Cybersecurity for accountants and tax preparers

Why cybersecurity for accountants is critical

Cybersecurity for accountants is about more than just technology; it is about protecting the financial lives of your clients. Accountants hold Social Security numbers, bank account details, and full income histories. This data is highly valuable on the black market, as it allows criminals to file fraudulent tax returns and open lines of credit in a client's name. A breach can lead to devastating identity theft for your clients and professional ruin for your firm. The trust that takes years to build can be lost in a single afternoon if a client's data is exposed.

Beyond the financial risks, accountants face strict regulatory requirements. The Federal Trade Commission (FTC) Safeguards Rule requires non-banking financial institutions, including many accounting firms, to develop, implement, and maintain a comprehensive security program. Failing to do so can result in significant fines and legal liability. As the tax world becomes increasingly digital, the expectations for how that data is handled are only going to rise.

Meeting the FTC Safeguards Rule

The FTC Safeguards Rule requires firms to have a written Information Security Plan (WISP). This is not a set it and forget it document. It must be tailored to the size and complexity of your firm and the nature of the data you handle. Key requirements include designating a qualified individual to oversee the program, conducting regular risk assessments, and monitoring service providers. Every firm, regardless of size, must show they are taking active steps to protect client information.

• Designate an employee or a third party to be responsible for your security program.
• Identify and assess risks to client information in each area of your operation.
• Design and implement a safeguards program and regularly test it.
• Select service providers that can maintain appropriate safeguards and oversee their handling of data.
• Update your security program based on the results of your testing and any changes to your business operations.

Protecting the tax preparation process

The IRS has highlighted Security Summit initiatives to help tax professionals protect their data. One of the most common ways accountants are targeted is through spear-phishing emails. These emails look like they come from the IRS, a software provider, or even a new client. They often contain a link to a fake login page or an attachment with malware designed to steal your software credentials. Training staff to recognize these sophisticated attacks is a vital part of cybersecurity for accountants.

Managing seasonal staff and temporary access

The busy season often requires hiring temporary or seasonal staff to handle the increased workload. This creates a unique security challenge. These employees need access to sensitive systems, but that access must be carefully managed and promptly removed once their contract ends. Every seasonal employee should receive the same security training as permanent staff and be required to follow all firm security policies, including the use of MFA and secure portals.

Firms should also implement 'least privilege' access, ensuring that seasonal staff only have access to the specific clients and files they are assigned to work on. This limits the potential damage if a temporary employee's account is compromised.

Basic security steps for every firm

You do not need to be a giant firm to have effective security. Start with the basics that provide the most protection for the least cost. Multi-factor authentication is the single most important step you can take. It prevents an attacker from accessing your email or tax software even if they steal your password. For an accountant, this layer of protection is the difference between a minor incident and a full-blown catastrophe.

1. Use a professional-grade antivirus and firewall on all computers.
2. Encrypt all client data, both when it is stored on your computers and when it is being sent over the internet.
3. Automatically lock your computer screen when you step away from your desk.
4. Securely dispose of old records by shredding paper documents and using wiping software for old hard drives.
5. Use a password manager to ensure all staff are using strong, unique passwords for every service.

Client communication and secure portals

Email is not a secure way to send tax documents. A standard email can be intercepted like a postcard in the mail. Encourage your clients to use a secure client portal for uploading their W-2s, 1099s, and other sensitive forms. This not only protects the data but also organizes it for easier processing. If a client insists on using email, require them to password-protect the document and send the password via a separate method like a text or phone call. This adds an essential layer of security to the most vulnerable part of the process.

The shift to the cloud: risks and rewards

Many accounting tools have moved to the cloud, offering better collaboration and accessibility. However, this means your data is now living on someone else's servers. Cybersecurity for accountants must include a thorough review of the security practices of your cloud providers. Ensure they offer features like encryption at rest and in transit, and that they have a clear policy for how they handle and backup your data. Moving to the cloud can improve your security, but only if you choose your partners wisely.