# Security for CPA firms and tax practices

> Accounting and tax firms that prepare returns are covered by the FTC Safeguards Rule, and the IRS tells every preparer to keep a written information security plan. CyberAccord helps firms write that plan, appoint a qualified individual, enforce multi-factor authentication and encryption, protect staff devices and email, and test their defenses.

Source: https://www.cyberaccord.com/industries/accounting-firms · Last reviewed: 2026-10-22

Tax preparers are financial institutions under the FTC Safeguards Rule, and the IRS expects every practice to have a written information security plan. We help firms write that plan, put its controls in place and keep them running.

## Key facts

- **Federal rule:** FTC Safeguards Rule, 16 CFR Part 314
- **IRS guidance:** Publications 4557 and 5708
- **Core document:** Written information security plan
- **Breach notice:** FTC notice for qualifying events

## The obligations and risks you face

### Tax preparers are financial institutions

The Safeguards Rule names an accountant or tax preparation service in the business of completing income tax returns as a financial institution. That brings the full set of required elements: a Qualified Individual, a written risk assessment, access controls, encryption of customer information and multi-factor authentication for anyone accessing your systems.

Source: [16 CFR 314.2 and 314.4 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314)

### The IRS expects a written security plan

IRS Publication 4557 states that protecting taxpayer data is the law and that tax return preparers must create and enact security plans under the Safeguards Rule. It warns that failing to do so may lead to an FTC investigation, and it points online providers to the e-file standards in Publication 1345.

Source: [IRS Publication 4557, Safeguarding Taxpayer Data](https://www.irs.gov/pub/irs-pdf/p4557.pdf)

### The plan must fit your firm and be kept current

IRS Publication 5708 gives a sample written information security plan for tax and accounting practices. It expects the plan to cover every required element while scaling to the size of the firm, with named responsibilities, staff training, vendor oversight and an incident response procedure.

Source: [IRS Publication 5708 (Rev. 8-2024)](https://www.irs.gov/pub/irs-pdf/p5708.pdf)

### Some incidents must be reported to the FTC

Since the 2023 amendment, a covered firm must notify the FTC no later than 30 days after discovering that unencrypted customer information of at least 500 consumers was acquired without authorization. State breach laws apply as well, and Publication 4557 asks preparers to report data theft to their IRS Stakeholder Liaison.

Source: [16 CFR 314.4(j), Notification to the Commission](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4)

## What we recommend

- [Managed Security](https://www.cyberaccord.com/services/managed-security)
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso)
- [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing)

## Applicable frameworks

- [FTC Safeguards Rule](https://www.cyberaccord.com/compliance/ftc-safeguards-rule)
- [SOC 2](https://www.cyberaccord.com/compliance/soc-2)
- [NIST](https://www.cyberaccord.com/compliance/nist)

## Frequently asked questions

### Is a WISP legally required for a small tax practice?

Yes. The FTC Safeguards Rule requires covered tax preparers to keep a written information security program, and IRS Publication 4557 says so directly. Firms with records on fewer than five thousand consumers are exempt from a few elements, such as the written risk assessment, the written incident response plan and the annual report, but not from the program itself.

### Who should be our Qualified Individual?

Someone accountable for the program, inside the firm or at a service provider. If you use a provider, the rule still requires the firm to keep responsibility, designate a senior person to oversee the provider, and require the provider to maintain its own program.

### Does the Safeguards Rule require penetration testing?

For most covered firms, yes. Unless you have effective continuous monitoring, the rule requires annual penetration testing and vulnerability assessments at least every six months. Firms with records on fewer than five thousand consumers are exempt from that schedule, but must still regularly test or monitor whether their safeguards work.

### How do we cut the risk of client portal and email compromise?

Enforce multi-factor authentication on email, the portal and tax software, apply managed email protection, encrypt laptops, and verify any request to change refund or payment details by phone using a number already on file.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com