When is a WISP required? The FTC Safeguards Rule dates

The short answer

It is required now. Section 314.3(a) says you "shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts." The original 2002 rule used the same words. Every effective date in the four Federal Register notices below has passed. The original Safeguards Rule took effect May 23, 2003. The 2021 amendments were effective January 10, 2022, and their later-starting parts were delayed to June 9, 2023. The FTC notification requirement in 16 CFR 314.4(j) was effective May 13, 2024. Section 314.2 lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution.

2003: the original rule

The Federal Register notice for the original rule (67 FR 36484, May 23, 2002) says: "This rule is effective on May 23, 2003."

2021: the amended rule

The amended rule is 86 FR 70272, published December 9, 2021. Its DATES section says:

"Effective date: This rule is effective January 10, 2022. Applicability date: The provisions set forth in Sec. 314.5 are applicable beginning December 9, 2022."

The 2021 text of 314.5 named these paragraphs: 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3), (h), and (i). Those are the parts that started later.

2022: the extension

A notice at 87 FR 71509 (November 23, 2022) moved that date. It says: "The applicability of the provisions set forth in Sec. 314.5 is delayed from December 9, 2022 until June 9, 2023." Its revised 314.5 reads: "Sections 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3), (h), and (i) are effective as of June 9, 2023."

2024: telling the FTC

The amendments in 88 FR 77499 (published November 13, 2023) are, in its words, "effective May 13, 2024." The eCFR text for October 1, 2026 reads: "Section 314.4(j) is effective as of May 13, 2024." Paragraph (j) is the notification paragraph. Section 314.2 defines a notification event as "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." It says that if a notification event involves the information of at least 500 consumers, "you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event." For the steps, see the breach notice guide.

The FTC's own business guidance says the same in short: "The Safeguards Rule took effect in 2003, but after public comment, the FTC amended it in 2021." It adds that the breach notification requirements "took effect in May 2024."

The small-office note does not change a date

Section 314.6 does not move any date. It says: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." The count is consumers, not staff. The one-person office guide has the detail.

The question preparers answer each year

The IRS instructions for Form W-12 say a PTIN "must be renewed annually." Line 11 of the form, "Data Security Responsibilities," reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." You must check Yes or No. The form points to IRS Publications 5708 and 4557. See the line 11 guide and the 2027 renewal guide.

How often the rule asks for review

The rule uses several wordings. Section 314.4(b)(2) says you "shall periodically perform additional risk assessments." Section 314.4(d)(1) says to "regularly test or otherwise monitor" your safeguards. Section 314.4(d)(2) says that without effective continuous monitoring you "shall conduct" annual penetration testing, and vulnerability assessments "at least every six months; and whenever there are material changes to your operations or business arrangements; and whenever there are circumstances you know or have reason to know may have a material impact on your information security program." Section 314.4(g) says to evaluate and adjust the program in light of test results, material changes, risk assessment results, and any other circumstances you know or have reason to know may have a material impact. Section 314.4(i) says the Qualified Individual reports in writing "regularly and at least annually." Section 314.6 lists (d)(2) and (i) among the paragraphs that "do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." The update guide goes through each one.

Sources

• 67 FR 36484 (May 23, 2002): federalregister.gov
• 86 FR 70272 (Dec 9, 2021): federalregister.gov
• 87 FR 71509 (Nov 23, 2022): federalregister.gov
• 88 FR 77499 (Nov 13, 2023): federalregister.gov
• 16 CFR 314.2, 314.3, 314.4, 314.5, 314.6 (eCFR; this page quotes the October 1, 2026 text): ecfr.gov, Part 314
• FTC, Safeguards Rule: What Your Business Needs to Know: ftc.gov
• IRS Form W-12 and instructions: fw12.pdf, iw12.pdf

This is general information, not legal advice.