IRS Publication 4557 Compliance: Complete Security Checklist for CPA Firms

Critical October Deadline: Tax Season Security Preparation

October marks the critical window for CPA firms to harden security before tax season. With peak filing season (January-April) approaching, now is the time to complete your annual WISP review, update security controls, and train employees. Firms that wait until December face compressed timelines and increased breach risk during the busiest period of the year.

Executive Summary: What Every Tax Professional Must Know

IRS Publication 4557, titled "Safeguarding Taxpayer Data: A Guide for Your Business," represents more than just guidance—it's the foundation for federal compliance requirements that every tax return preparer must follow. Whether you're a solo practitioner, regional CPA firm, or national tax preparation service, understanding and implementing these security standards is both a legal obligation and essential protection for your clients' most sensitive financial information.

The Federal Trade Commission's Safeguards Rule, which Publication 4557 helps you implement, requires ALL professional tax return preparers to develop, implement, and maintain a comprehensive Written Information Security Plan (WISP). This isn't optional guidance—it's federal law with enforcement mechanisms including civil penalties, loss of professional credentials, and potential criminal liability in cases of willful negligence.

Who Must Comply

Federal law applies to any individual or business that prepares or assists in preparing federal tax returns for compensation. This includes:

Certified Public Accountants (CPAs) and CPA firms of all sizes
Enrolled Agents and tax preparation specialists
Tax preparation franchises and independent offices
Accounting firms offering tax services
Attorneys who prepare tax returns
Any business using an IRS Preparer Tax Identification Number (PTIN)

Even if you only prepare a handful of returns annually, if you do so for compensation, you must comply. The FTC doesn't provide exemptions based on firm size or return volume.

What's at Stake

Consequences of Non-Compliance:

FTC Civil Penalties: Up to $46,517 per violation
State Disciplinary Actions: License suspension or revocation
Client Lawsuits: Negligence claims and breach of fiduciary duty
IRS Sanctions: Loss of PTIN and ability to file electronically
Reputational Damage: Public breach notifications destroy client trust
Insurance Issues: Many E&O policies exclude inadequate security
Criminal Liability: Willful negligence can lead to criminal charges

Beyond legal consequences, the practical impact of a data breach during tax season can be catastrophic. A single compromised system in January could expose thousands of Social Security numbers, W-2 data, bank account information, and personally identifiable information (PII)—everything needed for tax refund fraud and identity theft. The average cost of a data breach in the professional services sector now exceeds $5.5 million when you account for notification costs, credit monitoring, legal fees, regulatory fines, and lost business.

Written Information Security Plan (WISP) Requirements

The cornerstone of IRS Publication 4557 compliance is your Written Information Security Plan. This isn't a simple document you download and file away—it's a living, breathing framework that must be customized to your specific practice, regularly updated, and actively implemented across every aspect of your operations.

Core WISP Components Required by FTC Safeguards Rule

1. Designation of Security Coordinator

You must designate a qualified individual to coordinate your information security program. This person (often called the Chief Information Security Officer or Security Coordinator) must have:

Authority to implement and enforce security policies
Adequate knowledge of information security principles
Regular reporting relationship to senior management or ownership
Documented responsibilities and authority in the WISP

In smaller firms, this is typically a partner or owner. Larger firms may hire dedicated security personnel or engage a virtual CISO (vCISO) to fill this role.

2. Comprehensive Risk Assessment

Your WISP must document a thorough risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. This assessment should evaluate:

Information Assets: Where taxpayer data is stored, transmitted, and processed
Access Points: Who can access data and through what systems
Third-Party Risks: Cloud providers, software vendors, subcontractors
Technical Vulnerabilities: Unpatched software, weak configurations, outdated systems
Human Factors: Phishing susceptibility, password practices, remote work risks
Physical Security: Office access, device theft, document disposal
Business Continuity: Backup failures, ransomware, natural disasters

The IRS recommends conducting this assessment annually and whenever significant changes occur (new software, office relocation, staff changes, new service offerings). Many firms complete this assessment in October as part of tax season preparation.

3. Safeguards to Control Identified Risks

Based on your risk assessment, you must design and implement appropriate safeguards organized into three categories:

Administrative Safeguards

Security policies and procedures documentation
Employee training programs (initial and annual refresher)
Access control policies and least-privilege principles
Vendor management and third-party due diligence
Incident response and breach notification procedures

Physical Safeguards

Building and office access controls
Secure document storage and destruction
Workstation positioning and privacy screens
Device inventory and asset management
Clean desk policies for sensitive information

Technical Safeguards

Encryption of data at rest and in transit
Multi-factor authentication for all access
Firewall and network security controls
Antivirus and anti-malware protection
Regular software updates and patch management
Secure backup and disaster recovery systems
Security monitoring and logging

4. Service Provider Oversight

Your WISP must address how you select, contract with, and oversee service providers that have access to customer information. Required elements include:

Due diligence process before engaging vendors
Written contracts requiring vendors to maintain appropriate safeguards
Periodic assessments of vendor security measures
Documentation of vendor security capabilities

This applies to tax software vendors (Drake, Intuit Lacerte, CCH, Thomson Reuters), cloud storage providers, email services, document management systems, IT support contractors, and any other third party touching taxpayer data.

