IRS Publication 4557 & FTC Safeguards Rule for CPA Firms: What You Actually Have to Do in 2026

Many CPA firm owners in 2026 have heard of the FTC Safeguards Rule, have downloaded the IRS sample WISP at some point, and have a folder somewhere they would describe as their information security program.

Far fewer can produce, on demand, the documentation a Stakeholder Liaison, FTC investigator, state attorney general, or cyber-insurance underwriter would accept as evidence of a current, working program.

That is not a moral failure. It is structural. The CPA cybersecurity obligation in 2026 is not a single rule.

It is a four-layer stack — IRS guidance, FTC regulation, AICPA professional standards, and state law — and almost nothing in the day-to-day life of a tax practice surfaces the whole picture in one place.

This guide walks through what each layer requires, where firms most consistently fall short, and what a defensible 90-day path looks like.

A note up front: we operate the technical safeguards side. We are not your Qualified Individual under § 314.4(a) — that role lives inside the firm. We are not a CPA firm and we do not opine on AICPA SSTS interpretation.

The direct answer

CPA firms in 2026 have to satisfy four overlapping regimes at once:

• IRS Publication 4557 and 5708 for the Written Information Security Plan
• The FTC Safeguards Rule at 16 CFR Part 314 for the named controls
• AICPA SSTS § 1.3 for the professional-standards duty
• The state laws where the firm serves clients

There is no employee-count exemption. The Safeguards Rule specifically requires:

• A designated Qualified Individual
• MFA on any system with customer information
• Encryption at rest and in transit
• An incident response plan
• An annual report to firm leadership

The program that satisfies the strongest layer usually satisfies the others; very few firms have built that program.

The four-layer compliance stack

Every CPA firm preparing returns or providing tax services in the United States is subject to all four of these regimes simultaneously. They overlap. They do not replace each other.

1. IRS regulatory expectations — Publication 4557, Publication 5708, and IRC § 7216
2. FTC Safeguards Rule — 16 CFR Part 314, as amended in 2023
3. AICPA professional standards — Statement on Standards for Tax Services § 1.3, effective January 1, 2024
4. State law — NY DFS 23 NYCRR 500, CT Public Act 21-119, MA 201 CMR 17.00, CA CCPA/CPRA, and the 50-state breach-notification patchwork

Many firms are partially aware of layer 1, vaguely aware of layer 2, surprised by layer 3, and unaware of which parts of layer 4 apply to them. The technical program that satisfies the strongest layer tends to satisfy the others. Very few firms have built that program.

Layer 1: IRS Publication 4557, Publication 5708, and IRC § 7216

Publication 4557, "Safeguarding Taxpayer Data," is the umbrella document. It has required every paid preparer with a PTIN to maintain a Written Information Security Plan since 2008 and cross-references the FTC Safeguards Rule.

It is IRS guidance rather than regulation, but the Return Preparer Office treats it as an operating expectation, and a current WISP is the first thing an IRS Stakeholder Liaison asks about after a suspected data theft.

Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice" (2022) is the operational companion — a sample WISP and a fillable template. Two failure modes: firms that never downloaded it, and firms that filled in their letterhead once and never touched it again.

IRC § 7216 makes unauthorized disclosure or use of taxpayer return information a federal misdemeanor, with civil penalties under IRC § 6713 — the hook that turns sloppy data handling into a federal exposure for the preparer personally.

IRS Stakeholder Liaison reporting. The IRS expects a preparer who suspects a data theft involving tax-related information to contact their assigned Stakeholder Liaison promptly, per Publication 4557 and Security Summit guidance.

This is in addition to, not in place of, FTC, state, and client notifications.

PTIN consequences. The Return Preparer Office can suspend or revoke a PTIN for misconduct, and serious data-handling failures fall inside that authority. PTIN actions tied to data-security failures are real, and the loss of a PTIN ends a tax practice.

Layer 2: the FTC Safeguards Rule (16 CFR Part 314)

This is the layer most CPA firms underestimate. The Gramm-Leach-Bliley Act defines a "financial institution" broadly enough to include any business "significantly engaged" in providing financial products or services.

The FTC's interpretation, reaffirmed in the 2021 and 2023 amendments, places CPA firms preparing tax returns squarely inside that definition. The Safeguards Rule at 16 CFR Part 314 applies to your firm directly, regardless of whether you think of yourself as a "financial institution."

The 2023 amendments, with most substantive requirements live by June 9, 2023, sharpened the rule into specific named controls.

