CPA and EA firms
Security and compliance built around tax season.
Your clients trust you with Social Security numbers, bank details and EFIN access. Federal rules expect you to protect them in writing, and to prove it.
What applies to you
The rules, in plain language
- FTC Safeguards Rule. Tax preparation firms are financial institutions under the Gramm-Leach-Bliley Act, with no exemption for small practices. The rule requires a written information security program.
- IRS Publications 4557 and 5708. The IRS guide to safeguarding taxpayer data, and its template for a Written Information Security Plan.
- Form W-12, Line 11. Each PTIN renewal asks you to confirm you are aware that a written information security plan is required by law. What that means.
- The IRS Security Six. Antivirus, firewalls, multifactor authentication, backups, drive encryption and VPNs as a baseline.
Sources: IRS Tax Tip 2026-72, IRS Form W-12.
Common gaps in small tax practices
- A WISP downloaded from a template and never customized
- No named Qualified Individual
- MFA on email, but not on tax software, portals or remote access
- Backups that have never been test restored
- No written incident response plan or IRS Stakeholder Liaison contact
- Staff pasting client data into personal AI tools
We work your calendar
No surprises in busy season
May to October
Diagnostics, WISP builds and new security tools, while you have time to think.
November to December
PTIN renewal, insurance renewals, staff training and final checks before the season.
January to April
Quiet monitoring and support only. No changes to your systems while returns are going out.
Next step
Start with a fixed-price diagnostic.
A written gap assessment against the FTC Safeguards Rule and the IRS Security Six, with a prioritized plan to close each gap. $1,200 to $3,500, quoted before we start.