The IRS WISP deadline passed on June 9, 2023, which is the date the FTC’s updated Safeguards Rule took effect for tax preparers and every other covered financial institution.1Federal Trade Commission. FTC Extends Deadline by Six Months for Compliance with Some Changes to Financial Data Security Rule If your firm handles client tax data and you don’t have a functioning Written Information Security Plan today, you’re already out of compliance. There is no upcoming deadline to wait for. The practical move is to build the plan now, document when you did it, and treat every day without one as ongoing exposure to FTC civil penalties, IRS criminal and civil liability under Sections 7216 and 6713, and possible loss of your Electronic Filing Identification Number.
Who the Requirement Covers
The Gramm-Leach-Bliley Act classifies tax preparers as financial institutions, which puts them under the same data-protection framework that governs banks and investment advisors.2Internal Revenue Service. Publication 5708 – Creating a Written Information Security Plan for Your Tax and Accounting Practice The FTC enforces this through the Safeguards Rule at 16 CFR Part 314, which requires every covered institution to develop, implement, and maintain a written information security program.3Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know If you prepare federal tax returns, you’re covered. Solo practitioners, seasonal preparers, and large CPA firms all fall under the same mandate.
Layered on top of that is Internal Revenue Code Section 7216, which makes it a crime to knowingly or recklessly disclose tax return information without authorization.4Office of the Law Revision Counsel. 26 U.S.C. 7216 – Disclosure or Use of Information by Preparers of Returns Section 7216 doesn’t name a WISP, but a firm that gets breached because it never implemented basic security controls has a much harder time arguing the disclosure wasn’t reckless. The WISP is the evidence that you took the duty to protect client data seriously.
What the Plan Must Contain
The Safeguards Rule spells out specific elements. Writing a policy document and filing it away doesn’t count. Each piece has to be operational.
A Designated Qualified Individual
Your firm must designate a Qualified Individual responsible for overseeing and enforcing the security program.5eCFR. 16 CFR 314.4 – Elements This can be an employee or an outside service provider. If you outsource the role, you keep ultimate responsibility for compliance and must designate a senior employee to oversee the external person. In small practices, the firm owner often takes it on personally, but the person needs enough technical knowledge to make meaningful decisions about security controls.
A Written Risk Assessment
The foundation of the plan is a written risk assessment that identifies foreseeable threats to client data and evaluates whether your current safeguards actually address them.5eCFR. 16 CFR 314.4 – Elements It has to include criteria for categorizing the risks you face, an evaluation of your information systems, and a description of how each risk will be mitigated or accepted. Treat it as an honest inventory. Where does client data live? Who can reach it? What happens if a laptop is stolen or an employee clicks a phishing link?
Access Controls, Encryption, and Multi-Factor Authentication
Three technical requirements trip up smaller firms most often. Access to client data must be limited so each employee can only reach the information they need for their work. All client data must be encrypted both when stored and when transmitted over external networks.5eCFR. 16 CFR 314.4 – Elements Multi-factor authentication is required for anyone accessing your information systems. Your Qualified Individual can approve an alternative control that provides equivalent or better security, but that approval has to be documented in writing.
If your tax software login still uses just a password, or if you email unencrypted client documents, you have a compliance gap right now.
What Small Firms Are and Aren’t Exempt From
Firms that maintain records on fewer than 5,000 consumers get relief from four specific provisions of the Safeguards Rule.6eCFR. 16 CFR 314.6 – Exceptions Those cover the written risk assessment format, the required penetration testing and vulnerability scans, the written report to the board, and the Qualified Individual’s periodic reporting obligation. Most solo and small-firm preparers fall into this bracket.
What the exemption does not remove matters more than what it does. Smaller firms still need a WISP. They still must designate a Qualified Individual. They still must implement encryption, multi-factor authentication, and access controls. They still must conduct a risk assessment, even if the format doesn’t have to meet the detailed written criteria imposed on larger firms. The 5,000-consumer threshold trims paperwork and testing burdens, not the core security duties.
Keeping the Plan Alive After You Write It
A WISP that hasn’t been touched since 2023 is already out of compliance. The Safeguards Rule requires periodic reassessment whenever your operations change, new threats emerge, or testing reveals a gap.3Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know The regulation doesn’t set a fixed annual date, but most firms use the start of tax season as a natural trigger for a full review.
