Opens in a new tab
Office desk with files, laptop, and digital lock icon, representing data security and protection of financial and client information.

GLBA Compliance for CPA and Tax Firms: What the FTC Safeguards Rule Requires and the WISP That Documents It

By Jason Russell · October 28, 2026

Every fall, paid tax preparers renew their PTINs, and the renewal form asks a question that is really about GLBA compliance. As of October 2026, item 11 on Form W-12 reads: “I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.” You have to check yes or no.

Checking yes takes a second. Producing the plan when a client, an insurer, or a regulator asks for it takes longer. Renewal usually opens in mid to late October (last year it opened October 16, 2025), so this is a good month to check whether your plan exists and matches the rule.

This post covers why the rule reaches your firm even though you aren’t a bank, what it requires, what the small-firm exemption excuses, how IRS Publications 4557 and 5708 fit, what Florida adds, and a one-page checklist. I’m an IT and security person, not a lawyer or a CPA: this isn’t legal advice, and your firm’s attorney decides the legal questions.

Does GLBA only apply to banks?

No. The Gramm-Leach-Bliley Act (GLBA) is a 1999 federal law that, in the FTC’s words, requires financial institutions “to explain their information-sharing practices to their customers and to safeguard sensitive data.” The catch is how broadly it defines a financial institution.

The FTC’s guide to the Safeguards Rule lists tax preparation firms by name, and the rule’s definitions spell it out: “An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution” (16 CFR 314.2). The IRS agrees in Publication 5708: “tax and accounting professionals are considered financial institutions, regardless of size.”

One CPA wrinkle: federal law exempts licensed CPAs bound by state confidentiality rules from GLBA’s privacy notice requirement (15 U.S.C. 6803(d)). That exemption covers the notice. It says nothing about the Safeguards Rule.

Whose data counts

The rule protects information about consumers: individuals who get a financial service “primarily for personal, family, or household purposes.” Its examples of a customer relationship include someone who becomes your client for tax preparation. Your 1040 clients are squarely in.

A corporation isn’t a consumer, but the owners whose personal returns you prepare are. Florida’s breach law also covers electronic records pairing a name with a Social Security number, whether or not that person is your client. I’d protect every client file to the same standard.

What GLBA compliance requires under the FTC Safeguards Rule

The core requirement is an information security program “written in one or more readily accessible parts” and “appropriate to your size and complexity” (16 CFR Part 314). That written program is your WISP, or written information security plan. Here is what 16 CFR 314.4 says it must cover.

Someone in charge

You must designate a Qualified Individual to oversee, implement, and enforce the program. That person can work for your firm, an affiliate, or an outside service provider. If it’s an outside provider, you keep responsibility for compliance and must name a senior person at your firm to oversee them. As the FTC’s guide puts it, “the buck still stops with you.”

A risk assessment

The program has to rest on a risk assessment that identifies foreseeable internal and external risks to client data and judges whether your safeguards are enough. You repeat it periodically.

The safeguards

  • Access controls, so people see only the client data their jobs require.
  • An inventory of the data, people, devices, systems, and facilities involved.
  • Encryption of customer information at rest and in transit over external networks, or compensating controls your Qualified Individual approves where encryption isn’t feasible. In my experience, email is where this breaks down; see why encryption and DLP belong together.
  • Multi-factor authentication (MFA) “for any individual accessing any information system,” unless your Qualified Individual approves an equivalent or stronger control in writing. MFA has limits too, as I wrote in MFA Approved the Login. Someone Else Got In.
  • Secure disposal no later than two years after you last used the information to serve that client, unless you need it for business purposes, the law requires you to keep it, or targeted disposal isn’t feasible.
  • Change management procedures, plus monitoring and logging of what authorized users do.

Testing, training, and vendors

You must regularly test or monitor key controls. Staff need security awareness training updated for the risks you found; I took an honest look at whether employee cybersecurity training actually works. And you must oversee service providers: choose capable ones, require safeguards by contract, and assess them periodically. In my experience, that’s the duty that gets skipped, which is why I argue IT vendor management belongs with your IT provider.

Incidents and reporting

Firms at or above the 5,000-consumer line (more below) also need a written incident response plan and a written report from the Qualified Individual, at least yearly, to the board or equivalent governing body. Every covered firm must notify the FTC “as soon as possible, and no later than 30 days after discovery” of a notification event involving at least 500 consumers. That means unauthorized acquisition of unencrypted customer information, and unauthorized access is presumed to be acquisition unless you have reliable evidence otherwise. The requirement has applied since May 13, 2024, and the FTC warns: “Your report may be made public.”

