FTC Safeguards Rule checklist, and how the WISP fits in
Published
The FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial businesses, such as tax preparers, mortgage brokers, auto dealers that arrange financing, and lenders, to run a written information security program. It has ten required elements, from naming a Qualified Individual to notifying the FTC of breaches affecting 500 or more people. For tax professionals, that written program is the WISP.
This is a practical summary for owners, not legal advice. Each item cites the section of the rule.
Who is covered
The FTC's own list includes mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors and financial advisors, tax preparation firms, non-federally insured credit unions, investment advisers that don't register with the SEC, and finders. Auto dealers that extend financing or leases are covered too; the FTC has a separate FAQ for them. The FTC is explicit that what matters is the activity, not the label on your business.
The 10-item checklist
| Element | What it means | Rule |
|---|---|---|
| Qualified Individual | Name one person responsible for the program. Can be an employee or an outside provider, but the responsibility stays with you. | 314.4(a) |
| Written risk assessment | Where customer information lives, what threatens it and how well current safeguards hold. Repeat periodically. | 314.4(b) |
| Safeguards | Access controls, data and system inventory, encryption at rest and in transit, MFA for anyone accessing customer information, secure disposal, change management, activity logging. | 314.4(c) |
| Testing | Continuous monitoring, or a yearly penetration test plus vulnerability scans every six months. | 314.4(d) |
| Training | Security awareness for all staff, and qualified people running the program. | 314.4(e) |
| Service providers | Choose capable vendors, require safeguards in the contract, and check on them periodically. | 314.4(f) |
| Keep it current | Adjust the program after tests, changes in the business or new risks. | 314.4(g) |
| Incident response plan | Written: goals, roles, communications, remediation, documentation and lessons learned. | 314.4(h) |
| Report to the board | The Qualified Individual reports in writing at least annually, to the board or a senior officer. | 314.4(i) |
| Notify the FTC | Unauthorized acquisition of unencrypted data of 500+ consumers: notify within 30 days of discovery. | 314.4(j) |
The small business exemption
If you hold customer information on fewer than 5,000 consumers, section 314.6 exempts you from four items: the written risk assessment, the testing requirement, the written incident response plan and the annual board report. Everything else still applies, including MFA, encryption, the Qualified Individual and the 30-day breach notice.
Tax preparers: the WISP
For tax and accounting firms, the IRS and its Security Summit partners turned the Safeguards Rule into a ready-made template:
- IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice: a fill-in WISP template with sample language for each section.
- IRS Publication 4557, Safeguarding Taxpayer Data: the guide behind it, with the Safeguards Rule obligations and a checklist.
Preparers also acknowledge having a written data security plan when they renew their PTIN, so “we'll write it later” isn't an option. Fill the template with what you actually do; a WISP that describes controls you don't have is worse than a short honest one.
Where to start this week
- Name your Qualified Individual and write it down.
- Turn on MFA for email, tax software, the client portal and anything else with customer data.
- Check that laptops and backups are encrypted.
- List your vendors (tax software, IT support, cloud storage, shredding) and check their contracts mention security.
- Fill in the WISP template, or your own version, and put the FTC breach-notice link in it.
The rest of the controls, with costs per user, are in our small business security checklist. Firms licensed in New York may also fall under 23 NYCRR 500.
Sources: FTC, “FTC Safeguards Rule: What Your Business Needs to Know” · 16 CFR §314.4 and §314.6 · IRS Pub 5708 · IRS Pub 4557. Summary as of October 2026; not legal advice.
Questions people ask
Who has to comply with the FTC Safeguards Rule?
Non-bank financial institutions under the FTC's jurisdiction: tax preparation firms, mortgage lenders and brokers, payday lenders, finance companies, collection agencies, check cashers, credit counselors, investment advisers not registered with the SEC, auto dealers that arrange financing or leases, and finders. What matters is the activity, not what you call your business.
What is a WISP?
A written information security plan: the document that describes your security program. For tax preparers, the IRS publishes a template in Publication 5708, and preparers acknowledge having a data security plan when renewing their PTIN.
Is there an exemption for small businesses?
Partly. With customer information on fewer than 5,000 consumers, you're exempt from the written risk assessment, the required testing, the written incident response plan and the annual report to the board. You still need a qualified individual, safeguards like MFA and encryption, training, vendor oversight and the breach notice.
When do I have to notify the FTC of a breach?
When unencrypted information of at least 500 consumers is acquired without authorization, notify the FTC as soon as possible and no later than 30 days after discovery, through the FTC's online form. This requirement took effect May 13, 2024.