A written information security plan a 1 to 5 person tax practice will actually use

This page is general information, not legal advice. The FTC Safeguards Rule and IRS Publication 5708 are the texts to read. Have counsel review any plan before you treat it as the firm's plan. This page does not state penalties.

The FTC Safeguards Rule lists tax preparation firms as financial institutions. Covered firms must develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards designed to protect customer information. The program has to fit the size and complexity of the business, the nature and scope of the work, and the sensitivity of the information. (FTC Safeguards Rule: What Your Business Needs to Know)

IRS Publication 5708 is the Security Summit template for a tax and accounting practice. It says tax and accounting professionals are financial institutions under the Gramm-Leach-Bliley Act and the Safeguards Rule, regardless of size, and that a requirement of the Rule is implementing and maintaining a WISP. Publication 4557 says tax return preparers must create and enact security plans to protect client data, and points you to Publication 5708. Publication 5293 is the shorter data security resource list. (Publication 5708, Publication 4557, Publication 5293)

The FTC has exempted firms that maintain customer information concerning fewer than 5,000 consumers from certain provisions of the Rule. That is not a pass on writing a plan. Publication 5708 still tells every size of tax practice to keep a WISP. Read the FTC page for which provisions the exemption covers. (FTC Safeguards Rule: What Your Business Needs to Know)

The Rule requires a Qualified Individual to implement and supervise the program. That person can be an employee, or can work for an affiliate or a service provider. There is no required degree or title. If you hire a vendor to run it, you still designate a senior employee to supervise that vendor. Publication 5708 calls this person the Data Security Coordinator: the person tasked with the information security process. Put a name, not "IT." (FTC Safeguards Rule: What Your Business Needs to Know, Publication 5708)

• Write the coordinator's legal name and a backup.
• List authorized users, their access, and their duties. Publication 5708 has a sample attachment for employees authorized to access PII.
• The coordinator reports in writing at least annually to the board, or to a senior officer if you have no board.

You cannot write safeguards until you know what you hold and where it sits. The FTC says to inventory data, note where it is collected, stored, or transmitted, and keep a list of systems, devices, platforms, and personnel. Publication 5708 asks you to list types of information, potential areas for data loss, and each hardware item with the information it stores. (FTC Safeguards Rule: What Your Business Needs to Know, Publication 5708)

Publication 5708 also wants desktops, laptops, phones, removable drives, cloud storage, and USB sticks that hold PII on the hardware list. Set a rule that client PII does not live on a personal phone or home computer the firm does not control.

The Rule requires access controls you review, encryption of customer information on the system and in transit (or an equivalent control the Qualified Individual approved), and multi factor authentication for anyone accessing customer information on your system, unless the Qualified Individual approved a reasonably equivalent control in writing. MFA means at least two of: something you know, something you have, something you are. Publication 5708 repeats the MFA requirement. (FTC Safeguards Rule: What Your Business Needs to Know, Publication 5708)

Vendors: select service providers that can maintain appropriate safeguards, put the security expectations in the contract, and reassess them. Publication 5708 tells you to ensure the contract requires them to maintain safeguards and to oversee how they handle customer information.

• Turn MFA on for the portal, tax software, email, and the e-file / PTIN logins.
• Drop access the week someone leaves. Do not wait for a quarterly review.
• Name each vendor that can see client data: tax software, portal, IT, copier, shredding, offsite backup.
• A cleaning crew and a copier technician are on Publication 5708's acknowledgment list for a reason. They walk past paper.

The Rule requires a written incident response plan. It has to cover goals, internal processes, roles and decision authority, communications inside and outside the firm, how you fix weaknesses, how you document and report the event, and a review of what happened. Publication 5708 includes a sample security breach attachment and says to update it annually. (FTC Safeguards Rule: What Your Business Needs to Know, Publication 5708)

A Safeguards Rule notification event is a security breach involving unauthorized acquisition of unencrypted information of at least 500 consumers. Covered firms notify the FTC as soon as possible, and no later than 30 days after discovery, on the FTC's online form. Publication 5708 states the same 500 person / 30 day timing. Publication 4557 and Publication 5293 also tell tax professionals to report data loss to the IRS through the Stakeholder Liaison. Put those three contacts (FTC form, IRS liaison, your carrier) on one page the coordinator can find at 10 p.m. (FTC Safeguards Rule: What Your Business Needs to Know, Publication 4557)

Publication 5708 says a WISP is an evergreen document, and the sample template says to review and update at least annually. Do this in December or early January, before seasonal staff and a pile of W-2s land. Refresh employee and contractor acknowledgments after that meeting. (Publication 5708)

• Coordinator still employed here, with a named backup.
• Data inventory still matches the portal, tax software, email, paper, and vendors you use this season.
• MFA still on for every system that holds customer information, or a written equivalent approved by the coordinator.
• Access list: former staff and leftover vendor logins are gone.
• Vendor contracts still say they will safeguard customer information.
• Incident page still has current FTC, IRS, and carrier contacts.
• Signed acknowledgments collected after the annual walkthrough.
• Written report from the coordinator to the owner or board.

Download the data inventory. One row per system. Fill it before you rewrite Publication 5708's sample. The tax season operator can chase missing vendor answers and leftover access. Your staff approve what goes out. Your CPA reviews and signs every return.