Home / Accounting & Tax Firms
For accounting & tax firmsYour firm is required to have a written data-security plan. Is yours in place?
Your data-security program may not be compliant — ABR helps identify gaps and implement agreed safeguards.
Under the FTC Safeguards Rule, tax and accounting firms that prepare returns or give financial advice are treated as “financial institutions” — required to have a written information security plan (WISP) and specific safeguards. ABR writes the plan and runs the security that supports it.
Per the FTC Safeguards Rule (16 CFR Part 314) · IRS Publications 4557 & 5708
Build a security program your firm can maintain
Most small firms don't realize it: the FTC Safeguards Rule (under the Gramm-Leach-Bliley Act) treats tax and accounting firms as “financial institutions” — regardless of size. If your firm prepares returns or provides financial advice, you're required to have a written information security plan (WISP) and specific safeguards in place.
This isn't coming — it's here. The core requirements have been enforceable since June 2023, and since May 2024 a separate rule requires reporting a breach affecting 500 or more people to the FTC within 30 days.
The IRS is blunt about it: failing to have a written security plan “may result in an FTC investigation.”
What a compliant program actually requires
Review the applicable program requirements with your advisers. Some provisions have limited exemptions; this list introduces safeguards to discuss, not a complete compliance checklist:
A written security plan (WISP)
A documented program of administrative, technical, and physical safeguards — written, accessible, and kept current.
A designated Qualified Individual
One person accountable for the security program. This role can be outsourced.
A written risk assessment
Identify where client data lives and the risks to it.
Multi-factor authentication
MFA for anyone accessing systems with client data — with limited written exceptions.
Encryption
Client data encrypted at rest and in transit — with limited written exceptions.
Monitoring, testing & logging
Continuous monitoring — or annual penetration testing plus vulnerability scans every six months.
A written incident-response plan
A documented plan for when something goes wrong, plus 30-day FTC breach reporting.
Vendor oversight & staff training
Hold your service providers to the same standard, and train your team to spot threats.
How ABR supports your security program
Most providers sell you either the plan or the tools. We do both — the written WISP and the managed security that supports its implementation, under one roof.
We write & maintain your WISP
A real, firm-specific plan built to the FTC/IRS structure — and kept current as the rules change.
We serve as your Qualified Individual
Qualified Individual support can be scoped with your firm. Your firm retains oversight and responsibility for its obligations.
Managed endpoint protection (MDR)
24/7 MDR monitoring by a dedicated security team for the devices covered by your agreement.
Network security & hardening review
Firewalls, segmentation, and a hardening review to identify and prioritize gaps.
MFA & encryption, deployed for you
The two controls the rule names most — rolled out across your systems and email.
Monitoring, logging & incident response
Monitoring, audit logs and response planning within the agreed scope. Reporting responsibilities should be agreed with your firm and advisers.
Vendor oversight, training & backups
Service-provider review, staff security-awareness training, and recoverable backups.
One partner for the plan and the protection
Compliance isn't a document you file and forget — it's controls that have to actually run. ABR supports written security planning and agreed technical safeguards. This assistance is not a compliance certification or guarantee; your firm remains responsible for its obligations.
- The written WISP + your Qualified Individual
- Managed security aligned with your agreed safeguards
- Kept current as the rules change
- One partner, one bill — no finger-pointing
While we're in there — your phones, too
If your firm is also running an aging phone system, we can review it alongside your security needs. Our business phone service keeps your team reachable through tax season and from anywhere, with the same one-partner simplicity. Lines from $24.95/mo.
Common questions
Is my firm really covered? We're small.
Yes — the FTC Safeguards Rule applies to tax and accounting firms that prepare returns or provide financial advice, regardless of size. Coverage attaches to that work, not to the “CPA” title. (A firm doing only audit/attest work with no tax or financial-advisory services may fall outside it.)
What exactly is a WISP?
A Written Information Security Plan — a documented program of administrative, technical, and physical safeguards required by the FTC Safeguards Rule (16 CFR 314.3). The IRS publishes a fill-in template (Publication 5708). It must be written, maintained, and actually implemented — not just filed away.
What's the deadline?
The core requirements have been enforceable since June 9, 2023. Since May 13, 2024, a separate rule requires reporting a breach affecting 500 or more people to the FTC within 30 days. In short: the deadlines have already passed.
What happens if we don't comply?
Non-compliance is enforceable by the FTC. The IRS states plainly that failing to have a written security plan “may result in an FTC investigation,” and the FTC has acted against firms that had no written program in place.
Do you write the plan, or just sell security tools?
Both. We write and maintain your WISP and can serve as your Qualified Individual, and we run the managed security that supports it — one partner for the plan and the protection.
Sources: FTC Safeguards Rule (16 CFR Part 314) · IRS Pub 4557 — Safeguarding Taxpayer Data · IRS Pub 5708 — WISP template
One Partner … Total Peace of Mind™
See where your firm stands — free.
We'll review your current setup against the FTC Safeguards Rule and show you exactly what's in place and what's missing. No pressure, no jargon. Serving accounting firms across Chicago's northwest suburbs and nationwide.
Free Safeguards Rule analysis →