A written information security program is a documented plan describing how your business protects customer data. In the United States, the FTC Safeguards Rule (16 CFR Part 314) requires many non-bank businesses to maintain one. The rule applies to "financial institutions" under FTC jurisdiction that are not subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act, a definition that includes tax preparers, mortgage brokers, and automobile dealerships that lease vehicles on a nonoperating basis for longer than 90 days, among other businesses you might not expect. IRS Publication 4557 states that, under the FTC Safeguards Rule, tax return preparers must create and enact security plans, and that "failure to do so may result in an FTC investigation." Getting the program right gives you a defensible baseline for protecting customer information.

Who is legally required to have a written information security program?

Under the FTC Safeguards Rule, financial institutions under FTC jurisdiction that are not subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act must have a written information security program. According to the FTC's business guidance, this includes mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors, tax preparation firms, non-federally insured credit unions, and investment advisors not required to register with the SEC. The 2021 amendments added "finders" (companies that bring together buyers and sellers).

The IRS reminds tax professionals that the same rule applies to them. IRS Publication 4557 states that "protecting taxpayer data is the law" and that "according to the FTC Safeguards Rule, tax return preparers must create and enact security plans." IRS Publication 5708 provides a sample template specifically titled "Creating a Written Information Security Plan for your Tax & Accounting Practice."

The terminology varies. The FTC rule says "information security program." The IRS publications say "written information security plan" (WISP). They describe the same obligation: a documented approach to protecting customer or taxpayer data.

What must an FTC Safeguards Rule information security program include?

The FTC Safeguards Rule specifies nine required elements under Section 314.4(a) through (i). A compliant program must include:

  1. Designate a Qualified Individual to implement and supervise the program. This person can be an employee, or can work for an affiliate or service provider. No specific degree or title is required.
  2. Conduct a risk assessment. The assessment must be written and must include criteria for evaluating risks and threats to customer information. Periodic reassessments are required as operations change or new threats emerge.
  3. Design and implement safeguards to control identified risks, including:
    • Implement and periodically review access controls
    • Know what data you have and where it is stored
    • Encrypt customer information on your system and in transit
    • Assess the security of apps that store, access, or transmit customer information
    • Implement multi-factor authentication for anyone accessing customer information
    • Dispose of customer information securely
    • Anticipate and evaluate changes to your information system
    • Maintain logs of authorized user activity and monitor for unauthorized access
  4. Regularly monitor and test the effectiveness of safeguards, through continuous monitoring or annual penetration testing plus vulnerability assessments every six months.
  5. Train your staff with security awareness training and regular refreshers.
  6. Monitor your service providers. Contracts must spell out security expectations and build in ways to monitor their work.
  7. Keep your program current as operations, risks, and threats change.
  8. Create a written incident response plan covering goals, internal processes, roles and responsibilities, communications, remediation, documentation, and post-incident review.
  9. Require the Qualified Individual to report to leadership in writing at least annually to the board or a senior officer, covering compliance status, risk assessment, test results, security events, and recommendations.

The FTC guidance states that the program must be "appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information at issue."

Is there a small business exemption to the Safeguards Rule?

Partial. Section 314.6 of the Rule exempts financial institutions that maintain customer information on fewer than five thousand consumers from certain requirements: the written risk assessment (314.4(b)(1)), continuous monitoring or annual penetration testing and semi-annual vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)), and the Qualified Individual's annual written report to leadership (314.4(i)).

However, the core obligation remains. Even small businesses covered by the Rule must designate a qualified individual, implement appropriate safeguards, train staff, and monitor service providers. The exemption reduces documentation requirements for very small operations but does not eliminate the duty to protect customer information.

What does the FTC Safeguards Rule require for breach notification?

Since May 2024, the FTC Safeguards Rule requires covered financial institutions to notify the FTC of certain data breaches. According to Section 314.4(j) of the Rule, a "notification event" is a security breach involving the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. Notification must be made as soon as possible, and no later than 30 days after discovery, using the FTC's online reporting form.

This is separate from state breach notification laws, which have their own thresholds and timelines. A single breach can trigger multiple notification obligations.

What does the IRS tell tax professionals to do?

Tax professionals have overlapping obligations. IRS Publication 4557 ("Safeguarding Taxpayer Data") states that tax return preparers are considered financial institutions under the Gramm-Leach-Bliley Act and must comply with the FTC Safeguards Rule. It directs practitioners to create a data security plan and provides a checklist covering employee management, information systems, and system failure detection.

