Most small tax practices discover the Safeguards Rule in one of two ways: a professional liability insurer asks for a copy of their WISP, or the IRS asks during PTIN renewal. Both are late. Neither is fatal — but the number of firms who find out this way suggests the rule is not widely understood at the small end of the profession, where it very much applies.
This is not legal advice
We build practice management software; we are not your counsel and we are not your compliance consultant. What follows is a practical orientation, written to help you have a better conversation with someone who is. Where the exact obligation matters to you, read the rule itself and take advice.
Why it applies to you
The Gramm-Leach-Bliley Act defines "financial institution" far more broadly than the everyday meaning of the phrase. The FTC has consistently taken the position that businesses "significantly engaged" in financial activities are covered, and tax preparation is squarely within that. So are accountants and bookkeepers handling customer financial information.
There is no small-business exemption from the rule itself. There is a partial exemption from some of the more prescriptive requirements — a written risk assessment, an incident response plan, and annual reporting to the board — for firms holding information on fewer than 5,000 consumers. Note what that exemption does not cover: you still need the written program, and you still need the safeguards.
What the plan has to contain
A Written Information Security Plan is not a certificate you buy. It is a document describing what you actually do, kept current as what you do changes. At minimum it addresses:
A qualified individual
One named person responsible for the program. In a small firm this is usually a partner. It can be outsourced to a service provider, but accountability stays with you — you cannot contract away the obligation to oversee them.
A risk assessment
Where customer information lives, what could go wrong, and how likely and severe that would be. This is the part firms find hardest, mostly because the honest answer to "where does customer information live" is longer than expected: the practice management system, the tax software, the email mailbox, the accountant's laptop, the scanner's memory, the shared drive nobody has audited since 2019, and the filing cabinet.
Safeguards addressing what the assessment found
The rule enumerates these. In plain terms:
- Access controls — who can reach what, reviewed periodically, revoked on departure.
- Inventory — knowing what data you hold and where.
- Encryption of customer information at rest and in transit.
- Secure development practices for anything you build yourself.
- Multi-factor authentication for anyone accessing customer information.
- Secure disposal of customer information no longer needed, generally within two years of last use.
- Change management — a process for evaluating changes to systems.
- Monitoring of authorized user activity, and detection of unauthorized access.
Testing, training, oversight, and currency
Regular testing or monitoring of the safeguards' effectiveness. Security awareness training for staff. Due diligence on service providers — which includes your software vendors, your IT support, and anyone who touches client files. And a program that is kept current rather than written once and filed.
What software can genuinely do for you
A meaningful share of the technical safeguards can be satisfied by choosing systems that implement them and then documenting that choice. Concretely, a well-built practice management platform should give you:
- MFA on every account — and ideally with no route to switch it off, because a control that can be disabled by the person it constrains is a suggestion.
- Role-based access control with a permission matrix you can show an assessor, rather than "everyone is an admin".
- Encryption at rest for sensitive fields — SSN, FEIN, driver's license, bank details — not merely full-disk encryption on the server.
- An immutable audit log recording who accessed what, when, and from where. This is your monitoring requirement, and it is the one that is nearly impossible to retrofit.
- Secure disposal that actually removes the file and its database row, and records the deletion.
- Documented change management on the vendor's side — CI gates, dependency scanning, a release process you can describe.
A question worth asking every vendor
"Can a user in my firm turn off multi-factor authentication for their own account?" If the answer is yes, that control is optional, and you will have to describe it in your plan as optional. We think that is the wrong answer, which is why in Kveldo the page that disabled 2FA was deleted from the application rather than hidden.
What remains yours no matter what you buy
This is the part that gets skipped, and it is the part an examiner will ask about.
- Designating the qualified individual. No vendor can be your named responsible person.
- The risk assessment. Only you know where your data actually is — including the copies your software vendor cannot see, like the mailbox and the laptop.
- Staff training. The most common breach vector in small practices is a person, not a system.
- Service provider due diligence. Including on the vendor that told you they handle compliance for you.
- Keeping the plan current. A WISP describing a system you stopped using two years ago is worse than none, because it demonstrates the program is not real.
A realistic first pass
If you do not have a plan today, the goal for this month is not a perfect document. It is an honest one. A workable sequence:
- Write down every place client data lives. All of it, including the uncomfortable entries. This list is the foundation of everything else and it takes an afternoon.
- Cut the list. Every location you can eliminate is a risk you no longer have to manage, a control you no longer have to document, and a system you no longer have to monitor. Consolidating documents out of email and shared drives into one system with an audit log is the single largest reduction available to most firms.
- Turn on MFA everywhere. Practice management, tax software, email, cloud storage. Today, not next quarter.
- Name your qualified individual and write down what they are responsible for.
- Document what your systems already do — most firms are further along technically than their paperwork suggests, because their vendors implemented controls they never wrote down.
- Schedule the review. A calendar entry is the difference between a program and a document.
Where Kveldo fits
Kveldo is not your WISP and will not write it. What it can be is the system most of your WISP describes: one place client documents, communications, work and audit history live, with mandatory two-factor authentication on every account, role-based access control your Administrator configures, SSN and FEIN encrypted at rest under per-purpose keys, an immutable audit log covering data access and change, and secure disposal that removes the blob and the row and writes the deletion to the client's timeline.
Consolidation is the underrated part. Every system you retire is a paragraph you do not have to write, a vendor you do not have to assess, and a place a document can no longer be sitting unencrypted.
See Kveldo's security controls in detail →
Read next: why we made 2FA mandatory and deleted the off switch →