EXPLAINER · UPDATED 2026
The FTC Safeguards Rule is a federal regulation (under the Gramm-Leach-Bliley Act) that requires "financial institutions" — a category that includes tax preparers, accountants, and bookkeepers — to develop, implement, and maintain a written information security program to protect customer data. In plain English: if you handle clients' financial information, you must have a documented security program with a named person in charge, a risk assessment, specific technical safeguards (like encryption and MFA), an incident response plan, and ongoing oversight. Updated requirements took full effect in June 2023. For tax firms, the WISP is the document that satisfies the Rule, and IRS Publication 4557 is the guidance for meeting it.
Why does the Safeguards Rule apply to accountants?
Under the Gramm-Leach-Bliley Act, "financial institutions" isn't limited to banks. The FTC interprets it to include businesses "significantly engaged" in providing financial products or services — which covers tax preparation, accounting, and bookkeeping firms that handle clients' financial data. If you prepare returns or manage financial records for clients, you're in scope, regardless of size.
The 9 required elements of a security program
The updated Safeguards Rule requires a written program built around these components:
| # | Element | What it requires |
|---|---|---|
| 1 | Designate a Qualified Individual | A named person to oversee and enforce the security program. |
| 2 | Risk assessment | Identify the foreseeable risks to customer information. It must be written at 5,000 or more consumers. |
| 3 | Implement safeguards | Access controls (least privilege), encryption at rest and in transit, MFA for anyone accessing customer information, secure disposal, change management, and activity monitoring/logging. |
| 4 | Test or monitor safeguards | Regularly verify the effectiveness of the controls you put in place. |
| 5 | Train staff | Security-awareness training for employees; keep security personnel current. |
| 6 | Oversee service providers | Vet vendors and require them by contract to maintain safeguards. |
| 7 | Keep the program current | Reassess and adjust as your business and risks change. |
| 8 | Incident response plan | A playbook for detecting and responding to a breach. It must be written at 5,000 or more consumers. |
| 9 | Report to leadership | The Qualified Individual reports in writing at least annually. Required at 5,000 or more consumers. |
A WISP that documents all nine is how a tax firm demonstrates compliance.
What are the penalties for non-compliance?
The FTC enforces the Rule mainly through consent orders that dictate your security program, with outside assessments every two years, for up to 20 years. The FTC cannot currently fine a first violation of the Rule (it asked Congress for that power in 2019), but each violation of an order can cost up to $53,088 (2025 figure). For tax firms, the IRS treats a Safeguards Rule violation by an e-file provider as a violation of Revenue Procedure 2007-40, which carries EFIN sanctions up to expulsion from e-file. Beyond that, the reputational damage of a breach — and the loss of client trust — is often the larger cost.
How a WISP satisfies the Safeguards Rule
The Safeguards Rule requires a written program. For tax and accounting firms, that written program is the WISP. A well-built WISP maps one-to-one to the nine elements above — designating the Qualified Individual, recording the risk assessment, specifying the safeguards, and documenting training, vendor oversight, incident response, and review. Keep it adopted and current, and you have your evidence of compliance in one place.
Frequently asked questions
Keep reading
Sources & official references
- FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
- IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
This guide is general information, not legal advice. Verify current penalty figures and requirements with primary FTC/IRS sources for your firm's specific obligations.