FTC Safeguards Rule for Tax Preparers: The Six-Month Vulnerability Assessment Explained

If you renewed your PTIN this year, Form W-12 reminded you that paid tax return preparers are required by law to create and maintain a written information security plan. That requirement comes from the FTC Safeguards Rule. Most practices know about the plan itself. Far fewer know that the Rule also asks for regular security testing, including vulnerability assessments at least every six months.

This guide explains, in plain English, what that testing requirement says, who it applies to, what a vulnerability assessment should cover in a small tax or financial practice, and how to document it so you can show it was done.

Does the Safeguards Rule apply to your practice?

The Safeguards Rule (16 CFR Part 314) applies to non-bank “financial institutions” under FTC jurisdiction. The FTC’s own business guidance lists examples that include:

• Tax preparation firms
• Mortgage brokers and home loan originators
• Consumer finance companies and short-term lenders
• Debt collection agencies and credit counselors
• Financial advisors and investment advisors not required to register with the SEC
• Check-cashing and money-transfer businesses

For tax professionals the IRS is explicit. IRS Publication 5708 states that tax and accounting professionals are considered financial institutions regardless of size, and that implementing and maintaining a written information security plan (WISP) is a requirement of the Safeguards Rule.

One important exception: firms that maintain customer information on fewer than 5,000 consumers are exempt from a few specific parts of the Rule, including the testing requirement discussed below (16 CFR 314.6). The rest of the Rule, including the written plan and multi-factor authentication, still applies.

What the Rule actually says about testing

Section 314.4(d) requires covered firms to regularly test or monitor whether their safeguards work. For information systems, paragraph (d)(2) gives two options:

• Continuous monitoring of your systems, or
• Annual penetration testing plus vulnerability assessments at least every six months.

The Rule also asks for testing whenever there are material changes to your operations or business, or other circumstances that may materially affect your security program. According to the Rule, the vulnerability assessments include systemic scans or reviews reasonably designed to identify publicly known security vulnerabilities.

For most small practices, continuous monitoring means buying and running security tooling all year. Periodic testing is usually the simpler route: one penetration test a year and two vulnerability assessments, six months apart.

Vulnerability assessment vs. penetration test

The two are related but not the same, and the Rule asks for both (unless you monitor continuously).

For a deeper comparison, see penetration test vs. vulnerability scan vs. security review.

What a vulnerability assessment should cover in a tax practice

The Rule speaks of “information systems”, which is broader than the computers in your office. In a typical small practice, it helps to split the scope in two:

Internal systems

• Office computers and laptops, including operating system and software updates
• The office network, Wi-Fi and router
• File servers, backups and any on-premises tax software

This part is usually handled by your IT provider with scanning tools run from inside the network.

Internet-facing systems

• Your website, including contact and intake forms, booking widgets and plugins
• Client portals and any page where clients upload documents
• Login pages for webmail, the website admin area and remote access
• Your email domain and its SPF, DKIM and DMARC records, which decide whether criminals can send email that looks like it came from you
• Forgotten subdomains, test sites and old files that are still online

The external side is easy to overlook because it does not feel like part of the office. Yet it is exactly what attackers scan first, because they can reach it without breaking into anything. Typical issues include outdated website plugins, files left in public folders, login pages without two-factor authentication and missing DMARC records. For a quick self-check, see our 15-point website security checklist.

A practical six-month schedule

The Rule does not set specific months, so pick dates that suit your workload. For tax practices, a natural rhythm is:

• Fall (October–November): first assessment, so fixes are in place before filing season and the busiest phishing period.
• Spring (May): second assessment after the season, including a check that earlier findings were fixed.

Add an extra check whenever something material changes, for example a new website, a new client portal or a new office.

How to document it

Testing that is not documented is hard to prove. Keep the following with your WISP:

1. The report from each assessment, with the date and scope.
2. A short letter or statement from whoever performed it: what was tested, when and how.
3. Your remediation notes: what was fixed, by whom and when.
4. The results of the next assessment, showing the fixes held.

This also feeds two other parts of the Rule: the written report your Qualified Individual must give at least annually to your board or a senior officer, which covers testing results (314.4(i)), and the ongoing evaluation and adjustment of your program (314.4(g)).

Two requirements that often come up in the same findings

• Multi-factor authentication. The Rule requires MFA for anyone accessing any information system, unless your Qualified Individual approves an equivalent control in writing (314.4(c)(5)). An assessment that finds a website admin or webmail login without two-factor sign-in is pointing at this requirement.
• Breach notification to the FTC. If a security event involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery (314.4(j)). If an assessment finds client files exposed online, ask your advisors whether this requirement applies.

Checklist: the testing part of your Safeguards program

• Confirm whether you maintain information on 5,000 or more consumers.
• Decide between continuous monitoring and periodic testing, and record the decision in your WISP.
• Book the annual penetration test.
• Schedule two vulnerability assessments, six months apart, covering both internal and internet-facing systems.
• Keep every report, letter and remediation note with your WISP.
• Re-test after any material change.

How Nyorsoft can help

We cover the internet-facing part of your vulnerability assessments. Our FTC Safeguards Rule External Assessment includes two full external assessments a year, six months apart, each with a plain-English report, a mapping to 16 CFR 314.4 and a dated assessment letter for your records. The second assessment also verifies what you fixed. It costs $2,900 per year, with no calls or access to your systems needed.

You can download a sample report prepared for a fictional tax practice. We do not test internal systems or perform the annual penetration test; your IT provider or a penetration testing firm handles those.

Sources

• 16 CFR Part 314 – Standards for Safeguarding Customer Information (eCFR)
• FTC: Safeguards Rule – What Your Business Needs to Know
• IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice
• IRS Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) Application and Renewal

This article summarizes publicly available rules and guidance for general information. It is not legal advice; please rely on the official texts and your own advisors.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team