5. Continuous Evaluation and Adjustment

Your WISP must include provisions for regular monitoring and testing of safeguards, including:

Annual review and update of the security plan
Regular vulnerability assessments and security testing
Monitoring of safeguard effectiveness
Updates based on changes to business operations or emerging threats
Documentation of reviews, tests, and resulting changes

The FTC explicitly requires that your WISP be a living document, not a one-time compliance exercise. October reviews are standard practice, allowing time to address gaps before tax season.

IRS Publication 5708: Your WISP Template Resource

The IRS provides Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice," which includes a customizable WISP template. This 29-page document walks you through each required section with explanations, examples, and fillable sections.

Download it from the IRS website or work with a security advisory firm to create a customized WISP that addresses your specific practice environment, technology stack, and risk profile.

Administrative Safeguards for Tax Data Protection

Administrative safeguards form the policy and procedural foundation of your security program. These are the documented processes, training programs, and organizational structures that ensure security is embedded in your daily operations—not just implemented through technology.

Employee Security Training and Awareness

Human error remains the leading cause of data breaches in tax preparation. Employees who don't understand security policies can't follow them. Your WISP must document comprehensive training that includes:

Required Training Elements:

Initial Security Training: Within first week of employment for all staff with data access
Annual Refresher Training: Complete before tax season begins (October-November recommended)
Phishing Recognition: How to identify and report suspicious emails, especially fake IRS communications
Password Security: Creating strong passwords, using password managers, never sharing credentials
Physical Security: Locking workstations, securing documents, visitor protocols
Data Handling: Proper transmission of client data, approved tools, encryption requirements
Incident Reporting: How to report suspected breaches, security incidents, or policy violations
Work-from-Home Security: Securing home offices, using VPNs, protecting devices

Tax Season Phishing Alert

Cybercriminals dramatically increase phishing attacks against tax preparers during tax season. The IRS reports that fake IRS emails, W-2 scams, and client impersonation attempts surge from January through April. Schedule focused phishing training in December and send regular security reminders throughout tax season.

Access Controls and Least Privilege

Not everyone in your firm needs access to all client data. The principle of least privilege—giving employees only the access they need to perform their specific job functions—is a fundamental security control.

Access Control Requirements:

Role-Based Access: Define access levels by job function (tax preparer, admin, partner)
Unique User IDs: No shared accounts or generic logins
Strong Authentication: Complex passwords plus multi-factor authentication
Regular Access Reviews: Quarterly audits of who has access to what systems
Immediate Termination Procedures: Remove access within one hour of employee departure
Temporary Access Controls: Time-limited access for contractors or seasonal staff
Privileged Access Management: Enhanced controls for administrative accounts

Vendor Management and Third-Party Risk

Your tax software vendor, cloud storage provider, email service, and IT support contractor all represent potential points of compromise. The FTC Safeguards Rule explicitly requires you to manage these third-party risks through contracts and ongoing oversight.

Vendor Security Due Diligence Checklist:

Request SOC 2 Type II audit reports or equivalent security certifications
Review vendor's encryption practices (data at rest and in transit)
Verify vendor's incident response and breach notification procedures
Confirm vendor's backup and disaster recovery capabilities
Ensure written contract requires vendor to maintain appropriate safeguards
Include contractual right to audit vendor security practices
Require vendor notification of security incidents within 24 hours
Document vendor review annually or when significant changes occur

For tax software specifically, verify that your vendor complies with IRS security requirements for e-file providers and maintains their IRS Authorization. Major vendors (Intuit, Drake, CCH, Thomson Reuters) publish security documentation—request and review it annually.

Incident Response Planning

Your WISP must include documented procedures for responding to security incidents, from suspected phishing to confirmed data breaches. Having a plan in place before an incident occurs dramatically reduces response time and limits damage.

Incident Response Plan Components:

Incident Classification: Define severity levels and corresponding response procedures
Response Team: Designate specific individuals and their roles (security coordinator, legal, IT, management)
Containment Procedures: Steps to isolate affected systems and prevent spread
Investigation Process: How to determine scope, affected data, and root cause
Notification Requirements: Decision tree for when and how to notify IRS, FTC, clients, and law enforcement
Recovery Steps: System restoration, security improvements, lessons learned
Documentation Requirements: What to record during incident response for legal and regulatory purposes

Many firms test their incident response plan annually through tabletop exercises—simulated breach scenarios where the team walks through response procedures without an actual incident. Consider scheduling this exercise in October as part of tax season preparation. For detailed guidance on building incident response capabilities, see our incident response budget planning guide.

Physical Security Requirements for Tax Preparers

While much attention focuses on cybersecurity, physical security failures can be equally devastating. A stolen laptop containing unencrypted tax returns, documents left visible in unlocked offices, or paper files thrown in standard trash bins all represent serious compliance violations and data exposure risks.

