What is the FTC Safeguards Rule?
Short answer
The FTC Safeguards Rule requires tax preparers, as financial institutions, to run a written security program: encryption, multi-factor authentication, vendor oversight.
What it is
The Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for companies the FTC oversees. Tax return preparers are financial institutions under it. The rule requires a qualified individual in charge of security, a written risk assessment, access controls, an inventory of data and systems, encryption in transit and at rest, multi-factor authentication, secure disposal, change management, monitoring, staff training, oversight of service providers, an incident response plan and a yearly report to leadership.
Since 2024 the rule also requires notifying the FTC within 30 days of discovering a breach that affects 500 or more consumers.
Why it matters for a tax firm
This is where the Written Information Security Plan comes from. The rule is specific about controls, so "we use a good portal" is not compliance; a firm has to show the plan, the risk assessment, the training and the vendor reviews.
How XyloDocs handles it
XyloDocs encrypts client files in transit and at rest and keeps an access log a firm can hand to its security reviewer. The firm's own WISP, training and risk assessment are still the firm's to write.
Related terms
Read more on XyloDocs
Sources
Questions about FTC Safeguards Rule
Does the Safeguards Rule apply to a one-person tax practice?
Yes. Some requirements, such as the written risk assessment and the annual report, are relaxed for firms holding information on fewer than 5,000 consumers, but the program itself is required.
What has to be reported to the FTC?
A breach involving the unencrypted information of at least 500 consumers, within 30 days of discovery, through the FTC's online form.
Last reviewed: October 16, 2026. This glossary explains terms; it is not legal or tax advice. Check the cited source for the current rule.
Stop chasing documents and status calls
XyloDocs is the AI client communication platform for tax firms: bilingual calls and texts, document intake over WhatsApp and email, and status updates clients read before they phone.