The Safeguards Rule and IRS Pub 4557, in plain English.
Who it applies to
The FTC Safeguards Rule (16 CFR Part 314, amended 2021, enforceable since June 2023) applies to “financial institutions” under the Gramm-Leach-Bliley Act that are not regulated by a banking agency. That explicitly includes tax preparers, CPA firms, bookkeepers, mortgage brokers, insurance agencies, and other firms that handle consumer financial information. Firms with fewer than 5,000 consumers are exempt from a few elements (written risk assessment, annual board report, incident response plan) — but not from encryption, access controls, MFA or the written program itself.
What it requires (the nine elements of 314.4)
- A qualified individual responsible for the program.
- A written risk assessment.
- Safeguards: access controls, data inventory, encryption in transit and at rest, secure development, MFA, secure disposal, change management, activity logging.
- Regular testing and monitoring (continuous monitoring, or annual penetration test plus semi-annual vulnerability scans).
- Staff training.
- Oversight of service providers, with contracts requiring safeguards.
- Keeping the program current.
- A written incident response plan.
- Annual report to the board or senior management.
What IRS Publication 4557 adds
Pub 4557 (“Safeguarding Taxpayer Data”) is the IRS’s guide for tax professionals, and since 2023 the PTIN renewal asks preparers to confirm they have a written information security plan (WISP). It expects encryption of taxpayer data in email, strong passwords and MFA, and a response plan for data theft that includes notifying the IRS Stakeholder Liaison.
What PXCMail’s addendum commits to
- Encryption of client data in transit on every message, with encrypted delivery when the recipient can’t do TLS.
- Detection of SSNs, EINs, tax forms and account numbers before delivery.
- MFA for all users; named accounts; activity logging per message.
- Seven-year retention option aligned to IRS records guidance; certificate of destruction on exit.
- Breach notification within 72 hours of determination.
- Annual written confirmation of safeguards for your WISP.
What it does not require
There is no “Safeguards certification”. The rule asks for a program and evidence; it does not name products. Client portals are not mandatory — but if clients email you documents, the email must be protected.
Accounting & tax overview → · The Safeguards email checklist →