Office and Building Access Controls

Required Physical Access Controls:

Controlled Entry: Locked doors requiring keys, cards, or codes
Visitor Management: Sign-in procedures, escort requirements, visible badges
After-Hours Security: Alarm systems, locked file rooms, secured workstations
Workspace Visibility: Position monitors away from public view, privacy screens on client-facing workstations
Secure Storage: Locked file cabinets or rooms for physical tax documents
Clean Desk Policy: No client documents left visible when workspace unattended
Printer and Copier Security: Secure release printing, immediate retrieval of sensitive documents

Device Security and Asset Management

Every laptop, desktop, tablet, smartphone, USB drive, and external hard drive that touches client data must be inventoried, secured, and tracked throughout its lifecycle.

Device Security Requirements:

Asset Inventory: Maintain complete list of all devices with access to taxpayer data
Full Disk Encryption: Encrypt all devices that store or access client information (BitLocker, FileVault, etc.)
Screen Lock Requirements: Automatic lock after 10 minutes of inactivity, password/PIN to unlock
Anti-Theft Measures: Cable locks for desktops, laptop locks, GPS tracking for mobile devices
Lost/Stolen Procedures: Immediate reporting, remote wipe capabilities, password reset protocols
Disposal Procedures: Secure data wiping before device disposal, certificate of destruction for hard drives
Removable Media Controls: Limit USB drive use, encrypt external drives, prohibit personal devices

Document Handling and Destruction

Despite increasing digitization, most CPA firms still handle substantial paper documents—W-2s, 1099s, bank statements, prior year returns. These physical documents contain the same sensitive data as digital files and require equivalent protection.

Paper Document Security Requirements:

Secure Receipt: Lock client documents immediately upon receipt, never leave in open areas
Access Controls: Restrict access to file rooms and cabinets to authorized personnel only
Workspace Management: No client documents on desks overnight or when staff away from workstation
Fax Security: Immediate retrieval of faxed documents, secure disposal of cover sheets
Shredding Requirements: Cross-cut shredders (minimum), locked shred bins, scheduled destruction services
Never Standard Trash: All documents containing PII must be shredded, never thrown in regular garbage
Client Document Return: Secure methods for returning original documents (encrypted email, certified mail, in-person pickup)

Common Physical Security Failure: Dumpster Diving

Identity thieves regularly target tax preparers' trash during tax season. Documents thrown in regular trash bins—even if torn up—can be retrieved and reconstructed. This represents both a compliance violation and a practical security failure. Every piece of paper with client information must be cross-cut shredded or professionally destroyed.

Work-from-Home Physical Security

Remote work has become standard in many accounting practices, but home offices often lack the physical security controls of commercial office spaces. Your WISP must address home office security explicitly.

Home Office Security Requirements:

Dedicated Workspace: Separate area with door that locks when not occupied
Family Member Restrictions: No access to work devices or documents by household members
Secure Storage: Locked drawer or cabinet for physical client documents
Device Security: Never leave work laptop, tablet, or phone accessible to others
Screen Privacy: Position monitors away from windows and common areas
Visitor Protocols: No work discussions or visible documents during service visits or guests
Secure Disposal: Personal shredders for home offices or secure transport of documents to office for destruction

Technical Safeguards: Encryption, Access Controls, and Monitoring

Technical safeguards represent the technology controls that protect taxpayer data from unauthorized access, theft, and compromise. While administrative and physical safeguards provide the framework, technical controls enforce protection through encryption, authentication, monitoring, and other security technologies.

Encryption Requirements

Encryption is non-negotiable for tax preparers. The FTC Safeguards Rule specifically requires encryption of customer information both at rest and in transit. This means client data must be encrypted when stored on devices, servers, or cloud systems, and when transmitted over networks or the internet.

Encryption Implementation Requirements:

Full Disk Encryption: All laptops, desktops, and mobile devices (BitLocker for Windows, FileVault for Mac, device encryption for mobile)
File-Level Encryption: Individual client files when stored on network drives or cloud storage
Email Encryption: Encrypted email for transmitting tax documents and PII (TLS 1.2 minimum, consider S/MIME or PGP for sensitive attachments)
Secure File Transfer: SFTP, HTTPS, or encrypted client portals—never unencrypted FTP or email attachments without encryption
Database Encryption: If you maintain client databases, encrypt at the database level
Backup Encryption: All backup media must be encrypted (especially offsite backups)
VPN Requirements: Encrypted VPN for remote access to office systems and when using public Wi-Fi

Encryption Standard: AES-256

The IRS recommends AES-256 encryption as the standard for protecting taxpayer data. This applies to full disk encryption, file encryption, and data in transit. Older encryption standards (DES, 3DES, early versions of AES) should be phased out. Verify that your tax software, cloud storage, and backup systems all support AES-256.

Multi-Factor Authentication (MFA)

The FTC Safeguards Rule explicitly requires multi-factor authentication for any individual accessing customer information. This means username and password alone are no longer sufficient—you must implement a second factor of authentication.

