Email and Microsoft 365 security, where applicable; MFA, administrator privileges, and employee access.
Protect client records. Keep your WISP current.
Cybersecurity for Accounting and Tax Preparation Firms
Accounting and tax preparation firms hold some of the most sensitive personal and financial data any small business handles. Email, Microsoft 365, tax-preparation software, client portals, remote access, and backups all affect whether that data—and your firm's Written Information Security Plan—hold up to scrutiny.
Independent verificationWorks alongside your IT provider or software vendorEvidence for the firm's qualified individualPrioritized findings
We agree the internal settings and records to review before starting.
Who this is for
Practical guidance for firms with sensitive client information.
This page is for small and midsize CPA and accounting firms, independent tax practices, enrolled agents, seasonal tax teams, and bookkeeping or payroll businesses. Their systems and legal obligations can differ, so each engagement is scoped to the firm's actual operations.
Where information can be exposed
- A compromised mailbox reveals tax documents or enables payment fraud.
- A client folder is shared more broadly than intended.
- Seasonal staff retain access after their work ends.
- Remote access or unmanaged devices expose sensitive information.
- Backups exist, but recovery has not been demonstrated.
- A written policy describes controls nobody has verified.
Your IT provider and an independent review
Keep your existing IT provider and obtain an independent review of relevant safeguards. Findings and responsibilities are documented for the people who operate your environment.
Within the agreed scope
What we help review
Accounting and tax firms often focus attention on the tax-preparation software itself. But many disruptive incidents begin in ordinary business systems: an email account, an exposed remote-access service, a compromised administrator account, a shared client-document folder, or a backup that cannot be restored.
Client portals, document sharing, permissions, endpoint and remote-access safeguards.
Backup and recovery evidence; staff phishing readiness and reporting procedures.
Security policies, incident responsibilities, and WISP alignment.
Relevant vendors and service providers.
Choose the right starting point.
Choose the service that matches the question you need answered. The free review is public-only; the Baseline verifies internal safeguards within its published scope; WISP support focuses on tailored documentation and implementation priorities.
Start outside. Verify inside when necessary.
Free Zero-Access Exposure Review™
Identify the public security signals surrounding the firm's email, domains, websites, certificates, and internet-facing services.
- SPF, DKIM, and DMARC
- Lookalike domains
- Public subdomains and services
- Observable remote-access services
- Website and certificate posture
- Potential vulnerability matches requiring validation
Business Security Baseline
Verify essential business IT safeguards and receive evidence the firm's qualified individual and IT provider can use.
- Microsoft 365 identity and access
- MFA on tax-software and e-file access
- Administrative protections
- Sharing and available logging
- Backup and recovery evidence
- Incident, insurance, and client-request readiness
Preparing for a cyber insurance application or renewal? Use this checklist to gather evidence and flag gaps.
Phishing readiness
Preparers and front-office staff both handle unexpected client and vendor requests.
Tax firms often receive new-client document requests, IRS or state-agency impersonation, portal-notification lures, and payment or billing-change messages. A properly scoped phishing test can measure whether selected participants pause to verify the request, protect credentials, and report suspicious messages rather than acting on urgency alone.
Use participant-based pricing and confirm the exact campaign audience before work begins.
For recurring staff practice, Security Awareness Training provides weekly decision scenarios, feedback, and participation records. An optional annual combination adds four authorized simulated-email campaigns, campaign follow-up, reports, and a leadership readout; the training and simulations remain distinct deliverables.
The Managed Human-Risk Program adds ongoing client-portal, new-client document, and tax-agency impersonation scenarios, auto-assigned learning, and a shared dashboard with quarterly readouts. Training records give your WISP discussion a dated view of completed practice.
Scope a managed program for your firmPractical deliverables
Receive findings, prioritized improvements, and clear responsibilities for your firm and IT provider. Documentation updates and a leadership walkthrough are included when agreed.
Questions from accounting and tax firms
Do small tax preparation firms need a written security plan?
The FTC Safeguards Rule includes tax preparation firms among covered financial institutions, and the IRS provides WISP guidance. The exception for institutions holding information about fewer than 5,000 consumers applies to certain provisions; it is not a blanket exemption. Accounting and bookkeeping services should assess their obligations based on their activities.
Can you work with our existing IT provider?
Yes. We can review agreed evidence and give your firm and IT provider clear responsibilities and prioritized next steps without replacing ongoing IT support.
Can you review our Microsoft 365 and client-sharing settings?
Yes, when included in the agreed scope. The Business Security Baseline reviews relevant Microsoft 365 identity, access, sharing, and logging evidence.
How should we handle seasonal staff access?
Use documented provisioning, least-privilege access, MFA where applicable, and timely offboarding. We can review evidence of those practices within the agreed scope.
Do we need to send you actual client tax returns?
Initial scoping does not require taxpayer records. Evidence collection should minimize sensitive data and use read-only exports, screenshots, or documentation where practical. Some assessments may still require authorized access or carefully selected evidence to verify specific controls.
Do you draft our Written Information Security Plan (WISP)?
Yes, tailored WISP development or review documents your firm's systems, responsibilities, and planned safeguards, with evidence review as agreed. The IRS offers a free starting template in Publication 5708.
Does the Business Security Baseline guarantee FTC Safeguards Rule or IRS compliance?
No. The Baseline verifies agreed essential business IT safeguards and provides evidence to discuss with your legal and tax-practice advisors.
Can the free review examine our tax-preparation software or client portal directly?
No. The free Zero-Access Exposure Review™ looks only at public signals—email authentication, domains, and internet-facing services. Confirming access controls, MFA enforcement, and configuration inside tax-preparation software requires an authorized assessment such as the Business Security Baseline.
What does the $1,995 price cover?
It covers the defined Business Security Baseline for businesses with up to 25 employees. Larger or materially more complex environments receive a confirmed price after scoping.
Verify the safeguards protecting your client data.
Start with what is visible from the outside, then verify the controls protecting the client tax data your firm is responsible for.