House Bill 117, "Insurance Data Security Act," bill status page (introduced Feb. 4, 2025; returned to Business Committee by unanimous consent March 20, 2025) (read Oct. 28, 2026). Read it online. ↩
51. National Association of Insurance Commissioners, Insurance Data Security Model Law (#668) state adoption chart, Summer 2026, Idaho entry (related activity only) (read Oct. 28, 2026). Read it online. ↩
52. Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report, released April 2026, state tables (Idaho: 4,479 complaints; $88,725,284 in losses) (read Oct. 28, 2026). Read it online. ↩
53. IRS, Revenue Procedure 2013-14, section 1 (purpose: format and content of taxpayer consents for Form 1040 series filers under 26 CFR 301.7216-3; modifies and supersedes Rev. Proc. 2008-35) (read Oct. 28, 2026). Read it online. ↩
54. Department of War, "Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements," July 13, 2026, as reposted by the Office of Small Business Programs (read Oct. 28, 2026). Read it online. ↩