How to do a written risk assessment for a small tax office

Leer en español

The short answer

Section 314.4(b) of the FTC Safeguards Rule says to base your information security program on a risk assessment. The risk assessment shall be written and shall include three things, set out below. Section 314.6 lifts the written-assessment paragraph, 314.4(b)(1), for offices that keep customer information on fewer than 5,000 consumers. It does not lift paragraph (b) itself or the periodic reassessments in (b)(2). The IRS publications add practical steps: list the information you handle, list the ways it could be lost, and inventory the devices that touch it.

What the rule requires

Paragraph (b) reads:

"Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks."

Paragraph (b)(1) adds: "The risk assessment shall be written and shall include:"

• "Criteria for the evaluation and categorization of identified security risks or threats you face;"
• "Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and"
• "Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks."

Paragraph (b)(2) says: "You shall periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks". The rule uses the word "periodically" there. For how often offices update their plans, see how often to update a WISP.

Does the small-office exemption change it?

Section 314.6 says:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

Paragraph (b)(1), the written assessment with the three items above, is on that list. The opening of paragraph (b) and paragraph (b)(2) are not. The threshold counts consumers whose information you maintain, not staff. Read the list yourself against your own numbers.

Practical steps from Publication 5708

The Publication 5708 outline has a step called "Assess Risks". Under it the publication says: "While building your WISP, take a close look at your business to identify risks of unauthorized access, use, or disclosure of information." It breaks the step into three actions.

1. List the types of information your office handles. The publication says: "Identifying the information your practice handles is a critical step in evaluating risk." It gives these as examples: taxpayer PII, employee records, and private business financial information. Its wording is "Some types of information you may use in your firm includes".
2. List the potential types of loss, inside and outside the office. The publication says: "Examples might include physical theft of paper or electronic files, electronic data theft due to Remote Access Takeover of your computer network, and loss due to fire, hurricane, tornado or other natural cause." These are examples, not a required list.
3. Outline procedures to monitor your processes and test for new risks that may arise.

The next outline step is "Inventory Hardware". The publication says: "It is imperative to catalog all devices used in your practice that come in contact with taxpayer data." For each item it asks you to list the description and physical location, and record the types of information stored or processed.

What Publication 4557 adds

Publication 4557 says the Safeguards Rule requires companies "to assess and address the risks to customer information in all areas of their operation". It names three areas as particularly important: employee management and training, information systems, and detecting and managing system failures. Its checklist is introduced with "firms should consider implementing the following practices", so those items are suggestions.

Its list of basic steps includes: "Perform an inventory of devices where client tax data are stored, i.e., laptops, smart phones, tablets, external hard drives, etc." Its checklist has the line "Maintain a careful inventory of your company's computers and any other equipment on which customer information may be stored."

How it feeds the plan

Paragraph (c) says to "Design and implement safeguards to control the risks you identify through risk assessment". In Publication 5708's outline, "Assess Risks" comes before "Document Safety Measures in place", which lists suggested policies such as data collection and retention, network protection, user access and remote access.

Paragraph (g) closes the loop. It says to "Evaluate and adjust your information security program in light of" several things, including "the results of risk assessments performed under paragraph (b)(2) of this section". Publication 5708 says a plan "is intended to be an evergreen document that is regularly reviewed, tested, and updated".

The free WISP generator makes a draft plan. A draft is only a start.

Sources

• 16 CFR 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.