The under-5,000-consumer exemption: what it does and doesn’t excuse

16 CFR 314.6 exempts firms that “maintain customer information concerning fewer than five thousand consumers” from four requirements. Everything else still applies.

Requirement 5,000+ consumers Under 5,000
Written program (WISP) and Qualified Individual Required Required
Risk assessment Required, detailed written format Required, without the detailed written format
MFA, encryption, access, logging, disposal Required Required
Training and vendor oversight Required Required
Penetration tests and scans, or continuous monitoring Required Exempt
Written incident response plan Required Exempt
Annual written report to leadership Required Exempt
FTC notice (500+ consumers) Required Required

For larger firms, the testing rule means continuous monitoring, or an annual penetration test (an authorized attempt to break in) plus vulnerability assessments at least every six months. Smaller firms still have to test or monitor key controls regularly.

Two cautions. First, count carefully. The rule defines a consumer as someone who “obtains or has obtained” a service from you, and the exemption turns on the information you maintain. On a plain reading, old client files still on your server count, not just this season’s returns. If you’re near 5,000, let your attorney decide.

Second, keep an incident plan anyway. The FTC notice still applies, Florida has its own deadlines, and the IRS recommends that tax professionals create a data theft response plan.

Where IRS Publications 4557 and 5708 fit

The W-12 points to both for “more information about your responsibilities.”

IRS Publication 4557, Safeguarding Taxpayer Data, is the plain-English guide. It explains the Safeguards Rule, warns that failing to create a security plan “may result in an FTC investigation,” and includes a checklist. It also says who to call after a data theft: your local IRS Stakeholder Liaison, the states where you prepare returns, law enforcement, and your insurer.

IRS Publication 5708 is what most people mean by “the IRS WISP template.” As of October 2026, the current version is the August 2024 revision, a 29-page sample plan from the Security Summit (the IRS, state tax agencies, and the tax industry). It says it isn’t meant to “serve as a substitute for developing your own plan.”

Take that seriously. Its sample MFA policy spells out MFA for remote logins; the rule requires it for any individual accessing any information system. I also couldn’t find penetration testing, a general change management procedure, or the Qualified Individual’s annual report anywhere in it. Penetration testing (or continuous monitoring) and the annual report apply only at 5,000 or more consumers, which fits a template written “particularly” for “smaller practices,” but change management applies to everyone. Fill in the template and stop there, and your plan can promise less than the rule requires.

Florida adds its own clock

Florida’s breach law, section 501.171, requires businesses to “take reasonable measures to protect and secure” electronic personal information. After a breach:

  • Affected Floridians generally get notice no later than 30 days after you determine a breach occurred or have reason to believe one did.
  • The Department of Legal Affairs gets notice within 30 days if 500 or more Floridians are affected.
  • Nationwide credit reporting agencies must be told if you notify more than 1,000 people at once.
  • A vendor contracted to maintain, store, or process personal information for you must report a breach of its system to you within 10 days.

Late notice carries civil penalties of $1,000 a day for the first 30 days, then $50,000 for each 30-day period after that, up to $500,000 per breach.

Encryption matters here too. Florida’s definition of personal information excludes encrypted data, and the FTC notice covers unencrypted information, which includes encrypted data whose key was accessed by an unauthorized person. Your attorney decides whether an incident triggers notice, but encryption is the control most likely to change the answer.

One incident can mean notices to clients, the FTC, and the state, plus calls to the IRS and your insurer, several on 30-day clocks. The 2026 filing season opened January 26. Write the plan now, not in February.

A one-page GLBA compliance checklist

Use this as the skeleton of your WISP. Parts marked “5,000+” are required only at 5,000 or more consumers, though I’d do most of them anyway.

