Determine why the requirement applies
The FTC Safeguards Rule applies to covered financial institutions under FTC jurisdiction, including tax preparation firms. The label "financial institution" can cover businesses that do not look like banks. Have a qualified adviser confirm how your services fit the rule rather than assuming the answer depends only on your company name. [S05]
Do not confuse employee count with the rule's limited small-institution exemptions. The FTC describes exemptions from certain provisions for institutions maintaining information on fewer than 5,000 consumers; this is not a wholesale exemption from having a security program. [S05]
Make the plan describe real work
A useful WISP should explain the information you protect, the systems and vendors involved, who is responsible, how risks are assessed, and which safeguards address them. It should describe access, employee training, incident handling, recovery, and oversight appropriate to the firm's actual operations.
The IRS provides resources and a sample plan, but copying a template does not establish that the safeguards exist. A statement that all users have a control should be backed by a current report and a process for handling exceptions. Assign an owner who can explain the evidence, not merely locate the PDF. [S06]
Include busy-season and vendor realities
Consider how temporary staff receive access, who approves remote work, where tax documents are stored, and what happens when a preparer leaves. Identify support responsibilities for tax applications, document management, portals, and third-party hosting. These are suggested scoping questions, not a universal list of required products.
Practice a realistic disruption: a partner loses a device, a suspicious message reaches payroll, or the primary application becomes unavailable near a deadline. Confirm who makes decisions and where staff find the response plan if normal systems cannot be used.
Use IT support without outsourcing accountability
An IT provider can help implement safeguards, collect records, and explain technical limitations. It does not automatically become the firm's compliance decision-maker. The FTC allows service-provider involvement while retaining responsibility with the covered institution. [S05]
Before publishing a statement that your firm is compliant, verify the legal scope, actual implementation, and supporting evidence. Blue Tree Technology® can discuss technical support for the plan; your firm's designated leader and qualified legal or compliance adviser should approve the obligations and representations. This article provides education, not a determination that a particular practice satisfies the law.
Verification sources
S05 FTC: Safeguards Rule - What Your Business Needs to Know
S06 IRS: Tax professionals need a Written Information Security Plan