MFA Implementation Checklist:

Enable MFA on tax preparation software (Drake, Lacerte, ProSeries, UltraTax, CCH all support MFA)
Require MFA for email accounts (Microsoft 365, Google Workspace have built-in MFA)
Implement MFA for remote access and VPN connections
Enable MFA on cloud storage (Dropbox, OneDrive, SharePoint, etc.)
Use MFA for administrative access to servers, firewalls, and network equipment
Consider hardware security keys (YubiKey, Titan) for highest-privilege accounts
Document MFA requirements in your WISP and security policies

Acceptable second factors include: authenticator apps (Microsoft Authenticator, Google Authenticator, Duo), SMS text codes (least secure option), hardware tokens, biometrics (fingerprint, facial recognition), or push notifications to verified devices. SMS should only be used if no other option is available.

Network Security and Firewall Configuration

Required Network Security Controls:

Firewall Protection: Hardware firewall at network perimeter, software firewalls on all endpoints
Network Segmentation: Separate guest Wi-Fi from business network, isolate sensitive systems
Wireless Security: WPA3 encryption, strong Wi-Fi passwords changed quarterly, hidden SSIDs for business networks
Intrusion Detection: Systems to detect and alert on suspicious network activity
VPN Requirements: Mandatory VPN for remote access, never direct RDP or VNC exposure to internet
Port Security: Close unnecessary ports, restrict access to required services only
Regular Reviews: Quarterly review of firewall rules and network access controls

Endpoint Protection and Patch Management

Every desktop, laptop, and mobile device represents a potential entry point for attackers. Comprehensive endpoint protection goes far beyond basic antivirus software.

Endpoint Security Requirements:

Antivirus/Anti-Malware: Enterprise-grade protection on all devices, automatic updates, regular scans
Endpoint Detection and Response (EDR): Advanced threat detection beyond signature-based antivirus
Patch Management: Security updates installed within 30 days of release, critical patches within 7 days
Operating System Updates: Keep Windows, macOS, iOS, Android current with security patches
Application Updates: Update tax software, browsers, PDF readers, and all other applications regularly
Vulnerability Scanning: Monthly scans to identify missing patches and security weaknesses
End-of-Life Management: Replace or isolate systems that no longer receive security updates

Security Monitoring and Logging

You can't protect what you can't see. Security monitoring and comprehensive logging allow you to detect suspicious activity, investigate incidents, and demonstrate compliance during audits.

Monitoring and Logging Requirements:

Authentication Logging: Record all login attempts (successful and failed), track privileged account use
Access Logging: Log who accessed what client files and when
Change Logging: Track system configuration changes, software installations, security setting modifications
Network Monitoring: Monitor network traffic for unusual patterns, data exfiltration attempts
Log Retention: Maintain logs for minimum one year (longer for regulated data)
Alert Configuration: Automated alerts for failed logins, after-hours access, large data transfers
Regular Review: Weekly review of security logs during tax season, monthly during off-season

Backup and Disaster Recovery

Ransomware attacks targeting tax preparers spike during tax season. Your ability to recover quickly from ransomware, hardware failure, or natural disaster depends entirely on your backup strategy.

Backup Requirements for Tax Data:

3-2-1 Rule: Three copies of data, on two different media types, with one copy offsite
Backup Frequency: Daily during tax season, at minimum weekly year-round
Encryption: All backup media must be encrypted (especially cloud and offsite backups)
Immutable Backups: Protection against ransomware deleting or encrypting backups
Regular Testing: Monthly backup restoration tests to verify recoverability
Documented Procedures: Step-by-step recovery procedures for different scenarios
Retention Policies: Maintain backups for seven years to match tax record retention requirements

Consider working with a security assessment provider to evaluate your current technical safeguards against IRS Publication 4557 requirements. Many firms discover gaps in encryption, MFA coverage, or monitoring capabilities that can be addressed before audit or breach.

Tax Season Security Hardening Timeline

Tax season represents your highest-risk period. Client data flows increase dramatically, employees work longer hours (increasing fatigue and errors), phishing attacks surge, and cybercriminals focus specifically on tax preparers. A proactive security hardening timeline ensures you're protected before the rush begins.

October: Critical Preparation Month

October is your window for tax season security preparation. With tax season beginning in January and peak filing season running through April, October provides adequate time to complete security reviews, address findings, train staff, and implement new controls before the rush begins.

Complete Annual WISP Review: Review and update your Written Information Security Plan
Conduct Risk Assessment: Identify new risks from changed technology, staff, or processes
Annual Security Training: Complete required employee security training before tax season
Access Control Audit: Review who has access to what systems, remove unnecessary privileges
Vendor Security Review: Verify tax software vendor security certifications and agreements
Test Backup Recovery: Perform full restoration test to verify backup integrity
Patch and Update Systems: Install all security updates before heavy workload begins
Review Incident Response Plan: Update contact lists, test notification procedures

November-December: Implementation and Testing

Address gaps identified in October security review
Implement new security controls or update existing ones
Deploy tax software updates and verify MFA configuration
Test remote access and VPN capabilities before heavy use
Conduct phishing simulation to test employee awareness
Review and update physical security (locks, shredders, clean desk policies)
Finalize security monitoring and alerting configurations
Send pre-tax season security reminders to all staff

January-April: Enhanced Monitoring and Vigilance

Weekly Security Log Reviews: Increase monitoring frequency during peak season
Daily Backup Verification: Confirm backups complete successfully every day
Phishing Alert Emails: Send weekly security reminders about seasonal scams
Access Monitoring: Watch for unusual access patterns, after-hours activity, bulk data access
Rapid Incident Response: Investigate any suspicious activity immediately—don't wait
Staff Check-ins: Regular reminders about security policies, especially for temporary staff
Vendor Monitoring: Track any vendor security incidents or service disruptions

Phishing Surge Alert:

The IRS reports that phishing attacks targeting tax professionals increase 300-400% during tax season. Common scams include fake IRS emails, W-2 requests from "clients," tax software update notifications, and client impersonation. Train staff to verify all requests through independent channels before responding.

