What CPA and tax firms must protect, and how to do it without slowing tax season

The short answer

Accounting and tax firms hold exactly what criminals want: Social Security numbers, bank details, income records and the ability to file returns. In the U.S., tax preparers are treated as financial institutions under the FTC Safeguards Rule, which requires a written information security plan, a qualified person in charge of it, multi-factor authentication, encryption of customer information, vendor oversight and, since May 2024, notice to the FTC within 30 days of discovering a breach involving 500 or more consumers.

The IRS reinforces this through Publication 4557, Safeguarding Taxpayer Data, and a sample plan template in Publication 5708. This article turns those requirements into a practical plan for a 10 to 100 person firm. It is general information, not legal advice; confirm your obligations with counsel.

What the FTC Safeguards Rule requires

The rule sits at 16 CFR Part 314. In plain terms, a covered firm must:

• Name a qualified individual to oversee the security program. It can be an employee or an outside provider, but the firm stays responsible.
• Write a risk assessment covering where client data lives and what could go wrong.
• Put safeguards in place, including access controls, an inventory of systems and data, encryption of customer information in transit over external networks and at rest, and multi-factor authentication for any individual accessing any information system.
• Train staff and keep security awareness current.
• Oversee vendors that touch client data, including contract terms.
• Keep an incident response plan and test or monitor safeguards.
• Report in writing at least annually to the owners or a senior officer.
• Notify the FTC no later than 30 days after discovering an event involving unencrypted information of at least 500 consumers.

Firms that keep data on fewer than 5,000 consumers are exempt from a few parts, including the written risk assessment, the written incident response plan and the annual report, under section 314.6. They are not exempt from MFA, encryption, training or the plan itself.

What the IRS expects

IRS Publication 4557 is the IRS’s practical guide for tax professionals, and the IRS’s Taxes-Security-Together checklist tells preparers to create a data security plan with the elements the FTC requires: a coordinator, a risk assessment, safeguards, vendor oversight and ongoing review. The IRS and its Security Summit partners also promote a “Security Six” baseline: antivirus software, firewalls, two-factor authentication, backups, drive encryption and a VPN for remote access.

Publication 5708 gives a sample written information security plan (WISP) you can adapt. Use it as a structure, then fill it with what you actually do, because a template that does not match reality is worse than none when something goes wrong.

Securing client portals and file exchange

Email attachments are still a common way clients send W-2s, 1099s and bank statements. They are also the riskiest. A client portal fixes much of that, if it is set up well.

• Require multi-factor authentication for staff and, where the portal supports it, for clients
• Turn off file sharing by anonymous link for anything with taxpayer data
• Set expiration on shared links and remove old client folders on a schedule
• Encrypt email when a file must go by email, and never send passwords in the same message
• Limit staff access to the clients they actually work on
• Log downloads and review admin activity monthly

If your firm runs on Microsoft 365, our guide to Microsoft 365 security settings for small businesses covers the tenant settings behind secure sharing.

Tax-season phishing: what to expect

Attacks rise between January and April because staff are busy and clients send documents constantly. Common patterns:

• New client lures. A “prospect” emails a link to their tax documents that leads to a fake Microsoft or Google sign-in page.
• Fake IRS or software vendor notices. Messages claiming your e-file account or tax software license needs verification.
• Account takeover. Stolen preparer credentials used to file fraudulent returns or change refund deposit details.
• Payment fraud. A hijacked client or vendor email thread asks you to send funds to new bank details.

Defenses that work: phishing-resistant MFA for staff, email filtering with link and attachment scanning, external-sender banners, a rule that every banking change is confirmed by phone using a known number, and a short refresher training each December before the season starts.

Want a clear view of your firm’s security before tax season? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

A priority checklist for small accounting firms

1. Turn on multi-factor authentication for email, tax software, the portal, remote access and any cloud accounting platform.
2. Encrypt every laptop and any server or NAS that holds client data.
3. Back up client files and tax software data daily, keep a copy offline or immutable, and test a restore before the season.
4. Write or update your WISP using Publication 5708, and name your qualified individual.
5. Remove leavers and seasonal staff the same day their work ends.
6. Patch computers, tax software and browsers on a regular schedule.
7. Review vendor contracts for security terms, including your portal and IT providers.
8. Document an incident response plan: who to call, how to contact the IRS and the FTC, and how to reach your insurer and counsel.
9. Review your cyber-insurance application so your answers match reality. Our guide to cyber insurance requirements in 2026 lists what carriers commonly ask.

If you suspect a breach

1. Disconnect affected devices from the network but do not wipe them.
2. Call your IT provider and your cyber insurer’s breach line before hiring anyone else.
3. Contact counsel about state notification duties and the FTC requirement.
4. Report data theft to the IRS through your IRS Stakeholder Liaison, as the IRS advises tax professionals to do.
5. Change passwords and review e-file and bank account activity.

Remote and seasonal staff

Many firms add seasonal preparers and remote reviewers every January. Each one is a new set of accounts and devices touching taxpayer data.

• Create accounts from a checklist with only the client folders and software each person needs
• Provide firm-managed laptops where possible; if personal devices are allowed, require encryption, updates, a screen lock and endpoint protection
• Use secure remote access with multi-factor authentication, never remote desktop exposed to the internet
• Set an end date on seasonal accounts when you create them
• Collect equipment and remove access the day the season ends

Add these steps to your written plan so the qualified individual can show they happened.

How JLB USA helps

JLB USA’s cybersecurity services cover the safeguards these rules describe: multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores, a written recovery plan and help with cyber-insurance questionnaires. We do not give legal advice, so confirm your compliance obligations with counsel.

Keep reading

• Cybersecurity for small manufacturers: ransomware, OT and supplier demands
• Cybersecurity for nonprofits: protect donor data on a tight budget
• Acceptable use policy template: what to include and how to roll it out
• Backup and disaster recovery for small business: a practical plan

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Managed IT services
• Cyber insurance requirements in 2026