Cybersecurity built for CPA firms and tax preparers
Practical protection for client data, mapped to IRS Publication 4557 and the FTC Safeguards Rule, and sized for small and midsize firms.
What we put in place
Every firm is different, so we start with a check-up. These are the safeguards we most often set up and manage.
Multi-factor authentication
On email, Microsoft 365 or Google Workspace, tax and accounting software, remote access, IRS e-Services, and client portals. Phishing-resistant options where practical.
Email security
Spam and malware filtering, SPF, DKIM, and DMARC for your domain, external-sender warnings, and rules that flag look-alike domains.
Phishing awareness
Short, regular training and simulated phishing so staff can spot fake clients, fake IRS notices, and invoice fraud.
Backups that restore
Automated, encrypted, off-site backups of workstations, servers, and cloud data, with at least one copy kept out of reach of ransomware. We test restores.
Device encryption & endpoint protection
BitLocker or FileVault on every laptop and desktop, managed anti-malware, automatic updates, screen locks, and the ability to wipe a lost device.
Secure client file sharing
A client portal or encrypted sharing in place of emailed tax documents, with access limited to the people who need it.
Password manager
A business password manager so every login is long and unique, shared logins are controlled, and access can be removed in one place.
Network & remote access
A managed firewall, separate guest Wi-Fi, and a VPN or secure remote access for staff working from home or on the road.
Incident response
A written plan for who to call and what to do if something goes wrong, plus hands-on help to contain, recover, and document.
Protect your credentials, not just your computers
Criminals target tax professionals to file fraudulent returns using stolen client data or a firm’s own e-file credentials. We help you:
- Lock down IRS e-Services, PTIN, and tax software accounts with MFA and unique passwords.
- Remove access the same day someone leaves the firm.
- Watch the number of returns filed under your EFIN during filing season, as the IRS recommends, so anything unexpected stands out early.
- Encourage clients to use the IRS Identity Protection PIN program.
Meet the WISP requirement
The FTC Safeguards Rule requires a written information security program. The IRS PTIN application and renewal, Form W-12, asks preparers to acknowledge they are aware of that requirement.
We help you write a WISP based on IRS Publication 5708, then actually put the safeguards it describes in place.
Security questions we hear often
Is MFA required for tax preparers?
The FTC Safeguards Rule requires multi-factor authentication for anyone accessing customer information on your systems. The IRS also lists MFA among its Security Six basics for tax professionals.
What should we do if we think client data was stolen?
Act quickly. The IRS asks tax professionals to contact their IRS Stakeholder Liaison, and state tax agencies should be notified too. Under the FTC Safeguards Rule, a breach involving unencrypted information of 500 or more consumers must be reported to the FTC within 30 days of discovery. Colorado has its own breach notice law. Talk with your attorney and insurer, and call us to help contain the incident.
Do we need a client portal?
Email attachments are hard to secure and easy to misdirect. A portal or encrypted sharing tool gives clients a safer way to send documents and gives you a record of who accessed what.
Sources: IRS Publication 4557, Safeguarding Taxpayer Data; IRS Publication 5708; FTC, “FTC Safeguards Rule: What Your Business Needs to Know”; Instructions for Form W-12. This page is general information, not legal advice.
Start with a free security check-up
We review how your firm handles client data today, then give you a short, plain-English list of what to fix first. No obligation.