The named requirements

Designated Qualified Individual — § 314.4(a). One named individual responsible for the program. Not a committee. The role can be supported by an outside provider, but the named person must be inside the firm — typically a partner or firm administrator.

Written risk assessment — § 314.4(b). Identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, with periodic reassessment required.

Multi-factor authentication — § 314.4(c)(5). Required for any individual accessing any system containing customer information, subject to a narrow exception for equivalently strong controls approved in writing by the Qualified Individual.

In a CPA firm:

• MFA on Microsoft 365 or Google Workspace
• On the tax-prep software login itself (Lacerte, Drake, UltraTax, ProConnect, CCH Axcess, ATX)
• Client portal
• Document management
• Every remote-access path
• Every administrator account

Encryption — § 314.4(c)(3). Customer information must be encrypted in transit over external networks and at rest, with a similar narrow exception.

Access controls and least privilege — § 314.4(c)(1). Limited to authorized users with periodic reviews. Shared "FrontDesk" or "TaxAssistant" accounts are not consistent with this requirement.

Continuous monitoring or periodic penetration testing — § 314.4(d). Continuous monitoring, or annual penetration testing plus biannual vulnerability assessments. Most small firms cannot run continuous monitoring in-house, which makes managed detection and response the practical path.

Service provider oversight — § 314.4(f). Select providers capable of maintaining safeguards, contract with them to do so, and periodically assess them based on risk.

Written incident response plan — § 314.4(h). Roles, communication, remediation, documentation, and post-incident evaluation.

Annual report to the board or equivalent — § 314.4(i). The Qualified Individual reports in writing at least annually to the board or, in firms without one, to a senior officer.

The 30-day FTC notification

The 2023 amendments added a notification trigger that surprised many firms. For breaches affecting 500 or more consumers, the firm must notify the FTC within 30 days through the FTC's electronic portal — in addition to all state and IRS notification duties.

What noncompliance can cost

The Safeguards Rule has financial teeth. The FTC can assess civil penalties of up to $53,088 per violation per day — and because each day a required control is missing is treated as a separate violation, the exposure compounds fast.

That figure is the inflation-adjusted statutory maximum effective January 17, 2025 (up from $50,120); actual penalties are negotiated case by case, not assessed at the ceiling. The practical point holds: a documented program that satisfies § 314.4 is far cheaper than the maximum cost of being caught without one.

Layer 3: AICPA SSTS § 1.3 — Confidentiality and Data Protection

Effective January 1, 2024, the AICPA's revised Statement on Standards for Tax Services brought data protection inside the professional standards framework.

SSTS § 1.3 makes confidentiality and safeguarding of taxpayer information an explicit professional obligation for AICPA member CPAs providing tax services.

The standard uses a "reasonable steps" framework that parallels the ABA's Model Rule 1.6(c) sliding scale. It does not list specific controls.

It does require the practitioner to consider:

• The sensitivity of the information
• The likelihood of unauthorized disclosure
• The cost and difficulty of safeguards
• The impact on the engagement

A CPA who has taken no demonstrable steps is at risk under the standard regardless of whether a breach has occurred.

The disciplinary mechanism is the AICPA Professional Ethics Executive Committee, working through joint enforcement with state CPA societies — a different forum than IRS Office of Professional Responsibility or a state attorney general, and CPAs can be exposed to all three concurrently.

Layer 4: state requirements

The fourth layer is the one most likely to produce a surprise enforcement letter. A few specific states matter to most firms:

New York — 23 NYCRR 500 (NY DFS). Covered financial services entities, including many accounting firms that hold DFS licenses or meet the rule's coverage tests, must:

• Maintain a written cybersecurity program
• Designate a CISO
• Conduct risk assessments
• Implement MFA
• Encrypt non-public information
• File an annual certification

The November 2023 amendments tightened these requirements significantly.

Connecticut — Public Act 21-119, as amended in 2024. Provides a safe harbor from tort damages in certain data-breach litigation for organizations conforming to a recognized framework.

Massachusetts — 201 CMR 17.00. Any business that owns or licenses personal information about a Massachusetts resident is in scope. Most CPA firms with even a single MA client qualify.

Requires:

• A written information security program
• Encryption of personal information transmitted over public networks and stored on portable devices
• Specific computer-system requirements

California — CCPA/CPRA. Disclosure and consumer-rights obligations attach to firms meeting the revenue or processing thresholds.

The 50-state breach notification patchwork. Every state has a breach notification law. Notification windows range from "without unreasonable delay" to specific day counts.

A CPA firm whose client list crosses state lines is, after a breach, looking at parallel notifications under each state's law.

What does "reasonable efforts" look like for a CPA firm in 2026?

