When most firm owners hear "$50,644 per violation," they assume that means a single fine if something goes wrong. It does not. The number stacks. One breach against a tax firm with hundreds of clients can produce dozens of countable violations, and the math gets ugly fast.
This post is the math nobody walks you through before you call the breach coach. What counts as a violation, how the FTC totals it up, and the five operational controls that drop your risk from indefensible to defensible.
How the FTC defines a violation
The Safeguards Rule lists nine program elements. Each one missing or unimplemented can be cited as a separate failure. Within an enforcement action, each affected consumer record can also be treated as its own violation under the FTC's authority. The agency does not always pursue every count, but the ceiling is set in statute, not negotiation.
As of January 2026, the per-violation maximum sits at $50,644. That figure adjusts annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. The maximum applies whether the violation is a missing risk assessment, an absent qualified individual, or one of thousands of records exposed in a breach.
The 400-client worked example
Take a tax firm with 400 active client returns, 3 employees, and a moderate breach (a phishing-driven credential compromise that exposed half the client list). Here is how an FTC enforcement action could realistically count violations.
- No documented risk assessment: 1 violation
- No designated qualified individual in writing: 1 violation
- Missing multi-factor authentication on a system holding customer information: 1 violation
- No written incident response plan: 1 violation
- 200 affected client records: up to 200 violations
The maximum exposure on those counts alone is more than $10 million. The FTC almost never pursues the ceiling, but published settlements with small businesses have cleared $250,000 in direct penalties, plus 20-year monitoring requirements.
What insurance covers and what it does not
Cyber insurance for small firms typically covers forensic costs, notification, credit monitoring, and a portion of regulatory penalty exposure. Most policies cap regulatory coverage at $100,000 to $500,000. The premium and coverage both depend on whether you can prove your security program existed before the incident, not just after.
Insurers ask for the same artifacts the FTC will ask for: WISP, risk assessment, MFA enforcement, employee training records, vendor agreements. If you cannot produce them at renewal, you either pay double the premium or get denied coverage entirely.
The 5 controls that move you from indefensible to defensible
No control is perfect. The goal is not zero risk. The goal is being able to point to a documented, dated, ongoing program when the FTC asks. These five do most of the work.
- A WISP that is dated within the last 12 months and names a real qualified individual.
- Multi-factor authentication on every system that touches client data, with a written policy enforcing it.
- An annual employee training record showing every staff member completed phishing awareness training.
- A vendor list with signed data processing agreements covering every tool that handles customer information.
- A documented incident response plan that names your breach coach, your insurance contact, and your notification timeline.
What this looks like in practice
A 5-person firm with these five artifacts in place typically pays $300 to $700 per month for a managed security program that maintains them. That number is the cost of compliance.
A 5-person firm without these artifacts, after a moderate breach, faces $250,000 to $500,000 in combined penalties, legal fees, notification costs, and lost clients. That number is the cost of non-compliance.
The math always favors the firm with the program in place. The math never favors the firm hoping nothing happens.
Five-minute self-check
Pull up your current WISP. Answer these five questions out loud.
- Is it dated within the last 12 months?
- Does it name a specific qualified individual?
- Is multi-factor authentication enabled on every system that touches client data?
- Do you have employee training records on file?
- Do you have a written incident response plan that names a breach coach and an insurance contact?
If you answered no to any of those, that gap is the difference between a defensible firm and a $50,644-per-violation firm. Fix the gap before you need it.
