Cover graphic titled Cybersecurity for law firms: a small practice guide, with a gold shield and a scales of justice icon on a navy background

Cybersecurity for Accounting Firms and Tax Preparers

Written by

Cybersecurity for Accounting Firms and Tax Preparers

An accounting firm holds Social Security numbers, bank details and tax returns for every client. In the United States it also has a legal duty to protect them: tax preparers count as financial institutions under federal law, which brings the FTC Safeguards Rule and a written security plan.

Quick answer: In the US, professional tax preparers are treated as financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule requires a written information security plan (WISP): a named Qualified Individual, a written risk assessment, MFA, encryption, testing, staff training, vendor oversight and an incident response plan. IRS Publication 5708 gives a WISP template. Breaches affecting 500 or more consumers must be reported to the FTC within 30 days. This is general information, not legal advice.

Key takeaways

  • A WISP is a legal expectation, not just good practice, for tax return preparers (IRS Publication 4557).
  • Name one responsible person. The Safeguards Rule requires a Qualified Individual.
  • Lock down email and payments. Fake invoices and changed bank details are the standard fraud.
  • Know the breach steps. The IRS lists specific people to contact after a client data theft.

On this page: The rules · What a WISP covers · What to do first · Fraud · After a breach · Insurance · FAQ

What rules apply to accounting firms?

  • FTC Safeguards Rule. Under the Gramm-Leach-Bliley Act, IRS Publication 4557 says, professional tax preparers are financial institutions, and the Rule requires them to create and enact security plans to protect client data. The IRS warns that failing to do so may result in an FTC investigation.
  • IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data, sets out the expectations; Publication 5708 provides a WISP template.
  • State laws and professional standards may add requirements, such as breach notification laws. Ask your state CPA society or counsel.

The FTC exempts firms that hold information on fewer than 5,000 consumers from certain provisions of the Rule, but the FTC guidance does not spell out which, and the core duty to protect client data remains. Ask a professional before relying on the exemption.

What must a written information security plan cover?

Diagram of eight FTC Safeguards Rule requirements: Qualified Individual, written risk assessment, MFA, encryption, testing, staff training, service provider oversight and incident response plan
What the FTC Safeguards Rule expects a plan to cover, per FTC guidance. Breaches of 500 or more consumers must be reported to the FTC within 30 days.

Per the FTC’s guidance, the plan should include:

  • A Qualified Individual who runs the program (an employee or a provider’s staff).
  • A written risk assessment of internal and external risks, reassessed periodically.
  • Multi-factor authentication for anyone accessing customer information, unless the Qualified Individual approves an equivalent in writing.
  • Encryption of customer information at rest and in transit, or approved alternatives.
  • Testing: annual penetration testing and vulnerability scans every six months, unless you use continuous monitoring.
  • Training: regular security awareness training, with specialist training for staff who need it.
  • Service provider oversight: choose providers carefully, set expectations in contracts, and monitor them.
  • A written incident response plan covering roles, communications, remediation and review.
  • Annual written reporting by the Qualified Individual to the owners or governing body.

Our free security policy generator drafts six of the written policies you will need, but it does not produce a WISP and is not legal advice; use IRS Publication 5708 and your adviser for the WISP itself.

What should a small firm do first?

  1. Name your Qualified Individual and start the written risk assessment.
  2. Turn on MFA everywhere client data is reachable: email, tax software, document portals, remote access. See what MFA is.
  3. Encrypt laptops, phones, backups and the files you send. Use a secure client portal instead of email attachments.
  4. Protect devices with endpoint protection that someone monitors: endpoint protection vs antivirus.
  5. Back up and test restores, and keep one copy isolated: backup strategy.
  6. Train everyone, especially seasonal staff, before busy season: security awareness training.
  7. Review your vendors: tax software, cloud storage, IT provider.
  8. Write the incident plan and keep the contacts handy: incident response plan template.

Software options and published prices: best cybersecurity software for small business. A free tick-list: 12-step checklist.

Why are accounting firms targeted for fraud?

Firms hold the data needed to file fraudulent returns and handle client payments. The FBI’s Internet Crime Complaint Center received 24,768 business email compromise complaints with about $3.05 billion in reported losses in 2025, across all industries. Attackers impersonate clients asking to change bank details, or impersonate you to clients. Rules that stop this: no change of bank details without a call-back on a known number, MFA on email, and dual approval for payments. See business email compromise and how to spot a phishing email.

What should you do after a client data theft?

IRS Publication 4557 lists these steps for tax professionals:

  1. Report the theft to your local IRS Stakeholder Liaison.
  2. Contact the FBI’s local office if the IRS directs you to.
  3. File a police report.
  4. Contact the state tax agencies where you prepare returns.
  5. Hire a security expert to find the cause and scope, stop it and prevent a repeat.
  6. Notify your insurance company and check coverage.
  7. For ransomware, also contact the FBI and CISA.

Separately, the FTC requires financial institutions to notify it as soon as possible, and no later than 30 days after discovery, of a breach involving unencrypted information of at least 500 consumers. Check your state’s breach notification law and your policy’s notice requirements.

Does an accounting firm need cyber insurance?

Not by law, but incident costs add up: forensics, notification, downtime and fraud. Many policies require MFA, endpoint protection, backups and training. See cyber insurance requirements, what it costs and our free readiness check. Note that professional liability (E&O) insurance often excludes or limits cyber events, so check both policies.

Frequently asked questions

Do accountants need a written information security plan?

Tax return preparers are expected to have one under the FTC Safeguards Rule, per IRS Publication 4557. IRS Publication 5708 provides a template.

What is IRS Publication 5708?

A template and guidance for creating a written information security plan (WISP) for tax professionals, aligned with the FTC Safeguards Rule.

Do I have to report a data breach to the FTC?

Financial institutions must notify the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers.

What cybersecurity does a small accounting firm need?

MFA, encryption, endpoint protection, tested backups, staff training, vendor review, payment-verification rules and a written security and incident plan.

What should I do if client data is stolen?

Follow IRS Publication 4557: contact your IRS Stakeholder Liaison, the FBI if directed, police, state tax agencies, a security expert and your insurer.

Does the Safeguards Rule apply to small firms?

Yes, tax preparers of any size are covered, though the FTC exempts firms with information on fewer than 5,000 consumers from certain provisions. Confirm with an adviser.

Sources

SMB Security HQ provides general information, not legal, tax, financial or professional security advice. Regulations change; confirm current requirements with the IRS, FTC or a qualified adviser. See our Affiliate Disclosure and How We Test.