May-September: Review, Update, and Plan

Conduct post-tax season security review and lessons learned
Document any incidents, near-misses, or security challenges encountered
Review security metrics (failed logins, phishing reports, access violations)
Update security policies based on tax season experience
Plan security improvements or technology upgrades for next year
Conduct summer employee security refresher training
Review and renew vendor contracts and security agreements
Prepare budget requests for security improvements

Need Help with Tax Season Security Hardening?

Many CPA firms engage security advisors in October to conduct rapid security assessments before tax season. A focused 3-week security assessment can identify critical gaps, provide actionable remediation plans, and help prioritize security investments.

For firms needing ongoing support, a part-time vCISO engagement provides year-round security leadership, WISP maintenance, vendor management, and incident response capabilities without the cost of a full-time security executive.

Common IRS Audit Findings and How to Avoid Them

While the IRS doesn't conduct traditional "security audits" of tax preparers, several enforcement mechanisms can expose security deficiencies: FTC investigations, state board complaints, e-file provider reviews, and data breach investigations. Based on enforcement actions and industry guidance, certain failures appear repeatedly.

Finding #1: No Documented WISP or Severely Outdated Plan

The Issue: Many firms either have no Written Information Security Plan at all, or have a WISP created years ago that doesn't reflect current operations, technology, or threats.

Why It Matters: The FTC Safeguards Rule explicitly requires a written plan. "We follow security best practices" without documentation doesn't satisfy legal requirements. Outdated WISPs (referencing discontinued software, departed employees, or obsolete procedures) demonstrate lack of required annual review.

How to Avoid:

Create a WISP using IRS Publication 5708 template or work with security advisor
Review and update WISP annually (October recommended timing)
Document review date and changes made with each update
Ensure WISP reflects current technology stack, vendors, and procedures
Keep WISP accessible to employees and available for regulatory review

Finding #2: Lack of Employee Security Training

The Issue: No documented security training program, or training that occurred once years ago without refreshers.

Why It Matters: Human error causes the majority of data breaches. Employees who don't receive regular security training fall victim to phishing, mishandle sensitive data, use weak passwords, and violate security policies unknowingly.

How to Avoid:

Conduct initial security training within first week of employment
Provide annual refresher training to all staff (October/November timing ideal)
Document training dates, attendees, and topics covered
Include phishing simulations to test and reinforce training
Send security reminders during tax season when threats spike
Require acknowledgment of security policies in writing

Finding #3: Weak Passwords Without Multi-Factor Authentication

The Issue: Shared passwords, weak passwords (like "Tax2025"), no password complexity requirements, and no multi-factor authentication implementation.

Why It Matters: The FTC Safeguards Rule specifically requires multi-factor authentication. Password compromises are the leading attack vector for tax preparer breaches. A single compromised credential can expose thousands of client records.

How to Avoid:

Implement MFA on all systems touching client data (tax software, email, remote access)
Enforce strong password requirements (12+ characters, complexity)
Deploy password manager to all employees
Prohibit password sharing or use of shared accounts
Implement automatic password expiration (90 days maximum)
Monitor and alert on failed login attempts

Finding #4: Unencrypted Client Data

The Issue: Client data transmitted via unencrypted email, stored on unencrypted devices, or backed up without encryption.

Why It Matters: The Safeguards Rule requires encryption of customer information. A stolen laptop with unencrypted tax returns represents a massive breach requiring notification to potentially thousands of clients. Many state data breach laws consider encrypted data lost but not "breached."

How to Avoid:

Enable full disk encryption on all devices (BitLocker, FileVault)
Use encrypted email or secure client portals for document transmission
Encrypt all backup media, especially cloud and offsite backups
Implement file-level encryption for shared network drives
Use VPN for remote access and public Wi-Fi
Document encryption standards and verify implementation

Finding #5: No Documented Risk Assessment

The Issue: Inability to demonstrate that a risk assessment was conducted to identify security vulnerabilities and threats.

Why It Matters: Risk assessment is a core requirement of the FTC Safeguards Rule. Your security safeguards must be based on identified risks—not generic best practices without connection to your specific environment.

How to Avoid:

Conduct formal risk assessment annually (October timing aligns with tax season prep)
Document identified risks, likelihood, potential impact, and mitigation strategies
Update risk assessment when adding new technology or services
Consider professional security assessment services for comprehensive evaluation
Include risk assessment results in WISP documentation

Finding #6: Missing Vendor Security Agreements

The Issue: No written contracts requiring service providers to maintain appropriate security safeguards, or no documentation of vendor security capabilities.

