The FTC Safeguards Rule for tax and accounting firms
The Safeguards Rule, 16 CFR Part 314, is the federal rule behind the WISP requirement. Here is what it asks for, which parts small firms can skip, and which IT controls satisfy each element.
The nine elements, in plain English
Section 314.4 lists what an information security program must include. The right column shows the IT work that usually satisfies the technical side.
| Element | What it asks | IT that supports it |
|---|---|---|
| 314.4(a) | Name a Qualified Individual to oversee the program | Clear ownership; your IT provider can support but you stay responsible |
| 314.4(b) | Write a risk assessment | Asset inventory, network review, findings report |
| 314.4(c) | Put safeguards in place: access control, encryption, MFA, secure disposal, change management, logging | MFA, BitLocker, EDR, firewall, offboarding checklist, retention policy |
| 314.4(d) | Test or monitor the safeguards | Continuous monitoring, or annual penetration test and vulnerability scans every six months |
| 314.4(e) | Train your staff | Security awareness training and phishing simulations |
| 314.4(f) | Oversee service providers | Vendor list, contracts, security questionnaires |
| 314.4(g) | Keep the program current | Quarterly reviews and change logs |
| 314.4(h) | Write an incident response plan | Documented response steps, contacts and backups you can restore |
| 314.4(i) | Report to the board or owners at least yearly | An annual written summary of the program |
The small firm exemption
Under section 314.6, firms that maintain customer information on fewer than 5,000 consumers do not have to meet 314.4(b)(1) (a written risk assessment), 314.4(d)(2) (continuous monitoring or penetration testing), 314.4(h) (a written incident response plan) or 314.4(i) (the annual report). Most of the rule still applies, including MFA, encryption, training and vendor oversight.
Many small firms choose to do the exempt items anyway, because insurers and clients ask for them and they cost little once the rest is in place.
FTC notification
Since May 2024, firms must notify the FTC within 30 days of discovering a notification event involving unencrypted information of at least 500 consumers. Encryption is the single best way to keep a lost laptop from becoming a reportable event.
This page is a summary and is not legal advice. Read 16 CFR Part 314 and the FTC's guidance for the full requirements.
Sunesis Services builds, runs and proves your WISP
Help Desk NW runs the technology. Our sister firm Sunesis Services writes and maintains the Written Information Security Plan the IRS and the FTC require, with a fixed-price WISP and Security Six Diagnostic.
Start with a conversation, not a contract
A 20 minute call to hear how your firm runs today. If we are not the right fit, we will tell you, and point you to who is.