When the FTC, the IRS, an AICPA panel, a state attorney general, or a cyber-insurance underwriter looks at a CPA firm in 2026, the controls they expect to see converge:

• MFA everywhere customer information can be reached — email, tax-prep software, client portal, document management, remote access, every administrator account
• EDR or MDR on every endpoint and server — see managed detection and response
• Identity threat detection on Microsoft 365 or Google Workspace — see managed ITDR
• Immutable offsite backup with quarterly restore tests, logically isolated from the production identity perimeter
• WISP updated within the last 12 months — see The IRS WISP Template for Solo and Small CPA Firms (12 Pages, Not 60)
• Documented incident response plan with annual tabletop
• Security awareness training with phishing simulations and tracked completion — see managed SAT
• Vendor risk management — inventory, contracts, and breach-notification clauses for every tax software vendor, e-signature platform, cloud storage, client portal, payroll, bookkeeping, and AI assistant
• Encryption in transit (TLS 1.2+) and at rest — BitLocker, FileVault, database- or storage-level encryption
• Centralized logging adequate to determine breach scope — see managed SIEM
• Annual Qualified Individual report to firm leadership

None of these is exotic. The challenge in a CPA firm is rarely technical capability; it is designated ownership and consistent execution.

Where do CPA firms most consistently fall short?

The failure modes cluster predictably:

• The "we are too small" assumption. Solo and two-partner firms commonly believe the Safeguards Rule does not apply. It does.

  The 2023 amendments offer narrow documentation-only relief for firms with fewer than 5,000 consumers, and even that does not lift MFA, encryption, access-control, or vendor-oversight requirements.

• The static WISP. A firm downloads the Publication 5708 template, fills in the firm name, and treats it as done. The WISP must be reviewed at least annually, updated on material changes, and backed by evidence the controls are in place.

• The tax software MFA gap. Firm leadership enforces MFA on Microsoft 365 and feels covered. The tax-prep software has its own login.

  A preparer reaches Lacerte, Drake, UltraTax, ProConnect, ATX, or CCH Axcess from a home laptop with a username and password and nothing else. Under § 314.4(c)(5), that single login is a violation — the single most overlooked MFA control in this industry.

• Shared front-desk accounts. "ReceptionDesk," "TaxAssistant" — broad data access, no individual accountability, a password that has not rotated since the last associate left. Under § 314.4(c)(1) and § 314.4(c)(6), not defensible.

• Free-trial vendor drift. An associate signs up for a free trial of an e-signature service or client-portal tool. The free trial silently becomes production. No contract, no data-handling clause, no inclusion in the risk assessment.

• Personal cloud storage. Client tax documents in a partner's personal Dropbox or Google Drive — uncontrolled customer information outside the firm's program.

• The named-but-unaware Qualified Individual. The WISP names a Qualified Individual. The named person does not know it. No § 314.4(i) annual report has ever been prepared.

• Missing AI vendor inventory. The firm started using an AI tax-research assistant, document summarizer, or client-communication drafter last year.

  Not in the vendor inventory, not under a data-handling agreement, possibly sending taxpayer information to a third-party model provider. Layer this on Publication 4557 plus IRC § 7216 and the exposure is non-trivial.

What do enforcement and incident records now look like for CPA firms?

The IRS has not built a public enforcement docket for CPA-firm cybersecurity failures, but state attorneys general have. Two recent matters are useful reference points.

The October 20, 2025 New York Attorney General settlement with Wojeski & Company, an Albany-area CPA firm, covered two separate incidents — a July 2023 ransomware attack and a May 2024 third-party access incident.

The 2023 ransomware event affected 5,881 individuals in total, of whom 4,726 were New York residents; the 2024 incident affected 351 individuals (267 NY residents).

Settlement: $60,000 penalty plus a corrective security program. A clean example of how layer-4 state enforcement reaches a small CPA firm that did not have the layer-2 controls in place. (NY AG press release, 2025-10-20)

The Sax LLP disclosure, filed with the Maine Attorney General, involved approximately 228,876 individuals nationwide (244 Maine residents) notified by a top-100 accounting firm based in Parsippany, NJ.

Sax detected unusual activity on August 7, 2024, completed its data review on December 1, 2025, and began notifying affected individuals on December 16, 2025. The filing characterizes the incident as an external system breach (hacking); Sax has not publicly stated that a ransom was paid.

Firm size does not insulate against the incident profile, and state notification filings have become the de-facto public record for CPA-firm breaches. (Maine AG breach notice)

The pattern across both: the technical compromise is rarely novel. The exposure is built from delayed notification, missing documentation, and program gaps that pre-date the incident.