Why It Matters: The Safeguards Rule requires written contracts with service providers and periodic assessment of their security. Your tax software vendor, cloud storage provider, and IT contractor all represent potential breach points.

How to Avoid:

Request SOC 2 reports or security certifications from all vendors
Ensure contracts explicitly require appropriate security safeguards
Include breach notification requirements in vendor agreements
Review vendor security annually or when renewing contracts
Document vendor due diligence and security assessments
Maintain list of all vendors with access to client data

Self-Assessment Checklist

Use this quick checklist to identify potential compliance gaps:

Do you have a current, documented WISP reviewed within the past year?
Have all employees completed security training in the past 12 months?
Is MFA enabled on tax software, email, and remote access?
Are all devices encrypted and protected with security software?
Do you have written contracts requiring vendor security safeguards?
Have you conducted a risk assessment documenting security vulnerabilities?
Do you have documented incident response and breach notification procedures?
Are backups encrypted, tested, and stored offsite?
Do you maintain security logs and review them regularly?
Have you designated a specific individual to coordinate security?

If you answered "no" to any question, that represents a compliance gap requiring attention before tax season.

Software-Specific Security Guidance

Your tax preparation software represents your most critical security dependency. While software vendors implement baseline security, you remain responsible for proper configuration, access controls, and secure usage. Here's guidance for major tax software platforms commonly used by CPA firms.

Drake Tax Software

Drake Security Best Practices:

Enable Two-Factor Authentication: Drake supports 2FA for e-file accounts—enable it for all users
Data File Encryption: Drake encrypts data files automatically, but verify encryption is enabled
User Access Controls: Create individual user accounts, never share login credentials
Audit Trail: Enable Drake's audit log to track who accesses which returns
Secure Document Storage: Use Drake's document management with encryption rather than separate file storage
Regular Updates: Install Drake updates promptly—they include security patches
Network Security: If using Drake on a network, ensure network-level security and access controls
Backup Procedures: Follow Drake's backup recommendations, encrypt backup files

Resource: Drake publishes a WISP compliance guide in their knowledge base. Reference article KB17826 for Drake-specific security configuration.

Intuit Lacerte, ProSeries, and ProConnect

Intuit Platform Security Best Practices:

Intuit Account Protection: Enable 2-step verification on Intuit accounts (required for e-file)
User Permissions: Use role-based access controls to limit user privileges
Mobile Device Management: If using mobile apps, configure MDM policies
Client Data Protection: Leverage Intuit's built-in encryption for data at rest and in transit
Integration Security: Review security of third-party app integrations (QuickBooks, etc.)
Cloud vs. Desktop: ProConnect Tax (cloud) has different security controls than desktop Lacerte/ProSeries
Safeguard Hub: Use Intuit's Security & Compliance Center for compliance resources
Activity Monitoring: Review user activity logs available in account settings

Resource: Intuit provides comprehensive security documentation at accountants.intuit.com/taxprocenter under Security & Compliance section.

CCH Axcess and ProSystem fx

CCH Platform Security Best Practices:

Single Sign-On (SSO): Implement SSO with MFA for Axcess platform access
Role-Based Security: Configure granular permissions based on job functions
Audit and Compliance Reports: Use CCH's built-in compliance reporting tools
Data Center Security: Review CCH's SOC 2 reports for cloud infrastructure security
Client Portal Security: Configure secure client portal settings for document exchange
Integration Controls: Manage security for integrations with other CCH products
Session Management: Configure automatic session timeout for inactive users
IP Restrictions: Consider IP whitelisting for access from known locations only

Resource: CCH provides security best practices documentation through the CCH Support Portal and annual security webinars for clients.

Thomson Reuters UltraTax CS and GoSystem Tax

Thomson Reuters Security Best Practices:

Multi-Factor Authentication: Enable MFA for all UltraTax CS user accounts
Virtual Office CS Security: If using cloud hosting, leverage Virtual Office CS security features
Database Security: Implement SQL Server security best practices for CS Professional Suite database
Document Management: Use FileCabinet CS with encryption for secure document storage
Network Architecture: Follow Thomson Reuters network security recommendations for on-premise deployments
User Activity Tracking: Enable and review audit logs in database
Backup Encryption: Ensure database backups are encrypted
Annual Security Review: Participate in Thomson Reuters security training and updates

Resource: Thomson Reuters publishes security configuration guides and maintains a Security Resource Center for CS Professional Suite customers.

Universal Security Practices Across All Platforms

Regardless of which tax software you use, these security practices apply universally:

Vendor SOC 2 Review: Request and review your software vendor's SOC 2 Type II report annually
Written Agreement: Ensure your software license or service agreement addresses security and breach notification
Patch Management: Install software updates within 30 days of release (7 days for critical security patches)
Access Termination: Remove user access immediately upon employee termination
Client Portal Security: If offering client portals, verify encryption, authentication, and access logging
Integration Security: Evaluate security of any third-party integrations or add-ons
Mobile Access: If supporting mobile access, require device encryption and MDM
Disaster Recovery: Understand vendor's disaster recovery capabilities and your responsibilities
Data Retention: Configure data retention settings to comply with 7-year tax record requirements
Vendor Communication: Maintain contact with vendor's security team for incident notifications

October Vendor Review Checklist:

As part of your October tax season preparation, complete these vendor security tasks:

Request updated SOC 2 reports from all software vendors
Verify MFA is enabled for all users on all platforms
Review and update user access permissions
Install all available software updates and security patches
Test backup and restore procedures for all platforms
Review vendor security configuration against vendor best practices
Document vendor security review in your WISP

Client Data Breach Notification Under IRS Rules

Despite your best security efforts, breaches can still occur. When they do, your response speed and thoroughness directly impact both regulatory consequences and client harm. Tax preparer breach notification requirements involve multiple agencies and strict timelines.