Firms with records on 5,000 or more consumers face a specific testing mandate: annual penetration testing and vulnerability assessments at least every six months, unless they’ve implemented continuous monitoring.3Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know Additional testing is required whenever material changes could affect security posture.
Everyone who touches client data needs security awareness training, and that training has to be refreshed regularly. The most common breach vector for tax offices isn’t a sophisticated hack. It’s an employee opening a phishing email or reusing a weak password. Document every training session, including dates, topics, and attendees.
The plan itself needs to be updated to reflect changes in technology, staffing, office locations, and how you store or transmit data. Switch tax software, add a remote worker, start using a cloud service, and those changes should appear in the plan.5eCFR. 16 CFR 314.4 – Elements
If Client Data Is Compromised
A separate FTC breach notification requirement took effect in May 2024. Financial institutions must report any breach involving 500 or more consumers within 30 days of discovery.7Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect The rule defines a triggering event as unauthorized acquisition of unencrypted customer information, including cases where an encryption key itself was compromised.
The IRS expects tax professionals to report data theft to their local IRS Stakeholder Liaison as quickly as possible.8Internal Revenue Service. Data Theft Information for Tax Professionals The Stakeholder Liaison then notifies IRS Criminal Investigation and other divisions on your behalf. Speed matters because the IRS can move to block fraudulent returns filed with your clients’ stolen information, but only if the notification arrives before those returns hit the system. Third-party theft reports have to go through the Stakeholder Liaison, not the general IRS phone line.
Most states have their own breach notification laws requiring you to notify affected individuals within a set timeframe. A single breach can trigger reporting to the FTC, the IRS, a state attorney general, and every affected client.
Penalties for Skipping the Requirement
The FTC can impose civil penalties exceeding $50,000 per violation of the Safeguards Rule, with inflation adjustments pushing that figure higher each year. Enforcement actions often result in consent orders requiring specific remedial measures and years of outside monitoring. For a small practice, the monitoring costs alone can outweigh the fine.
Under Section 7216, knowingly or recklessly disclosing client tax information without authorization is a misdemeanor carrying up to one year in prison and a fine of up to $1,000 per violation.4Office of the Law Revision Counsel. 26 U.S.C. 7216 – Disclosure or Use of Information by Preparers of Returns When the disclosure is connected to identity theft, the maximum fine jumps to $100,000 per violation. That identity-theft escalator is what gives Section 7216 real weight in a breach scenario, because stolen tax data is almost always used for identity fraud.
Section 6713 adds a $250 civil penalty for each unauthorized disclosure or use of tax return information, capped at $10,000 per calendar year.9Office of the Law Revision Counsel. 26 U.S.C. 6713 – Disclosure or Use of Information by Preparers of Returns When identity theft is involved, those amounts rise to $1,000 per disclosure with a $50,000 annual cap. A single breach affecting hundreds of clients can reach the cap almost immediately.
The IRS can also deny or sanction authorized e-file providers, including suspending or revoking a firm’s EFIN.10Internal Revenue Service. e-file Cases For most modern practices, losing the ability to e-file effectively shuts down the business.
Building a Plan Now
If you’re starting from scratch, IRS Publication 5708 was written specifically to help smaller practices build a WISP.2Internal Revenue Service. Publication 5708 – Creating a Written Information Security Plan for Your Tax and Accounting Practice It walks through each required element and includes sample language. Don’t treat it as a fill-in-the-blank template. A plan that reads like a generic document you downloaded and signed won’t hold up if the FTC comes knocking. It has to reflect your actual office setup, your actual technology, and your actual risks.
Start with the risk assessment. Catalog every place client data exists: your tax software, your email, paper files in the office, a backup drive, your laptop at home. For each location, ask what could go wrong and what’s currently preventing it. Then designate your Qualified Individual, turn on MFA everywhere you can, confirm your data is encrypted, and restrict who has access to what. Document all of it. Firms that get into trouble usually aren’t the ones that missed an obscure technical requirement. They’re the ones that never started, or wrote a plan they never followed. A straightforward, honest WISP that you actually maintain is worth far more than a polished document sitting in a drawer.