FTC Safeguards Rule checklist for tax preparers this filing season

Does the FTC Safeguards Rule apply to my tax practice?

Yes, if you prepare income tax returns. The rule's definition of a financial institution, at 16 CFR 314.2(h)(2)(viii), includes an accountant or other tax preparation service in the business of completing income tax returns. The IRS repeated the point in IR-2026-92 on August 18, 2026: "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." For how that plan shows up on your PTIN renewal, see our note on the PTIN data security question.

Firm size changes part of the list. Under 16 CFR 314.6, a firm that maintains customer information on fewer than 5,000 consumers is exempt from four requirements: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the annual written report to the board. Every other element applies at any size. The checklist below follows 16 CFR 314.4 and notes where busy season raises the stakes.

What belongs on an FTC Safeguards Rule checklist before filing season?

Before filing season, the checklist starts with ownership, risk and access, because these items are the hardest to fix once returns start moving.

• Qualified Individual, 314.4(a): name the person who oversees and implements the program. If that is an outside provider, a senior member of your firm must oversee the provider, and the firm remains responsible for compliance.
• Risk assessment, 314.4(b): update it for anything new since last season, such as new tax software, a new client portal, remote staff or AI tools. Firms with information on 5,000 or more consumers must keep it in writing.
• Access controls, 314.4(c)(1): each person gets access only to the client data needed for their work. Remove access for anyone who left after last season.
• Inventory, 314.4(c)(2): list the data, people, devices, systems and facilities that handle taxpayer information, including any personal computers used for client work.
• Encryption, 314.4(c)(3): encrypt customer information at rest and in transit over external networks. Where that is infeasible, the Qualified Individual must review and approve compensating controls.
• Multifactor authentication, 314.4(c)(5): required for any individual accessing any information system. In IR-2026-106, the IRS stated that "the MFA requirement applies to tax preparation firms regardless of size" and urged firms to enable it "in tax software, cloud storage, email, and other services containing sensitive client information."

What changes when seasonal staff arrive?

User counts, device counts and risk all rise at once, so training, accounts and logging move to the top of the list.

• Training, 314.4(e): security awareness training "updated as necessary to reflect risks identified by the risk assessment." Seasonal staff should complete it before they open a return.
• Individual accounts: IR-2026-106 tells firms to "use individual accounts and never share usernames or passwords." A shared login defeats both multifactor authentication and activity logging.
• Logging, 314.4(c)(8): monitor and log the activity of authorized users and detect unauthorized access, use or tampering. Confirm logging is on for tax software, email and the client portal.
• Offboarding: set an end date for every seasonal account when you create it, and confirm removal after the season.

Which vendors need a look before January?

Every provider that touches client data: tax software, the client portal, e-signature, cloud storage, backup and your IT provider. 314.4(f) requires selecting providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing each provider based on its risk.

• Confirm the safeguards language exists in each contract and keep a copy with your written information security plan.
• Confirm multifactor authentication is switched on and enforced in each vendor platform.
• Record how and how fast each vendor will tell you about a security event on its side.

What if something goes wrong mid-season?

Follow the incident response plan and work two reporting tracks at once. Firms with information on 5,000 or more consumers need a written plan under 314.4(h) that covers goals, internal processes, roles and decision authority, communications, remediation, documentation and post-incident revision.

The FTC track: under 314.4(j), a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery, using the electronic form on the FTC's website. An event counts as discovered on the first day any employee, officer or agent of the firm knows of it, other than the person who committed it.

The IRS track: the IRS data theft guidance for tax professionals says to report client data theft to your local IRS Stakeholder Liaison, because "speed is critical" to stopping fraudulent returns. The same page lists state tax agencies, state attorneys general, the FBI, local police, your insurer and affected clients.

• Put your area's Stakeholder Liaison contact in the plan now.
• Decide in advance who has authority to call the insurer, the IRS and outside counsel.

What should you do this quarter?

Spread the work across the months before filing season so nothing lands in January.

• October and November: confirm the Qualified Individual, update the risk assessment and inventory, and remove stale accounts.
• November: if you hold information on 5,000 or more consumers and lack continuous monitoring, schedule the annual penetration test and confirm vulnerability assessments run at least every six months under 314.4(d)(2).
• December: check vendor contracts, audit multifactor authentication enforcement and set up seasonal accounts as individual, time-limited logins.
• January: train every staff member, test a backup restore, and confirm logging on the core systems.
• After the season: remove seasonal access, review the program under 314.4(g), and, at 5,000 or more consumers, deliver the Qualified Individual's annual written report.

Disposal belongs on the post-season list too. 314.4(c)(6) requires disposing of customer information no later than two years after it was last used for the client, unless it is needed for business operations, legal reasons, or targeted disposal is not feasible. Check that against your record retention obligations before deleting anything.

How does s90 help?

s90 runs the technical controls this checklist depends on for tax and accounting firms: multifactor authentication and individual accounts across tax software, email and portals, encryption on every device, centralized logging, vulnerability scanning, and fast onboarding and offboarding of seasonal staff. We also keep the evidence your Qualified Individual needs for the annual review. If you want to work through this list before January, we are happy to start with your current plan.