  1. Name your Qualified Individual and, if that person is outside the firm, the partner who oversees them.
  2. Inventory client data: tax software, portal, document management, email, file shares, laptops, paper, and every vendor that touches it.
  3. Assess the risks: what could go wrong, how bad it would be, and what you’ll do about it (detailed written format at 5,000+).
  4. Limit access to what each role needs, and remove it the day someone leaves.
  5. Require MFA on email, tax software, the client portal, remote access, and every admin account.
  6. Encrypt laptops, servers, backups, and any email or file transfer carrying Social Security numbers.
  7. Log and review sign-ins and file access.
  8. Test controls regularly; at 5,000+, use continuous monitoring or an annual penetration test plus scans every six months.
  9. Train everyone at hire and yearly, with the signed acknowledgments Publication 5708 recommends.
  10. Write down how staff verify callers before releasing a return or changing bank details. Getting client information from staff under false pretenses is illegal pretexting; your procedure is what actually stops it.
  11. Manage vendors: a list, safeguards in each contract, and periodic reviews.
  12. Set retention rules. Preparers must keep a copy of each return, or a list of names and taxpayer ID numbers, for three years after the close of the return period. Dispose of the rest securely, within two years of last use unless an exception applies.
  13. Write the incident plan: who decides, who calls the IRS Stakeholder Liaison, your insurer, and your attorney, and who sends client, FTC, and Florida notices (written plan required at 5,000+).
  14. Review yearly: the Qualified Individual reports to the partners in writing (5,000+), and the WISP gets updated.

The honest tradeoffs

  • A WISP isn’t security. The rule says “develop, implement, and maintain.” If the plan says MFA everywhere and the front desk signs in with a password alone, the plan just documents the gap.
  • It costs time, and testing costs money. Partner time goes into the risk assessment, vendor reviews, and yearly updates; larger firms also pay for penetration tests and scans. In my experience, the software is rarely the expensive part. Setup and upkeep are.
  • There’s friction. MFA prompts, encrypted messages your clients have to open, portals clients would rather skip. Roll changes out after filing season, not during it.
  • No plan guarantees anything. A good program lowers the odds of a breach and limits the damage. It won’t prevent every incident, and no provider, including us, can guarantee you’re compliant.

Where I have a stake in this

Harmony sells managed cybersecurity in Orlando and across Central Florida. WISP upkeep (an annual review of your written plan) is included in our flat fee for CPA and tax firms: as of October 2026, $110 per user per month, which also covers managed security, backup and ransomware readiness, tax software vendor management, and quarterly vCIO (outsourced technology planning) reviews. So I benefit if you decide this is worth paying someone to handle.

There’s a less flattering reason this matters to us. The Safeguards Rule requires you to oversee your service providers, and in most small firms I’ve seen, the IT provider holds admin access to nearly everything. If that’s us, you’re supposed to be checking our work. If an outside provider ever serves as your Qualified Individual, responsibility still stays with you. Ask any IT provider, including us, to put its security practices in writing and say how fast it will report a breach. Under Florida law, a vendor that maintains, stores, or processes personal information for you gets 10 days.

Frequently asked questions

Does GLBA only apply to banks?

No. GLBA covers “financial institutions,” a category far broader than banks. The FTC’s Safeguards Rule names tax preparation firms, and its definitions say an accountant or tax preparation service that completes income tax returns is a financial institution. If your firm prepares returns, plan on the rule applying to you.

What are the three key rules of GLBA?

GLBA has three main parts: the Privacy Rule, which governs how you tell customers about your information-sharing practices; the Safeguards Rule, which requires a written information security program; and the pretexting provisions, which make it illegal to obtain customer information under false pretenses. Licensed CPAs bound by state confidentiality rules are exempt from the privacy notice requirement, but that exemption doesn’t reach the Safeguards Rule.

Is GLBA still in effect?

Yes. Congress passed GLBA in 1999, and the FTC has tightened the Safeguards Rule since. Many 2021 updates, including the Qualified Individual, written risk assessment, encryption, and MFA, had a compliance deadline of June 9, 2023, and the FTC breach notice requirement took effect May 13, 2024.

Who is a customer under GLBA?

Under the Safeguards Rule, a customer is a consumer with a continuing relationship with you, and a consumer is an individual who gets a financial product or service primarily for personal, family, or household purposes. The rule’s own examples include an individual who becomes your client to obtain tax preparation services. The rule also covers customer information that other financial institutions share with you.

Where to start

If you aren’t sure your WISP would hold up, or aren’t sure you have one, renewal season is a good time to find out. We’re happy to walk through your current plan against the rule and the checklist above, with no pressure and no obligation. You can see what’s included in our plan for CPA and accounting firms, and we provide IT support in Orlando and across Central Florida. Give us a call at (407) 720-6540 whenever you’re ready.

Sources

Our latest posts