Who You Must Notify and When

1. Federal Trade Commission (FTC) - 30 Days

Requirement: Report security events affecting 500 or more individuals to the FTC within 30 days of discovering the incident.

How to Report: Submit notification through FTC's online reporting system at ftc.gov.

Information Required: Number of affected individuals, types of information involved, description of incident, remediation steps taken, and contact information.

2. Internal Revenue Service (IRS) - Immediately

Requirement: Report client data theft to your local IRS Stakeholder Liaison as soon as discovered. Speed is critical—the IRS can take steps to block fraudulent tax returns if notified quickly.

How to Report: Contact your local IRS Stakeholder Liaison (find contact at irs.gov). They will notify IRS Criminal Investigation and other appropriate offices.

Why This Matters: Early IRS notification allows them to flag affected Social Security numbers and prevent tax refund fraud—the primary goal of tax preparer breaches.

3. Law Enforcement - Immediately

Requirement: File reports with both FBI and local police.

How to Report: Contact your local FBI field office (fbi.gov/contact-us/field-offices) and file a police report with local law enforcement.

Why This Matters: Creates official record of incident for insurance claims and regulatory proceedings. Law enforcement may investigate and potentially identify perpetrators.

4. State Attorneys General - Varies by State

Requirement: Most states require notification to the state attorney general, especially for breaches affecting state residents. Requirements vary significantly by state.

How to Report: Check requirements for each state where affected clients reside. Some states require simultaneous notification to attorney general when notifying residents.

State-Specific Requirements: Timeline, threshold (number of affected residents), and information required differ by state. Some states require notification for any breach; others have minimum thresholds.

5. Affected Clients - Without Unreasonable Delay

Requirement: Send individual written notification to all affected clients. IRS recommends individual letters (not mass email) explaining what happened, what information was exposed, and what steps they should take.

Timing Coordination: Coordinate timing with law enforcement—they may request you delay client notification briefly to avoid tipping off perpetrators during active investigation. However, delays should be minimal.

Required Information in Client Letters:

Description of incident and what happened
Types of information exposed (SSN, financial data, etc.)
Steps you're taking to address the breach
Steps clients should take to protect themselves
Resources for identity theft protection and credit monitoring
Contact information for questions
Apology and commitment to improved security

6. Credit Reporting Agencies - If Required by State Law

Requirement: Some states require notification to major credit reporting agencies (Equifax, Experian, TransUnion) for large breaches.

Credit Monitoring Obligations: Many states require offering free credit monitoring to affected individuals. Budget for these costs in your incident response planning—they can be substantial for large breaches.

Breach Response Checklist

Immediate Actions (First 24 Hours):

Activate incident response team and document all actions taken
Contain the incident—isolate affected systems, change passwords, block unauthorized access
Preserve evidence—don't delete logs, emails, or other potential evidence
Notify IRS Stakeholder Liaison immediately
Contact FBI and file local police report
Engage forensic investigator to determine scope and cause
Notify professional liability (E&O) insurance carrier
Contact legal counsel experienced in data breach response

Short-Term Actions (Week 1):

Complete investigation to determine what data was accessed/stolen and how many individuals affected
Determine notification obligations based on affected states and number of individuals
Prepare notification letters for affected clients
Set up dedicated phone line and email for client questions
Arrange credit monitoring services if required
Begin remediation—patch vulnerabilities, improve security controls

Medium-Term Actions (Weeks 2-4):

Send client notification letters (coordinate timing with law enforcement)
File FTC notification (within 30 days if 500+ individuals affected)
Notify state attorneys general as required
Respond to client questions and concerns professionally and empathetically
Complete security remediation to prevent recurrence
Conduct lessons learned review with incident response team

Critical Warning: Tax Season Breaches

Breaches discovered during tax season (January-April) create extreme pressure. You must balance notification obligations with client service during your busiest period. This is why October preparation and November security hardening are so critical—preventing breaches is far preferable to responding to them during peak season. Have your incident response plan, vendor contacts, and legal counsel identified before tax season begins.

For detailed incident response planning guidance, including budget considerations and vendor selection, see our incident response budget guide for mid-market organizations.

How NonaSec Helps CPA Firms Achieve IRS Publication 4557 Compliance

NonaSec specializes in helping professional services firms—including CPA practices, accounting firms, and tax preparation businesses—build practical, cost-effective security programs that satisfy regulatory requirements without overwhelming limited IT resources or budgets.

