A template in a folder isn't a security program
The IRS tells tax and accounting professionals they're required by law to have a Written Information Security Plan, and it publishes a sample to help. Many firms fill in the name, file it, and stop there.
The FTC's Safeguards Rule asks for more than the document: real controls, a named Qualified Individual and oversight of your vendors. The rule says an accountant or tax preparation service that completes income tax returns is a financial institution.
What the small-firm exception really does
16 CFR 314.6 removes four paragraphs for institutions holding customer information on fewer than 5,000 consumers. Everything else still applies.
| Requirement | Under 5,000 consumers |
|---|---|
| Written program, Qualified Individual, MFA, encryption | Still required |
| Access controls, secure disposal, logging, training, vendor oversight | Still required |
| FTC notice for events affecting 500 or more consumers | Still required |
| Risk assessment in the specific written form of 314.4(b)(1) | Exempt from that paragraph |
| Annual pen test and six-monthly scans | Exempt from that paragraph |
| Written incident response plan, and annual report to owners | Exempt from those paragraphs |
Three checks for this week
- ///Name your Qualified Individual in writing
They can be an outside provider, but then a senior person at your firm must oversee them.
- ///Turn on MFA everywhere, not only tax software
The rule covers anyone accessing any information system. Check email, your portal, remote access and cloud storage.
- ///Check your EFIN and PTIN counts weekly
IRS Publication 4557 advises comparing the IRS's count of returns filed with what you actually filed.
Tax season suits us. Your staff are rushed and they open every attachment. One phished login to your tax software or remote access could give us what we need to file false returns under your EFIN.
What's in the full PDF
- ///The full requirement-by-requirement exception table
- ///A checklist to compare your WISP with how your firm actually runs
- ///Fillable data map, vendor oversight and consumer count pages
- ///Data theft steps: IRS, states, FTC and who to call