Sources & References

IRS resources

• IRS Publication 5708 — Creating a Written Information Security Plan
  Internal Revenue Service

  The IRS-published WISP guide and sample template for tax professionals.

• IRS Publication 4557 — Safeguarding Taxpayer Data
  Internal Revenue Service

  Long-standing IRS guidance for paid preparers on protecting taxpayer information.

• IRS — Protect Your Clients; Protect Yourself
  Internal Revenue Service

  IRS Security Summit data security resources for tax professionals.

• IRS — Identity Theft Central for Tax Pros
  Internal Revenue Service

  Reporting suspected data theft, EFIN compromise, and client identity theft.

FTC & GLBA

• FTC Safeguards Rule — 16 CFR Part 314
  Federal Trade Commission

  The current implementing regulation for the GLBA safeguarding requirements.

• FTC — FTC Safeguards Rule: What Your Business Needs to Know
  Federal Trade Commission

  Plain-English FTC overview of the required elements.

• Gramm-Leach-Bliley Act (GLBA)
  Federal Trade Commission

  Underlying statute that makes tax preparers and similar firms 'financial institutions.'

FTC Enforcement & Penalties

• FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
  Federal Trade Commission

  2025 inflation-adjusted civil penalty amounts.

• 16 CFR 1.98 — Adjustment of civil monetary penalty amounts
  eCFR

  Current FTC civil penalty maximums.

• FTC notice that 2025 civil penalty levels continue to apply (2026)
  Federal Register

  2025 penalty levels remain in effect.

• First Safeguards Rule enforcement cases
  Federal Trade Commission

  Consent orders with 10 years of biennial audits.

• GAO-19-196: Actions Needed to Strengthen Oversight of Consumer Reporting Agencies
  U.S. Government Accountability Office

  FTC lacks civil penalty authority for initial GLBA violations.

• FTC Safeguards Rule: What Your Business Needs to Know
  Federal Trade Commission

  FTC business guidance on the Safeguards Rule.

NIST & standards

• NIST Cybersecurity Framework
  National Institute of Standards and Technology

  Voluntary framework (Identify, Protect, Detect, Respond, Recover) referenced throughout the Safeguards Rule.

• NIST SP 800-53 — Security and Privacy Controls
  National Institute of Standards and Technology

  Control catalog informing administrative, technical, and physical safeguards.

• NIST SP 800-171 — Protecting CUI in Non-Federal Systems
  National Institute of Standards and Technology

  Reference baseline used by many small firms to structure technical safeguards.