Accounting firms trade returns, W-2s and bank details with clients all year, and most heavily when attackers are busiest. We help firms meet the FTC Safeguards Rule and IRS security expectations without slowing down the work.
Tax and accounting data unlocks refunds, accounts and identities, which makes firms of every size a target.
Phishing and fake-client scams peak when your team is busiest. One compromised mailbox can expose hundreds of returns.
Source documents and finished returns often move as unencrypted attachments that can be forwarded, misdirected or intercepted.
The FTC Safeguards Rule requires a written plan, and the IRS expects every paid preparer to have one in place.
Tax preparers count as financial institutions under federal privacy law, so the FTC's Safeguards Rule applies.
A written information security plan is required. IRS Publication 5708 gives firms a template to start from.
Multi-factor authentication is required for anyone accessing customer information on your systems.
to notify the FTC after discovering a breach involving unencrypted data on 500 or more consumers.
Sources: FTC Safeguards Rule guide · IRS Publication 5708 · IRS Publication 4557
The technical safeguards your WISP describes, put in place and kept running.
A branded, encrypted place for clients to upload source documents and download finished returns, instead of email.
See Secure File Share →Encrypted, patched and monitored machines with multi-factor login for every preparer.
Workstation support →Encrypted, versioned backups so a ransomware hit in March doesn't stop the season.
Backup & storage →Hardened email, MFA and phishing protection where most tax-season attacks start.
Cloud applications →Give seasonal and remote staff secure access to tax software without data leaving the office.
Virtual desktop →Help mapping your WISP to the controls you actually run, and closing the gaps.
Consulting →Your plan has to reflect how your firm actually operates, so you own it. We help you put the technical controls in place and document them accurately, and IRS Publication 5708 is a good template to start from.
Yes. You can send a client an upload-only link protected by a password and expiration date, so they never see anyone else's files.
Yes. We secure the devices, network and accounts around the software you already use rather than replacing it.
Yes. The Safeguards Rule applies regardless of size, though firms holding data on fewer than 5,000 consumers are exempt from some requirements.