Ask the staff at a small tax practice who is in charge of information security and the answers often vary. One person points to the owner, another to the outside IT provider, and someone else mentions the person who set up the tax software. That uncertainty is exactly what the FTC Safeguards Rule is designed to remove. The Rule asks every firm it covers to name one Qualified Individual who oversees, implements and enforces the information security program, and to put that choice in writing in the written information security plan (WISP).
For tax preparers, CPAs, enrolled agents and bookkeepers, the quiet weeks before filing season are the right time to settle this question. Once returns start arriving, there is little time left to sort out who decides what.
What the Rule actually says
The requirement sits in 16 CFR 314.4(a). A firm must "designate a qualified individual responsible for overseeing and implementing" its information security program and enforcing it. The Qualified Individual can be an employee, someone at an affiliate or someone at a service provider.
IRS Publication 4557, Safeguarding Taxpayer Data, repeats the same step for tax professionals, and the IRS and the Security Summit partners have reminded tax pros that a written plan is a legal requirement (IR-2025-79). In other words, the Qualified Individual is not an optional extra. It is one of the first things a WISP should state.
For more background on the role itself, see the earlier post What Is a Qualified Individual Under FTC Safeguards (Plain English). This post focuses on the practical side: how a tax office names the right person and keeps the role working all year.
Who should it be?
In a small office, the Qualified Individual is often the owner, a partner or the office manager. The title matters less than three practical traits:
- Authority. The person can make decisions, approve spending on safeguards and tell staff to change a habit.
- Knowledge of the office. The person knows who has access to client data, which software is in use and which vendors touch that data.
- Time. The role needs regular attention, not one afternoon a year. A few hours a month is a realistic starting point for many small practices.
It also makes sense to name a backup in the WISP, so someone can act if the Qualified Individual is out during the busiest weeks of the season.
Using an outside provider
Many tax practices work with an outside IT or security provider, and the Rule allows the Qualified Individual to come from a service provider. The important point is what does not move. Under 16 CFR 314.4(a), when a firm uses a service provider or affiliate for this role, the firm keeps responsibility for meeting the Rule. It must also designate a senior member of its own staff to direct and oversee the Qualified Individual, and require the provider to maintain an information security program that protects the firm.
So an outsourced Qualified Individual can bring expertise and save the owner time, but the responsibility stays with the tax practice. The WISP should name both people: the provider's Qualified Individual and the senior person inside the office who oversees that work.
The written report
The Rule also calls for the Qualified Individual to report in writing, regularly and at least annually, to the firm's board or equivalent governing body, or to a senior officer responsible for the program when there is no board. Under 314.4(i), the report covers the overall status of the information security program and material matters such as the risk assessment, risk management and control decisions, service provider arrangements, test results, security events and how management responded, and recommended changes.
For a small tax office this does not need to be long. A few pages, dated and kept with the WISP, can show the owner where things stand: what changed this year, what was tested, what went wrong and what should happen next. It also gives the office a natural moment each year to update the plan.
What the role looks like during the year
A Qualified Individual does not have to do every task personally. The job is to oversee the program and make sure someone is doing each piece. In a typical tax practice that means:
- Keeping the written risk assessment current, which the Rule requires under 314.4(b).
- Reviewing who has access to client data, especially when seasonal staff join or leave.
- Checking that multi-factor authentication, updates and backups are in place and working.
- Reviewing vendors that handle client data and their security commitments.
- Leading the response if something goes wrong, following the incident response plan in the WISP.
A checklist for this week
- Open the WISP and find the name of the Qualified Individual. If no one is named, or the person has left, name someone now.
- Name a backup who can act during filing season if the Qualified Individual is unavailable.
- If the Qualified Individual works for an outside provider, name the senior person in the office who oversees that provider, and confirm the contract requires the provider to protect the firm's data.
- Put the Qualified Individual's duties in writing in the WISP, including the annual written report.
- Schedule the next written report on the calendar, ideally before filing season begins.
- Tell the staff who the Qualified Individual is and how to reach that person about a suspicious email or a lost device.
Where Watch Cloud fits
Watch Cloud Cyber Security works with tax preparers, CPAs, enrolled agents and bookkeepers to build and maintain a WISP aligned with the FTC Safeguards Rule and IRS Publication 4557, along with 24/7 monitoring and endpoint protection for tax offices. That support helps the Qualified Individual stay on top of the program, while the firm keeps its own responsibility under the Rule.
