top of page
Search

FTC Safeguards Rule: Why Tax Preparers Can’t Afford Compliance Complacency in 2025

  • Writer: Tyler Bartley
    Tyler Bartley
  • May 31
  • 2 min read

The Brief

Regulators have pivoted from gentle reminders to hard‑hitting enforcement. The FTC’s expanded Safeguards Rule now layers breach‑notification mandates on top of prescriptive cybersecurity controls. Penalties are inflation‑indexed and punitive, up to $50,000 per violation per day at the corporate level and up to $11,000 for responsible individuals. Non‑compliance is no longer a rounding‑error risk; it’s an existential threat to small tax practices with thin margins.


CognITive Technology Services helps CPAs, EAs, and independent tax preparers operationalize compliance at a price point engineered for firms with fewer than 250 employees. Here’s what you need to know, and what you need to do, before the next filing season.


1. The Reality

  • Hard Deadline in the Rear‑View. All enhanced control requirements came due June 9, 2023; breach‑notification duties went live May 13, 2024. If you haven’t retrofitted your Written Information Security Program (WISP), you’re already out of compliance.

  • Escalating Penalties. The FTC adjusted civil penalties to $51,744 in 2024 and historically imposes up to $100,000 per violation in egregious cases. Directors and officers can be held personally liable - an emerging trend we expect to accelerate in 2025.

  • Mandatory Disclosure. Breaches must be reported to the FTC within 30 days. Think about the reputational fallout of your firm’s name on the public breach‑list.


2. Why Tax Practices Are in the Crosshairs

Tax preparers aggregate the richest set of personally identifiable information (PII) outside of healthcare—SSNs, income data, bank routing numbers, and dependent records. Attackers recognize that smaller firms often outsource IT or rely on a single managed service provider (MSP) with limited security oversight. The delta between data value and security maturity makes CPA firms prime targets.


3. Five Pillars 0f The Safeguards

  1. Appoint a Qualified Individual (QI). The Rule insists on clear accountability. Whether in‑house or fractional, your QI must have authority and budget to direct the program.

  2. Conduct a Data‑Driven Risk Assessment. Boilerplate checklists won’t cut it. Expect regulators to request evidence that risks were prioritized based on likelihood and impact.

  3. Develop & Maintain a Written Information Security Program (WISP). Use IRS Publication 5708 as a baseline, then layer in control mappings to NIST CSF 2.0 for future‑proofing.

  4. Deploy Continuous Monitoring & Incident Response. Annual vulnerability scans are yesterday’s playbook. Integrate 24×7 log analytics, EDR telemetry, and rehearse your Incident Response Plan quarterly.

  5. Vet and Monitor Service Providers. Your e‑file vendor, cloud bookkeeping tool, and outsourced IT partner are extensions of your threat surface. Contractual security clauses and annual attestation reviews are non‑negotiable.


4. Compliance as Competitive Advantage

Early adopters are already leveraging compliance posture in RFPs and client‑facing marketing. In a commoditized tax‑prep market, being able to prove adherence to GLBA and Safeguards Rule requirements differentiates your firm and commands premium pricing. Expect enterprise clients to mandate evidence of compliance during vendor onboarding by 2026.


The FTC isn’t waiting for you to “get around to it,” and neither will your clients once enforcement headlines hit the news cycle. Book a 30‑minute strategy call with us today to de‑risk your practice and bullet‑proof your reputation before the next tax season closes.

 
 
bottom of page