The 12 email questions in a Safeguards Rule review.
Use this as the email section of your WISP. Each question has the answer a small firm should be able to give — and what to do if you can’t.
- Who is the qualified individual responsible for information security? A named person, even in a two-person firm.
- Do you have a written information security plan that covers email? The PTIN renewal asks; the FTC can ask to see it.
- Is client data encrypted in transit, always? Not “our provider uses TLS”. Enforcement, and a fallback for recipients who can’t.
- What happens when a W-2 or 1040 is emailed? Detection and automatic encryption, logged.
- Is multi-factor authentication on for every email account? Required by 314.4(c)(5).
- Can staff forward client data to personal accounts? Blocked or logged, by policy.
- How long are client emails kept, and can you prove they weren’t altered? Written retention; immutable archive for the period.
- Can you find every message about one client? Archive search independent of individual mailboxes.
- Do your service providers (including email) sign a contract with safeguards? 314.4(f).
- What is your plan if an inbox is compromised during tax season? Incident response plan; IRS Stakeholder Liaison notification; a list of affected clients from the audit trail.
- Is your domain protected from being spoofed to your clients? SPF, DKIM, DMARC published.
- When was staff last trained, and is it documented? Annual, with records.
Answer all 12 with PXCMail Check question 11 now
A WISP template with this section completed is part of the design-partner kit.
Why these twelve
Each question maps to an element of 16 CFR 314.4, the section of the FTC Safeguards Rule that says what an information security program must contain. Question 1 is 314.4(a), the qualified individual. Question 2 is the written program itself, which IRS Publication 4557 calls the WISP and the PTIN renewal asks about. Questions 3 and 4 are 314.4(c)(3), encryption of customer information in transit and at rest. Question 5 is (c)(5), multi-factor authentication for anyone accessing customer information. Questions 6 and 8 come from the access-control and monitoring elements in (c)(1) and (c)(8). Question 7 is the retention and disposal element in (c)(6). Question 9 is (f), service providers under contract. Question 10 is (h), the incident response plan, plus the (j) duty to notify the FTC within 30 days of an event affecting 500 or more consumers. Question 11 is the domain control every insurer asks for. Question 12 is (e), training. Firms with fewer than 5,000 consumers skip the written risk assessment, the annual board report and the written incident plan under 314.6, but not the controls.
A worked answer sheet: Ortiz CPA
Nine people, Microsoft 365, Drake and TaxDome. Daniel Ortiz filled this in for the PTIN renewal, using the Publication 5708 template for the rest of the WISP.
| # | Ortiz CPA’s answer | Evidence |
|---|---|---|
| 1 | Daniel Ortiz, partner, named in the WISP | WISP section 1 |
| 2 | Yes, Publication 5708 template with this sheet as the email section | WISP, dated and signed |
| 3 | TLS enforced on all outbound mail; recipients that cannot negotiate it get locked delivery | Policy screenshot; audit trail entries |
| 4 | W-2, 1099 and 1040 fingerprints and SSN patterns trigger locked delivery automatically, logged per message | Detection pack settings; sample audit entry |
| 5 | MFA on all nine Microsoft 365 accounts and the PXCMail console | Console → Users export |
| 6 | Forwarding to personal domains blocked by policy; exceptions require partner release | Policy rule; held-message log |
| 7 | Seven years in immutable storage; sha256 manifest on export | Retention setting (accounting profile) |
| 8 | Archive search by client name, address or date, independent of staff mailboxes | Sample search export |
| 9 | Data Processing & Safeguards Addendum with 314.4(f) terms signed at signup; Microsoft and TaxDome agreements on file | Countersigned addendum in Console → Organization |
| 10 | Written steps: revoke sessions, reset, pull the affected-client list from the audit trail, call the IRS Stakeholder Liaison, notify clients; FTC notice if 500 or more consumers are affected | WISP section 9; first-hour guide |
| 11 | SPF, DKIM, DMARC published | Scanner result, dated |
| 12 | Annual, in January before the season; attendance recorded | Training roster |
How to use it before the review
- Fill the sheet in before PTIN renewal season, so the renewal question is answered from a document rather than from memory.
- Send a test return PDF to a personal address and confirm it goes out locked; keep the audit entry for question 4.
- Run the scanner for question 11 and fix any missing record.
- Attach the addendum and your other vendor contracts for question 9; the FTC asks for contracts, not assurances.
- Review the sheet every January and after any staff change, and keep each year’s version.
FAQ
Does the Safeguards Rule apply to a nine-person CPA firm?
If the firm prepares tax returns or otherwise handles consumer financial information as a significant activity, yes. The under-5,000-consumer exemption in 314.6 removes some paperwork, not the controls.
Does the FTC audit small firms?
Enforcement is rare and is a tail risk. The questions arrive far more often from the PTIN renewal, an insurer, or a client who lost money to a spoofed email.
Is a password on a PDF enough for question 4?
It covers that one file but not the program: staff forget, the password travels in the next email, and nothing is logged. See PDF password or portal.
Do we need to notify anyone after a compromised inbox?
The IRS asks practitioners to contact their Stakeholder Liaison; the FTC must be notified within 30 days if 500 or more consumers are affected; state breach laws may apply. The audit trail gives you the client list to work from.
Related
The Safeguards Rule, in plain English · Accounting & Tax · A WISP in a weekend