IRS Publication 5708 ("Creating a Written Information Security Plan for your Tax & Accounting Practice") provides a sample WISP template. The template covers objectives, scope, a designated Data Security Coordinator, risk assessment, hardware inventory, safety measures (data collection, retention, disclosure, network protection, user access, remote access, connected devices, and reportable incidents), and implementation. The IRS notes that a WISP should be "appropriate to the company's size, scope of activities, complexity, and the sensitivity of the customer data it handles."

We have covered cybersecurity for accountants and CPAs in more detail, including why accounting firms are targeted and the regulatory landscape they face.

Does Canada require a written information security policy?

Canada's federal privacy law, PIPEDA, does not mandate a document literally named "WISP" or "written information security program." However, PIPEDA's fair information principles create similar obligations. According to the Office of the Privacy Commissioner:

  • Principle 4.1 (Accountability): An organization is responsible for personal information under its control and must appoint someone accountable for compliance with the principles.
  • Principle 4.7 (Safeguards): Personal information must be protected by appropriate security relative to the sensitivity of the information.

The OPC's guidance on Principle 4.7 specifically recommends that organizations "develop and implement a security policy to protect personal information." While not using the term WISP, this guidance describes the same outcome: a documented approach to safeguarding personal information.

For Canadian businesses handling personal information, documenting your security policies and practices is a practical way to demonstrate PIPEDA compliance, even if the law does not prescribe a specific document name.

What should a small business WISP actually include?

A practical written information security program for a small business does not need to be hundreds of pages. The FTC and IRS guidance both emphasize that the plan should be appropriate to your size and complexity. As IRS Publication 5708 notes, "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." Based on the FTC Safeguards Rule elements and IRS Publication 5708, a small business WISP should cover:

  1. Scope and data inventory: What customer information you collect, where it is stored (computers, cloud services, paper files), and what regulations apply to your business.
  2. Qualified Individual or Data Security Coordinator: Name the person responsible for implementing and supervising the program.
  3. Risk assessment: Document the foreseeable risks to customer information (theft, unauthorized access, accidental disclosure, system failures) and how you evaluate them.
  4. Access controls: Who has access to customer data, how access is granted and revoked, and how you verify that access is limited to those with a business need.
  5. Multi-factor authentication: How MFA is enforced on systems containing customer information.
  6. Encryption: How sensitive data is protected at rest and in transit.
  7. Vendor oversight: How you select service providers and ensure they maintain appropriate safeguards. This matters for third-party vendor risk beyond the WISP itself.
  8. Training: How employees are trained on security policies and how often training is refreshed.
  9. Incident response: What happens when a security event is detected, who is notified, and how you document and report incidents. For more depth, see our guide to incident response planning before something happens.
  10. Review cadence: How often the plan is reviewed and updated (at least annually, or when significant changes occur).

The IRS Publication 5708 sample template provides a starting point, but your WISP should reflect your actual operations, not just copy a template without adapting it.

Why does a written program matter beyond compliance?

A documented security program serves purposes beyond satisfying regulators. As we covered in what cyber insurers check before quoting a policy, underwriters treat a written incident response plan as one of four floor controls and want evidence for each. Having documented security policies can support your insurance application and demonstrate that your security posture is deliberate, not accidental.

A written plan also creates clarity during a crisis. When an incident occurs, knowing who is responsible, what steps to take, and how to communicate reduces confusion. The value is in having thought through the questions before they become urgent.

What should business leaders take from this?

If your business falls under the FTC Safeguards Rule (and many non-bank businesses do), you are legally required to have a written information security program. The IRS reminds tax professionals that the same rule applies to them. Canadian businesses subject to PIPEDA should document their security policies as a practical matter, even without a literal WISP requirement.

A useful question to put to your IT lead or provider this week: "Do we have a written information security program, and when was it last reviewed?"

If the answer is uncertain, that is the gap to close. A WISP does not need to be complex, but it does need to exist, reflect your actual practices, and be reviewed regularly. If you are unsure where your business stands on the controls that belong in a written security program, a free cybersecurity assessment can help identify which areas need attention before you document them.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. The requirements described are based on the FTC Safeguards Rule text, FTC business guidance, IRS publications, and OPC guidance as of the date of publication and may change. Organizations should consult qualified legal and cybersecurity professionals to determine their specific obligations and develop a written information security program appropriate to their circumstances.