COMPLIANCE RISK · UPDATED 2026
If you're a paid tax preparer without a Written Information Security Plan, you're out of compliance with the FTC Safeguards Rule, and short of what IRS Publication 4557 recommends — and the consequences are real: an FTC consent order that can run 20 years, e-file (EFIN) sanctions under Revenue Procedure 2007-40, and steep breach-response costs and lost client trust if data is stolen. The good news: it's fixable quickly.
The consequences, from most to least obvious
| Consequence | What it means for your firm |
|---|---|
| FTC enforcement | The FTC enforces the Safeguards Rule through consent orders that dictate your security program for up to 20 years. It cannot currently fine a first violation, but each violation of an order can cost up to $53,088 (2025). |
| EFIN sanctions — you can't e-file | The IRS treats a Safeguards Rule violation by an e-file provider as a violation of Revenue Procedure 2007-40. Its sanctions run from a written reprimand to suspension or expulsion from e-file, halting electronic returns during the season that matters most. |
| PTIN and professional standing | A breach tied to inadequate safeguards can jeopardize your standing as a preparer and trigger additional scrutiny. |
| Breach costs and liability | Without a documented, followed plan, a breach is far more expensive: notification costs, remediation, potential lawsuits, and lost client trust. A current WISP is evidence of due diligence. |
| Insurance problems | Cyber-insurers increasingly require a WISP. No plan can mean no coverage — or a denied claim. |
Why "I'm too small to be a target" is the wrong assumption
There's no small-firm exemption from the written plan (16 CFR 314.6 excuses firms under 5,000 consumers from only four specific provisions). Solo and small practices are, if anything, more targeted precisely because attackers expect weaker defenses — and the WISP requirement applies to every paid preparer who handles client data, from national firms to a one-person home office.
The fix is faster than the risk
You don't need a breach scare to act. A compliant WISP takes minutes with a guided tool:
- Designate your Security Coordinator.
- Complete a risk assessment.
- Generate the eight required policy sections for your firm.
- Adopt it (sign) and train staff.
- Set the annual review.
Frequently asked questions
Keep reading
Sources
- FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
- IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
This guide is general information, not legal advice. Verify penalty and enforcement details with primary FTC/IRS sources.