The breach response sequence under all four layers

When a CPA firm suspects a data theft involving taxpayer or customer information, the sequence we run with firm leadership and breach counsel:

1. Contain technically. Isolate endpoints, revoke compromised credentials, disable tax-software sessions, preserve forensic evidence.
2. Determine scope. Which taxpayers, which data categories, which return years, which states of residence.
3. Notify the IRS Stakeholder Liaison promptly upon suspected theft of tax-related data.
4. Notify the FTC within 30 days for breaches affecting 500 or more consumers, through the FTC's electronic notification portal (§ 314.4(j)).
5. Notify state attorneys general per applicable state law — timing varies; several have specific filing portals.
6. Notify affected taxpayers per applicable state breach-notification law.
7. Notify the cyber-insurance carrier within the policy's window — typically 24 to 72 hours, frequently a coverage condition.
8. Document everything for the Qualified Individual's annual report and any subsequent regulatory inquiry.

The post-incident documentation is not for the file cabinet. It is the evidentiary base that the next investigator, underwriter, or AICPA panel will work from.

A 90-day practical path

For a firm starting from behind, the most useful framing is a 90-day program with milestones the Qualified Individual can actually report against.

Days 1-30 — foundation.

• Formally designate the Qualified Individual in writing
• Complete the written risk assessment under § 314.4(b)
• Enforce MFA firm-wide on email, tax-prep software, client portal, document management, and remote access — including admin accounts
• Deploy EDR or MDR on every endpoint and server
• Confirm full-disk encryption on every laptop and workstation

Days 31-60 — program.

• Build the vendor inventory; add breach-notification and data-handling clauses to every contract touching customer information
• Draft or refresh the WISP using the Publication 5708 outline, scoped to the firm's actual systems
• Draft the incident response plan with named roles, escalation, and the notification sequence above
• Stand up centralized logging adequate to determine breach scope

Days 61-90 — operationalize.

• Launch the security awareness training program and run the first phishing simulation
• Run the first tabletop against a realistic scenario (compromised preparer credential during filing season is a good first run)
• Deliver the Qualified Individual's first § 314.4(i) annual report to firm leadership
• Confirm cyber-insurance readiness by mapping controls to the carrier's renewal questionnaire

At day 90 a firm that started from a static WISP has a current, defensible program. It will not be perfect. It will be defensible — which is the operative standard under all four layers.

Where Obsidian Ridge fits

We deliver the technical safeguards side:

• MFA enforcement
• Managed detection and response
• Identity threat detection on Microsoft 365 and Google Workspace
• Security awareness training with phishing simulations
• Encryption attestation
• Centralized logging
• A documentation package that maps controls to FTC § 314.4 subsections and to the Publication 5708 WISP outline

We are not your Qualified Individual. The named role at § 314.4(a) lives with a firm partner or executive. We are not your CPA, and we do not interpret AICPA SSTS § 1.3 — that conversation belongs to your firm and to the AICPA Professional Ethics Executive Committee.

What we bring is the security-operations side that:

• Lets your Qualified Individual report to firm leadership with confidence
• Lets your cyber-insurance carrier renew without arguing about controls
• Lets your IRS Stakeholder Liaison have the conversation they expect to have

Closing

The CPA cybersecurity obligation in 2026 is no longer optional and no longer aspirational. The penalty stack now includes:

• Professional standards (AICPA SSTS § 1.3)
• Federal regulation (IRS Publication 4557, FTC Safeguards Rule)
• State law (NY DFS 23 NYCRR 500, MA 201 CMR 17.00, the 50-state breach-notification patchwork)
• Cyber-insurance non-renewal

The technical and documented program that satisfies the strongest of those layers will satisfy the others.

Build it once. Maintain it. Review it annually. Be a firm the IRS Stakeholder Liaison is glad to talk to, and a firm whose cyber underwriter renews without a phone call.

If you are a CPA firm trying to map your current posture against the four-layer stack, Talk with us to start a working conversation that produces a concrete gap list against FTC § 314.4 subsections, Publication 4557, and the state requirements that apply to your client footprint.

The accounting industry overview describes the engagement model in more detail.

---

This article is general information for educational purposes, not legal or tax-practice advice. IRS guidance, FTC rule text, and state statutes cited above change over time, and application to a specific firm depends on facts and jurisdiction.

Consult qualified counsel and your state CPA society before relying on any specific interpretation. Sources: FTC Safeguards Rule (ftc.gov) and IRS Publication 4557 (irs.gov).