Key takeaways
- Score every file sharing option on encryption, MFA, per-user logs, deletion and a written security statement.
- Name the Qualified Individual and get any MFA exception approved in writing before the season starts.
- Keep the retention schedule and the two-year disposal rule in one document, with the reason for each period.
The baseline in 16 CFR 314.4
The FTC Safeguards Rule lists tax preparation firms among the covered entities it applies to, and its technical requirements sit in 16 CFR 314.4. Six of them decide whether a file sharing tool can hold client tax documents at all.
Encryption. Section 314.4(c)(3) requires customer information to be encrypted in transit over external networks and at rest. If encryption is infeasible, alternative compensating controls can be used, but the Qualified Individual has to review and approve them. Ask every vendor for that statement in writing, not a line on a pricing page.
Multi-factor authentication. Section 314.4(c)(5) requires MFA for any individual accessing any information system, unless your Qualified Individual has approved in writing reasonably equivalent or more secure access controls. Read literally, that includes clients who log in to a portal, not only staff.
Activity logging. Section 314.4(c)(8) requires policies, procedures and controls designed to monitor and log the activity of authorized users. A last-login timestamp does not meet that wording. The firm needs per-file view and download events tied to a named user or a specific link.
Disposal. Section 314.4(c)(6)(i) requires secure disposal of customer information in any format no later than two years after the last date it is used in connection with the provision of a product or service to the customer it relates to. The exceptions cover data needed for business operations or other legitimate business purposes, data that law requires you to retain, and cases where targeted disposal is not reasonably feasible. Write the disposal rule and the tax retention periods together, as the next section shows.
Incident response and the board report. Section 314.4(h) requires a written incident response plan designed to promptly respond to, and recover from, any security event. Section 314.4(i) requires the Qualified Individual to report in writing, regularly and at least annually, to the board of directors.
The fewer-than-5,000 exemption
Section 314.6 provides that 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. They cover the written risk assessment, monitoring and testing, the incident response plan and the annual board report.
Decision rule: if the firm maintains customer information on fewer than five thousand consumers, the written risk assessment, the incident response plan and the board report can come out of the WISP. Encryption, MFA, activity logging and disposal still apply. Count every vault, including former clients’ files, and confirm the count with counsel.
Map each control to a WISP row
The IRS protect-your-clients page states that “Federal Trade Commission regulations require professional tax preparers to create and enact security plans”. It names IRS Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, and Publication 5709, How to Create a Written Information Security Plan for Data Safety.
Build the file sharing section of the WISP as a table with four columns: the control, the setting that proves it, the owner and the review date. The MFA row names the admin console setting that enforces MFA for staff.
The Qualified Individual should check each vendor’s written answers against the baseline, not the sales deck.
Which files need which controls
Decision rule: if a file contains a Social Security number, an EIN, an ITIN or a bank account number, it goes through an authenticated upload, not email, a text message or a shared link.
Decision rule: if the client logs in to a portal, require MFA on the login. If the client only uploads once a year, a one-time code sent to the address on file may qualify as reasonably equivalent, but only the Qualified Individual can decide that, and the approval goes into the WISP before the first season.
Decision rule: if a staff member needs a file from a client folder they are not assigned to, grant access to that one folder for that engagement and remove it at close.
Retention and disposal are different rules
The IRS page on how long to keep records gives 3 years as the default period. It gives 6 years if you do not report income you should report and the omitted income is more than 25% of the gross income shown on the return. It gives 7 years for a claim for a loss from worthless securities or a bad debt deduction, and at least 4 years for employment tax records after the date the tax is due or paid, whichever is later.
Worked example. A 2026 return filed in spring 2027 with no omitted income gets the 3-year default, so its support stays available for that period. Where tax law requires the keep period, the 314.4(c)(6)(i) exception for data that law requires you to retain applies, so the firm can hold the file.
Failure mode: a firm deletes a client’s 2026 support two years after the last engagement, and then an IRS question about that return arrives with nothing to answer it. Fix: one retention schedule that lists each document type, the keep period with its source, the disposal date and the person who approves deletion. Deletion is logged, not just done.
When a breach triggers the FTC notice
The notice requirement applies to a notification event, which is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers. Notice to the FTC is due as soon as possible and no later than 30 days after discovery.
Decision rule: if a stolen staff password let someone download client files through the portal and MFA was not enforced, treat the files as unencrypted until counsel says otherwise, and count the consumers whose files were taken. If the files were encrypted and the keys were not exposed, ask counsel whether the event falls outside the definition.
Section 314.6 does not list 314.4(j), so the notice applies even under the five thousand consumer exemption.
How the common options rank
Score each option on five checks: encryption and MFA enforced by the system, per-user logs you can export, deletion and retention controls that follow your schedule, a written security statement for the WISP, and one-step revocation of a single client’s access.
1. A client portal built for tax document collection. It ranks first when staff MFA is enforced, the audit log exports per file and deletion is configurable. Usual’s product plan describes TLS 1.2 or higher in transit, AES-256 at rest, staff MFA with authenticator codes or passkeys, and an audit log of views, downloads and permission changes kept 7 years. Legal hold, a WISP compliance package and a SOC 2 Type I report are planned for later releases, so ask for shipped status in writing.
2. Document management with a client portal. Folder-based systems pass the logging check only when the audit trail can be exported, not just viewed on screen. Log in with a client account before go-live and confirm the client sees only their own folders.
3. Consumer cloud storage with share links, such as Google Drive, Dropbox or OneDrive. The common failure is a link anyone can open. Use it only on a business tier with an admin log of shares and downloads, link expiry set and sharing limited to named users.
4. Encrypted email or secure send add-ons. They protect one message to one recipient. They fail the logging and retention checks because a copy sits in two mailboxes and nobody owns its deletion. They suit a one-off document, not a season of tax ID requests.
5. Plain email attachments and text messages. These fail the baseline. Move the file into an authenticated upload the day it arrives and delete the mailbox copy after it is filed.
What to send each vendor this week
Send this request in writing: “Please send your current security statement covering encryption at rest and in transit, the admin setting that enforces multi-factor authentication for staff, a sample audit log export for one client folder, and your written process for deleting a client’s files when an engagement ends.” A vendor that cannot answer all four in writing fails that check.
Then ask: “Do you have a SOC 2 Type II report, and can I review it under NDA?” A Type I report describes controls at one point in time. A Type II report covers a period of operation, so ask for Type II.