The IRS has told tax professionals that a written security plan is federal law, and here is what it said, the caveat on its page, and where I would start.
Ask a small tax or accounting office whether it has a written security plan, and I hear either "it is somewhere" or "my software handles that." Behind the answer is a fair worry: is this actually required, or is it a document someone wants to sell me? It is a fair question, and the short answer from the IRS is yes, with caveats I will set out.
What the IRS said
In IRS Tax Tip 2019-174, dated December 11, 2019, the IRS told tax professionals that having a written data security plan is federal law, tied to the FTC Safeguards Rule. I am paraphrasing, and the IRS page is marked "Historical Content," so it may not reflect current law, policies or procedures. Please confirm the current position with your attorney, since this is an auditor's explanation and not legal advice.
Who the FTC rule reaches
The FTC says the Safeguards Rule lists 13 types of covered businesses, including mortgage lenders, payday lenders, check cashers and tax preparation firms, and that the list is not exhaustive. If you prepare returns, you are named. If your work is accounting or bookkeeping, I would not assume you are outside it, because the list is not exhaustive. That is worth settling with your attorney, and the answer may differ from one firm to the next.
Where I would start
The IRS points tax professionals to Publication 4557, "Safeguarding Taxpayer Data," as its recommended starting point. It covers security measures, a plan checklist and the Safeguards Rule, with a focus on employee management and training, information systems, and managing system failures. In plain terms, that asks who can reach taxpayer information and what staff are taught, where taxpayer data lives and how it is protected, and what you do when something breaks, is lost or is breached.
First, I would read the checklist with the person who runs your office and mark each item done, partly done or not done, remembering that most small offices have more in place than they realize. Second, I would put one person's name next to every item, because a plan with owners is a plan that gets maintained. Third, I would turn the list into plain sentences, which becomes your first draft. It should describe how your office really works, since software helps carry out a plan but the people are what make it hold. Finally, I would revisit it whenever staff, software or vendors change.
A written plan is also often the first thing a careful client or insurer asks to see, which is one more reason to have it on paper. It should not be a binder written to satisfy someone and then shelved, because a plan that promises controls nobody uses is worse than a modest plan that is accurate.
When you want a plan you can stand behind, my calendar is open for a call with AssureRidge Cyber.