Our Approach: Advisory, Not Just Implementation

We don't sell you security products or lock you into long-term implementation contracts. Instead, we provide expert advisory services that help you make informed decisions, prioritize effectively, and build security capabilities using your existing resources and vendors. Learn more about our advisory-only model.

Security Assessment for Accounting Firms

Our 3-week security assessment evaluates your current security posture against IRS Publication 4557 requirements, identifying compliance gaps and providing a prioritized roadmap for remediation.

Perfect for October tax season preparation:

Complete assessment in 3 weeks
WISP review and gap analysis
Technical security evaluation
Vendor security assessment
Detailed remediation roadmap
Budget planning for security improvements

Fractional vCISO for Year-Round Compliance

Our part-time vCISO service provides ongoing security leadership, WISP maintenance, vendor oversight, and incident response capabilities without the cost of a full-time security executive.

Ideal for firms needing ongoing support:

Annual WISP review and updates
Quarterly risk assessments
Vendor security management
Security policy development
Employee training coordination
Incident response planning and support

Accounting Industry Expertise

We understand the unique challenges CPA firms face: seasonal workload spikes, remote work environments, diverse technology stacks (multiple tax software platforms, cloud storage, client portals), limited IT staff, and tight budgets. Our recommendations are tailored to the accounting industry, not generic security advice.

Learn more about our accounting industry security services or explore our transparent pricing for security assessments and vCISO engagements.

Common Engagement Models for CPA Firms

October Assessment + Remediation Guidance

Timeline: 3 weeks in October

Deliverables: Comprehensive security assessment, WISP gap analysis, prioritized remediation roadmap, budget estimates

Best For: Firms conducting annual security review or preparing for first tax season after implementing new technology

WISP Development + Training Package

Timeline: 4-6 weeks

Deliverables: Customized WISP, security policies and procedures, employee training materials, vendor management templates

Best For: Firms without documented WISP or needing complete security program overhaul

Year-Round vCISO Engagement

Timeline: Ongoing (typically 8-16 hours/month)

Deliverables: Continuous security leadership, quarterly risk assessments, annual WISP updates, vendor oversight, incident response support

Best For: Firms needing ongoing security expertise without full-time hire, or firms with complex compliance requirements

Pre-Tax Season Security Hardening

Timeline: October-November (6-8 weeks)

Deliverables: Security assessment, critical gap remediation, employee training, monitoring configuration, incident response testing

Best For: Firms needing comprehensive security upgrade before tax season begins

Ready to Ensure Compliance Before Tax Season?

October is the critical month for tax season security preparation. Whether you need a rapid compliance assessment, WISP development, or ongoing security leadership, we can help you protect client data and satisfy IRS Publication 4557 requirements.

Security Assessment View Pricing

Frequently Asked Questions

What is IRS Publication 4557 and who must comply?

IRS Publication 4557 (Safeguarding Taxpayer Data) provides comprehensive security guidance for tax professionals. Federal law requires ALL professional tax return preparers to comply with the FTC Safeguards Rule, which mandates a Written Information Security Plan (WISP). This applies to CPA firms, enrolled agents, tax preparation services, and any business that prepares tax returns for compensation.

What are the required components of a WISP under IRS Publication 4557?

A compliant WISP must include: designation of a security coordinator, comprehensive risk assessment, administrative safeguards (employee training, access controls, vendor management), physical security measures, technical safeguards (encryption, multi-factor authentication, monitoring), incident response procedures, annual security plan reviews, and documentation of all security measures and training activities.

What are the breach notification requirements for tax preparers?

Tax preparers must report breaches affecting 500+ individuals to the FTC within 30 days. They must also notify the IRS Stakeholder Liaison immediately, contact state attorneys general as required by state law, notify all affected clients in writing, report to the FBI and local police, and offer credit monitoring in states where required. Speed is critical—the IRS can block fraudulent returns if notified quickly.

When should CPA firms begin tax season security hardening?

October is the critical month for tax season preparation. By October 1st, firms should complete their annual WISP review, update security policies, conduct employee security training, audit access controls, test backup and recovery systems, review vendor security agreements, and implement enhanced monitoring. This allows time to address gaps before the January-April peak filing season.

What are the most common IRS audit findings for tax preparer security?

Common findings include: no documented WISP or outdated plans, lack of employee security training, weak or shared passwords without MFA, unencrypted client data in transit or at rest, inadequate physical security controls, missing vendor security agreements, no documented risk assessments, absence of incident response plans, and failure to conduct annual security reviews.

Related Security Resources for CPA Firms

Security Budget Justification

Build the business case for security investments with ROI calculations, risk quantification, and executive-ready budget justification templates.

Incident Response Budget Planning

Comprehensive guide to incident response capabilities, vendor selection, and budget planning for mid-market organizations including accounting firms.

Security Metrics & Executive Dashboards

Build meaningful security metrics and executive dashboards that demonstrate compliance, track security posture, and support data-driven decisions.

October Is Your Window for Tax Season Security Preparation

Don't wait until December or January to address security gaps. Complete your IRS Publication 4557 compliance review in October to ensure you're protected before peak filing season begins.

Schedule Security Assessment View Pricing & Packages