Common questions from small tax practices
I'm a one-person shop. Do I really need a written security plan?
Yes. The FTC Safeguards Rule covers paid preparers of any size, and the renewal form has you acknowledge it. What changes for a small firm is how much has to be in writing. If you keep information on fewer than 5,000 clients, counting past clients whose files you still hold, four items drop off: the written risk assessment, the formal testing schedule, the written incident response plan, and the annual written report. You still need one named person in charge, encryption, multi-factor sign-in, training for anyone who touches client data, and a check on your vendors. For a solo practice the plan can be five or six pages. The IRS sample in Publication 5708 is a fine starting point.
Is the free IRS template enough, or do I have to buy something?
The template is enough if you fill it in with your own details. The rule doesn't require a paid product or a particular format. Where people go wrong is leaving the sample text as written. Your plan should name your actual devices, your actual software, who has access to what, and which vendors hold client data. Budget an afternoon. Make four lists first (devices, software, people, vendors) and the template goes quickly. Paid services are for people who would rather spend the afternoon on returns.
What happens if I get hacked? Who do I have to tell?
Three things to know. First, if unencrypted information on 500 or more clients is taken, you must notify the FTC within 30 days. Second, the IRS asks you to contact your Stakeholder Liaison when client data is stolen, so they can protect those clients' accounts. Third, your state's breach law probably requires you to notify the affected clients. Write those three steps and the phone numbers into your plan now.
What does the free website report check?
Five things: whether your site uses HTTPS; whether your forms ask for Social Security numbers or bank details; whether your site asks clients to email tax documents; whether a privacy or security page exists; and whether your email domain has SPF and DMARC. It only looks at what anyone can see from outside. It does not log in to anything or test your systems.
What do I get if you write my plan?
A finished plan built on the IRS Publication 5708 outline, a one-page summary, a staff sign-off sheet, a breach response card, and email security setup for your domain (SPF, DKIM and DMARC). We start with a planning call of about 45 minutes where we go through your devices, software, staff and vendors. I write the plan from that and deliver it within 2 days of the call. The price is $495.
What happens if I don't have a written plan?
The FTC Safeguards Rule requires paid preparers to have one, and the FTC enforces that rule. IRS Publication 4557 says that failing to create and follow a security plan may result in an FTC investigation. The more common cost is practical: after a data theft, the plan is the first thing your insurer, the IRS Stakeholder Liaison and your clients ask about.
How often do I need to update it?
There is no fixed interval in the rule. It says to adjust the plan when your business changes and in light of what your testing and monitoring show. In practice, review it once a year before filing season and any time you change software, staff, office or a vendor. Keep a dated note of each review.
The checklist, template and website report are free. What's the catch?
They are how small practices find me. Some finish the plan themselves with the template, which is the point of it. Some would rather build it together on a planning call, and that is the paid service.
Do you certify that my firm is compliant?
No. I prepare a written security plan for your practice from your answers. I do not provide legal advice or certify compliance. Keeping the plan current and following it is the firm's job.